Edit tour

Windows Analysis Report
LayyB0R.exe

Overview

General Information

Sample name:	LayyB0R.exe
Analysis ID:	1585945
MD5:	46fe008a90da36053c2283f88baf327a
SHA1:	d4468911d1a9d52029a87045b7fe3e48288b0c68
SHA256:	00b1dbb467fd9362fd4f5a3e76ef16f3b4abe4fb620e62aa00a7bdae67c0042a
Tags:	exemalwaretrojanuser-Joker
Infos:

Detection

RHADAMANTHYS

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected RHADAMANTHYS Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Checks if the current machine is a virtual machine (disk enumeration)

Machine Learning detection for sample

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

AV process strings found (often used to terminate AV products)

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

One or more processes crash

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Uncommon Svchost Parent Process

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Keylogger Generic

Yara signature match

Classification

Process Tree

System is w10x64

LayyB0R.exe (PID: 5552 cmdline: "C:\Users\user\Desktop\LayyB0R.exe" MD5: 46FE008A90DA36053C2283F88BAF327A)

svchost.exe (PID: 768 cmdline: "C:\Windows\System32\svchost.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

fontdrvhost.exe (PID: 5624 cmdline: "C:\Windows\System32\fontdrvhost.exe" MD5: BBCB897697B3442657C7D6E3EDDBD25F)

WerFault.exe (PID: 4708 cmdline: C:\Windows\system32\WerFault.exe -u -p 5624 -s 136 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

WerFault.exe (PID: 6792 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5552 -s 468 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Rhadamanthys	According to PCrisk, Rhadamanthys is a stealer-type malware, and as its name implies - it is designed to extract data from infected machines.At the time of writing, this malware is spread through malicious websites mirroring those of genuine software such as AnyDesk, Zoom, Notepad++, and others. Rhadamanthys is downloaded alongside the real program, thus diminishing immediate user suspicion. These sites were promoted through Google ads, which superseded the legitimate search results on the Google search engine.	Sandworm	https://0xmrmagnezi.github.io/malware%20analysis/Rhadamanthys/ https://blog.cyble.com/2023/01/12/rhadamanthys-new-stealer-spreading-through-google-ads/ https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023 https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.talosintelligence.com/highlighting-ta866-asylum-ambuscade/	https://malpedia.caad.fkie.fraunhofer.de/details/win.rhadamanthys

Malware Configuration

Threatname: Rhadamanthys

{"C2 url": "https://154.216.20.162:1950/ea67a7c847f6620fc89/5mhwlxfi.wrqga"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1505624302.0000000002120000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000003.1491298614.0000000002190000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.1494146858.00000000005F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000000.00000003.1494152729.0000000000649000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1450:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000003.1493458753.0000000002DD0000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000002.00000003.1505712687.0000000004AB0000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000000.00000003.1493301738.0000000002BB0000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000002.00000003.1505920756.0000000004CD0000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000000.00000002.1505769565.0000000002270000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000002.1569395693.0000000002DD0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
Process Memory Space: LayyB0R.exe PID: 5552	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: svchost.exe PID: 768	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author
2.3.svchost.exe.4ab0000.0.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0.3.LayyB0R.exe.2dd0000.8.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
2.3.svchost.exe.4cd0000.7.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
2.3.svchost.exe.4ab0000.6.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0.3.LayyB0R.exe.2dd0000.8.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
2.3.svchost.exe.4ab0000.6.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0.3.LayyB0R.exe.2bb0000.7.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Click to see the 2 entries

Sigma Signatures

System Summary

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\svchost.exe", CommandLine: "C:\Windows\System32\svchost.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\LayyB0R.exe", ParentImage: C:\Users\user\Desktop\LayyB0R.exe, ParentProcessId: 5552, ParentProcessName: LayyB0R.exe, ProcessCommandLine: "C:\Windows\System32\svchost.exe", ProcessId: 768, ProcessName: svchost.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: "C:\Windows\System32\svchost.exe", CommandLine: "C:\Windows\System32\svchost.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\LayyB0R.exe", ParentImage: C:\Users\user\Desktop\LayyB0R.exe, ParentProcessId: 5552, ParentProcessName: LayyB0R.exe, ProcessCommandLine: "C:\Windows\System32\svchost.exe", ProcessId: 768, ProcessName: svchost.exe

Suricata Signatures

ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-08T15:01:15.325933+0100	2854802	1	Domain Observed Used for C2 Detected	154.216.20.162	1950	192.168.2.8	49704	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: LayyB0R.exe

Avira: detected

Found malware configuration

Source: 00000000.00000003.1481064905.0000000002190000.00000004.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: Rhadamanthys {"C2 url": "https://154.216.20.162:1950/ea67a7c847f6620fc89/5mhwlxfi.wrqga"}

Multi AV Scanner detection for submitted file

Source: LayyB0R.exe

Virustotal: Detection: 37%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: LayyB0R.exe

Joe Sandbox ML: detected

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\LayyB0R.exe

Unpacked PE file: 0.2.LayyB0R.exe.400000.0.unpack

Source: LayyB0R.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\LayyB0R.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source:	Binary string: wkernel32.pdb source: LayyB0R.exe, 00000000.00000003.1493130447.0000000002CD0000.00000004.00000001.00020000.00000000.sdmp, LayyB0R.exe, 00000000.00000003.1493062939.0000000002BB0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1505511755.0000000004B30000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1505417931.0000000000D00000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: LayyB0R.exe, 00000000.00000003.1493458753.0000000002DD0000.00000004.00000001.00020000.00000000.sdmp, LayyB0R.exe, 00000000.00000003.1493301738.0000000002BB0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1505712687.0000000004AB0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1505920756.0000000004CD0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: LayyB0R.exe, 00000000.00000003.1492245077.0000000002BB0000.00000004.00000001.00020000.00000000.sdmp, LayyB0R.exe, 00000000.00000003.1492403614.0000000002DA0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1496638560.0000000004CA0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1495210461.0000000004AB0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: LayyB0R.exe, 00000000.00000003.1492743542.0000000002BB0000.00000004.00000001.00020000.00000000.sdmp, LayyB0R.exe, 00000000.00000003.1492884460.0000000002D50000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1505025841.0000000004C50000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1497662804.0000000004AB0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: LayyB0R.exe, 00000000.00000003.1492245077.0000000002BB0000.00000004.00000001.00020000.00000000.sdmp, LayyB0R.exe, 00000000.00000003.1492403614.0000000002DA0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1496638560.0000000004CA0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1495210461.0000000004AB0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: LayyB0R.exe, 00000000.00000003.1492743542.0000000002BB0000.00000004.00000001.00020000.00000000.sdmp, LayyB0R.exe, 00000000.00000003.1492884460.0000000002D50000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1505025841.0000000004C50000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1497662804.0000000004AB0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdbUGP source: LayyB0R.exe, 00000000.00000003.1493130447.0000000002CD0000.00000004.00000001.00020000.00000000.sdmp, LayyB0R.exe, 00000000.00000003.1493062939.0000000002BB0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1505511755.0000000004B30000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1505417931.0000000000D00000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdbUGP source: LayyB0R.exe, 00000000.00000003.1493458753.0000000002DD0000.00000004.00000001.00020000.00000000.sdmp, LayyB0R.exe, 00000000.00000003.1493301738.0000000002BB0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1505712687.0000000004AB0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1505920756.0000000004CD0000.00000004.00000001.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\LayyB0R.exe	Code function: 0_2_00431B09 FindFirstFileExW,		0_2_00431B09
Source: C:\Users\user\Desktop\LayyB0R.exe	Code function: 0_2_02151D70 FindFirstFileExW,		0_2_02151D70

Source: C:\Windows\System32\fontdrvhost.exe

Code function: 4x nop then dec esp

6_2_00000227FA630511

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 154.216.20.162:1950 -> 192.168.2.8:49704

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe

Network Connect: 154.216.20.162 1950

Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://154.216.20.162:1950/ea67a7c847f6620fc89/5mhwlxfi.wrqga

Source: global traffic

TCP traffic: 192.168.2.8:49704 -> 154.216.20.162:1950

Source: Joe Sandbox View

ASN Name: SKHT-ASShenzhenKatherineHengTechnologyInformationCo SKHT-ASShenzhenKatherineHengTechnologyInformationCo

Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.162
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.162
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.162
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.162
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.162
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.162
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.162
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.162
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.162
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.162
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.162
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.162
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.162
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.162
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.162
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.162
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.162
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.162
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.162
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.162
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.162
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.162
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.162
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.162
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.162
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.162
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.162
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.162
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.162
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.162
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.162
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.162
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.162
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.162
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.162
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.162
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.162
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.162
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.162
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.162
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.162
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.162
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.162
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.162
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.162
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.162
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.162
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.162
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.162
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.20.162

Source: Amcache.hve.9.dr	String found in binary or memory: http://upx.sf.net
Source: svchost.exe, 00000002.00000002.1568774447.000000000043C000.00000004.00000010.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1569099723.000000000090C000.00000004.00000020.00020000.00000000.sdmp, fontdrvhost.exe, fontdrvhost.exe, 00000006.00000002.1659165600.00000227FA630000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: https://154.216.20.162:1950/ea67a7c847f6620fc89/5mhwlxfi.wrqga
Source: svchost.exe, 00000002.00000002.1569099723.000000000090C000.00000004.00000020.00020000.00000000.sdmp, fontdrvhost.exe, 00000006.00000002.1659165600.00000227FA630000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: https://154.216.20.162:1950/ea67a7c847f6620fc89/5mhwlxfi.wrqgakernelbasentdllkernel32GetProcessMitig
Source: svchost.exe, 00000002.00000002.1568774447.000000000043C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://154.216.20.162:1950/ea67a7c847f6620fc89/5mhwlxfi.wrqgax
Source: svchost.exe, 00000002.00000003.1534747651.00000000009A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cloudflare-dns.com/dns-query
Source: svchost.exe, 00000002.00000003.1534747651.00000000009A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cloudflare-dns.com/dns-queryPOSTContent-TypeContent-LengthHostapplication/dns-message%dMachi

Source: LayyB0R.exe, 00000000.00000003.1493458753.0000000002DD0000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: DirectInput8Create

memstr_c4c62a55-9

Source: LayyB0R.exe, 00000000.00000003.1493458753.0000000002DD0000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_28502a4a-0

Source: Yara match	File source: 2.3.svchost.exe.4ab0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.LayyB0R.exe.2dd0000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.svchost.exe.4cd0000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.svchost.exe.4ab0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.LayyB0R.exe.2dd0000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.svchost.exe.4ab0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.LayyB0R.exe.2bb0000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1493458753.0000000002DD0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1505712687.0000000004AB0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1493301738.0000000002BB0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1505920756.0000000004CD0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LayyB0R.exe PID: 5552, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 768, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.1505624302.0000000002120000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000003.1494152729.0000000000649000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown

Source: C:\Windows\System32\fontdrvhost.exe	Code function: 6_2_00000227FA631CF4 NtAcceptConnectPort,CloseHandle,	6_2_00000227FA631CF4
Source: C:\Windows\System32\fontdrvhost.exe	Code function: 6_2_00000227FA6315C0 NtAcceptConnectPort,	6_2_00000227FA6315C0
Source: C:\Windows\System32\fontdrvhost.exe	Code function: 6_2_00000227FA630AC8 NtAcceptConnectPort,NtAcceptConnectPort,	6_2_00000227FA630AC8
Source: C:\Windows\System32\fontdrvhost.exe	Code function: 6_2_00000227FA631AA4 NtAcceptConnectPort,NtAcceptConnectPort,	6_2_00000227FA631AA4

Source: C:\Users\user\Desktop\LayyB0R.exe	Code function: 0_2_004381D2	0_2_004381D2
Source: C:\Users\user\Desktop\LayyB0R.exe	Code function: 0_2_0042C231	0_2_0042C231
Source: C:\Users\user\Desktop\LayyB0R.exe	Code function: 0_2_0042C400	0_2_0042C400
Source: C:\Users\user\Desktop\LayyB0R.exe	Code function: 0_2_0214C667	0_2_0214C667
Source: C:\Users\user\Desktop\LayyB0R.exe	Code function: 0_2_02158439	0_2_02158439
Source: C:\Users\user\Desktop\LayyB0R.exe	Code function: 0_2_0214C498	0_2_0214C498
Source: C:\Windows\System32\fontdrvhost.exe	Code function: 6_2_00000227FA630C70	6_2_00000227FA630C70

Source: C:\Users\user\Desktop\LayyB0R.exe	Code function: String function: 0042CD90 appears 33 times
Source: C:\Users\user\Desktop\LayyB0R.exe	Code function: String function: 0214CFF7 appears 33 times

Source: C:\Users\user\Desktop\LayyB0R.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5552 -s 468

Source: LayyB0R.exe	Binary or memory string: OriginalFilename vs LayyB0R.exe
Source: LayyB0R.exe, 00000000.00000003.1493130447.0000000002CD0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \[FileVersionProductVersionFileDescriptionCompanyNameProductNameOriginalFilenameInternalNameLegalCopyright vs LayyB0R.exe
Source: LayyB0R.exe, 00000000.00000003.1481064905.0000000002190000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCFF Explorer.exe: vs LayyB0R.exe
Source: LayyB0R.exe, 00000000.00000003.1493062939.0000000002BB0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \[FileVersionProductVersionFileDescriptionCompanyNameProductNameOriginalFilenameInternalNameLegalCopyright vs LayyB0R.exe
Source: LayyB0R.exe, 00000000.00000003.1493130447.0000000002D20000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekernel32j% vs LayyB0R.exe
Source: LayyB0R.exe, 00000000.00000003.1493062939.0000000002C42000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekernel32j% vs LayyB0R.exe
Source: LayyB0R.exe, 00000000.00000003.1492743542.0000000002CD3000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs LayyB0R.exe
Source: LayyB0R.exe, 00000000.00000003.1492245077.0000000002D28000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs LayyB0R.exe
Source: LayyB0R.exe, 00000000.00000002.1505624302.0000000002120000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCFF Explorer.exe: vs LayyB0R.exe
Source: LayyB0R.exe, 00000000.00000003.1493458753.0000000002FB1000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameKernelbase.dllj% vs LayyB0R.exe
Source: LayyB0R.exe, 00000000.00000003.1492403614.0000000002F26000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs LayyB0R.exe
Source: LayyB0R.exe, 00000000.00000003.1493301738.0000000002BB0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameKernelbase.dllj% vs LayyB0R.exe
Source: LayyB0R.exe, 00000000.00000002.1505362557.0000000000449000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameCFF Explorer.exe: vs LayyB0R.exe
Source: LayyB0R.exe, 00000000.00000003.1492884460.0000000002E7D000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs LayyB0R.exe
Source: LayyB0R.exe, 00000000.00000003.1491424479.0000000000449000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameCFF Explorer.exe: vs LayyB0R.exe

Source: LayyB0R.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.1505624302.0000000002120000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000003.1494152729.0000000000649000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12

Source: LayyB0R.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.evad.winEXE@7/5@0/1

Source: C:\Users\user\Desktop\LayyB0R.exe

Code function: 0_3_0064A47E CreateToolhelp32Snapshot,Module32First,

0_3_0064A47E

Source: C:\Windows\SysWOW64\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\MSCTF.Asm.{00000009-7082a096-77f7-1e6135-d52f738ed9ed}
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5624

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\d3901dad-fa3d-4e68-9739-2cbce91be7de

Jump to behavior

Source: LayyB0R.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\LayyB0R.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: LayyB0R.exe

Virustotal: Detection: 37%

Source: unknown	Process created: C:\Users\user\Desktop\LayyB0R.exe "C:\Users\user\Desktop\LayyB0R.exe"
Source: C:\Users\user\Desktop\LayyB0R.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\System32\svchost.exe"
Source: C:\Users\user\Desktop\LayyB0R.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5552 -s 468
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\System32\fontdrvhost.exe "C:\Windows\System32\fontdrvhost.exe"
Source: C:\Windows\System32\fontdrvhost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 5624 -s 136
Source: C:\Users\user\Desktop\LayyB0R.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\System32\svchost.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\System32\fontdrvhost.exe "C:\Windows\System32\fontdrvhost.exe"	Jump to behavior

Source: C:\Users\user\Desktop\LayyB0R.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LayyB0R.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LayyB0R.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mswsock.dll	Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: LayyB0R.exe

Static file information: File size 2693632 > 1048576

Source: C:\Users\user\Desktop\LayyB0R.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source:	Binary string: wkernel32.pdb source: LayyB0R.exe, 00000000.00000003.1493130447.0000000002CD0000.00000004.00000001.00020000.00000000.sdmp, LayyB0R.exe, 00000000.00000003.1493062939.0000000002BB0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1505511755.0000000004B30000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1505417931.0000000000D00000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: LayyB0R.exe, 00000000.00000003.1493458753.0000000002DD0000.00000004.00000001.00020000.00000000.sdmp, LayyB0R.exe, 00000000.00000003.1493301738.0000000002BB0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1505712687.0000000004AB0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1505920756.0000000004CD0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: LayyB0R.exe, 00000000.00000003.1492245077.0000000002BB0000.00000004.00000001.00020000.00000000.sdmp, LayyB0R.exe, 00000000.00000003.1492403614.0000000002DA0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1496638560.0000000004CA0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1495210461.0000000004AB0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: LayyB0R.exe, 00000000.00000003.1492743542.0000000002BB0000.00000004.00000001.00020000.00000000.sdmp, LayyB0R.exe, 00000000.00000003.1492884460.0000000002D50000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1505025841.0000000004C50000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1497662804.0000000004AB0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: LayyB0R.exe, 00000000.00000003.1492245077.0000000002BB0000.00000004.00000001.00020000.00000000.sdmp, LayyB0R.exe, 00000000.00000003.1492403614.0000000002DA0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1496638560.0000000004CA0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1495210461.0000000004AB0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: LayyB0R.exe, 00000000.00000003.1492743542.0000000002BB0000.00000004.00000001.00020000.00000000.sdmp, LayyB0R.exe, 00000000.00000003.1492884460.0000000002D50000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1505025841.0000000004C50000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1497662804.0000000004AB0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdbUGP source: LayyB0R.exe, 00000000.00000003.1493130447.0000000002CD0000.00000004.00000001.00020000.00000000.sdmp, LayyB0R.exe, 00000000.00000003.1493062939.0000000002BB0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1505511755.0000000004B30000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1505417931.0000000000D00000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdbUGP source: LayyB0R.exe, 00000000.00000003.1493458753.0000000002DD0000.00000004.00000001.00020000.00000000.sdmp, LayyB0R.exe, 00000000.00000003.1493301738.0000000002BB0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1505712687.0000000004AB0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1505920756.0000000004CD0000.00000004.00000001.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\LayyB0R.exe

Unpacked PE file: 0.2.LayyB0R.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.gima:W;.tabiya:W;.rsrc:R; vs .text:ER;.textbss:EW;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\LayyB0R.exe

Unpacked PE file: 0.2.LayyB0R.exe.400000.0.unpack

Source: LayyB0R.exe

Static PE information: real checksum: 0x9e92e should be: 0x29e92e

Source: LayyB0R.exe	Static PE information: section name: .gima
Source: LayyB0R.exe	Static PE information: section name: .tabiya

Source: C:\Users\user\Desktop\LayyB0R.exe	Code function: 0_3_0043BC39 push ecx; ret	0_3_0043BC59
Source: C:\Users\user\Desktop\LayyB0R.exe	Code function: 0_3_0043B8EC push edi; ret	0_3_0043B8F8
Source: C:\Users\user\Desktop\LayyB0R.exe	Code function: 0_3_0043D2FB push edi; ret	0_3_0043D2CC
Source: C:\Users\user\Desktop\LayyB0R.exe	Code function: 0_3_0043A0F9 push FFFFFF82h; iretd	0_3_0043A0FB
Source: C:\Users\user\Desktop\LayyB0R.exe	Code function: 0_3_0043FE8F push esi; ret	0_3_0043FEA1
Source: C:\Users\user\Desktop\LayyB0R.exe	Code function: 0_3_00439F6A push eax; ret	0_3_00439F75
Source: C:\Users\user\Desktop\LayyB0R.exe	Code function: 0_3_0043DD01 push esi; ret	0_3_0043DD6A
Source: C:\Users\user\Desktop\LayyB0R.exe	Code function: 0_3_0043B1DC push eax; ret	0_3_0043B1DD
Source: C:\Users\user\Desktop\LayyB0R.exe	Code function: 0_3_0064EA27 push edx; retf	0_3_0064EA67
Source: C:\Users\user\Desktop\LayyB0R.exe	Code function: 0_3_0064F40C push ebx; retf	0_3_0064F470
Source: C:\Users\user\Desktop\LayyB0R.exe	Code function: 0_3_0064DAE7 push ebx; retf	0_3_0064DAEB
Source: C:\Users\user\Desktop\LayyB0R.exe	Code function: 0_3_0064C4ED push edi; ret	0_3_0064C4DF
Source: C:\Users\user\Desktop\LayyB0R.exe	Code function: 0_3_0064C4D4 push edi; ret	0_3_0064C4DF
Source: C:\Users\user\Desktop\LayyB0R.exe	Code function: 0_3_0064F4DE push ebx; retf	0_3_0064F470
Source: C:\Users\user\Desktop\LayyB0R.exe	Code function: 0_3_0064C0D9 push edx; iretd	0_3_0064C0DA
Source: C:\Users\user\Desktop\LayyB0R.exe	Code function: 0_3_0064C48D push ebx; retf	0_3_0064C490
Source: C:\Users\user\Desktop\LayyB0R.exe	Code function: 0_3_0064D296 push edx; iretd	0_3_0064D297
Source: C:\Users\user\Desktop\LayyB0R.exe	Code function: 0_3_0064DD66 push ecx; iretd	0_3_0064DD69
Source: C:\Users\user\Desktop\LayyB0R.exe	Code function: 0_3_0064B7F3 push edi; iretd	0_3_0064B80F
Source: C:\Users\user\Desktop\LayyB0R.exe	Code function: 0_3_0064E592 push edx; iretd	0_3_0064E593
Source: C:\Users\user\Desktop\LayyB0R.exe	Code function: 0_2_0043B8EC push edi; ret	0_2_0043B8F8
Source: C:\Users\user\Desktop\LayyB0R.exe	Code function: 0_2_0043A0F9 push FFFFFF82h; iretd	0_2_0043A0FB
Source: C:\Users\user\Desktop\LayyB0R.exe	Code function: 0_2_00438904 push ecx; ret	0_2_00438917
Source: C:\Users\user\Desktop\LayyB0R.exe	Code function: 0_2_0043B1DC push eax; ret	0_2_0043B1DD
Source: C:\Users\user\Desktop\LayyB0R.exe	Code function: 0_2_0043D2FB push edi; ret	0_2_0043D2CC
Source: C:\Users\user\Desktop\LayyB0R.exe	Code function: 0_2_0043BC39 push ecx; ret	0_2_0043BC59
Source: C:\Users\user\Desktop\LayyB0R.exe	Code function: 0_2_0043DD01 push esi; ret	0_2_0043DD6A
Source: C:\Users\user\Desktop\LayyB0R.exe	Code function: 0_2_0043FE8F push esi; ret	0_2_0043FEA1
Source: C:\Users\user\Desktop\LayyB0R.exe	Code function: 0_2_00439F6A push eax; ret	0_2_00439F75
Source: C:\Users\user\Desktop\LayyB0R.exe	Code function: 0_2_02158B6B push ecx; ret	0_2_02158B7E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_3_0047225C push eax; ret	2_3_0047225D

Source: LayyB0R.exe

Static PE information: section name: .text entropy: 7.632200892708984

Source: C:\Users\user\Desktop\LayyB0R.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Windows\SysWOW64\svchost.exe

Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI

Jump to behavior

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PnPEntity
Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PnPEntity

Query firmware table information (likely to detect VMs)

Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	System information queried: FirmwareTableInformation	Jump to behavior

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\LayyB0R.exe	API/Special instruction interceptor: Address: 7FFBCB7AD044
Source: C:\Windows\SysWOW64\svchost.exe	API/Special instruction interceptor: Address: 7FFBCB7AD044
Source: C:\Windows\SysWOW64\svchost.exe	API/Special instruction interceptor: Address: 4D4B83A

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Windows\SysWOW64\svchost.exe

File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: svchost.exe, 00000002.00000002.1569099723.0000000000900000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HOOKEXPLORER.EXE
Source: svchost.exe, 00000002.00000002.1569099723.0000000000900000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXE
Source: LayyB0R.exe, 00000000.00000003.1481064905.0000000002190000.00000004.00001000.00020000.00000000.sdmp, LayyB0R.exe, 00000000.00000002.1505624302.0000000002120000.00000040.00001000.00020000.00000000.sdmp, LayyB0R.exe, 00000000.00000002.1505362557.0000000000449000.00000040.00000001.01000000.00000003.sdmp, LayyB0R.exe, 00000000.00000003.1491424479.0000000000449000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: ORIGINALFILENAMECFF EXPLORER.EXE:
Source: svchost.exe, 00000002.00000002.1569099723.0000000000900000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXEAUTORUNS.EXEDUMPCAP.EXEDE4DOT.EXEHOOKEXPLORER.EXEILSPY.EXELORDPE.EXEDNSPY.EXEPETOOLS.EXEAUTORUNSC.EX
Source: svchost.exe, 00000002.00000002.1569099723.0000000000900000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: X64DBG.EXE
Source: LayyB0R.exe	Binary or memory string: CFF EXPLORER.EXE
Source: LayyB0R.exe, 00000000.00000003.1481064905.0000000002190000.00000004.00001000.00020000.00000000.sdmp, LayyB0R.exe, 00000000.00000002.1505624302.0000000002120000.00000040.00001000.00020000.00000000.sdmp, LayyB0R.exe, 00000000.00000002.1505362557.0000000000449000.00000040.00000001.01000000.00000003.sdmp, LayyB0R.exe, 00000000.00000003.1491424479.0000000000449000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: INTERNALNAMECFF EXPLORER.EXE
Source: svchost.exe, 00000002.00000002.1569099723.0000000000900000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AUTORUNS.EXE
Source: svchost.exe, 00000002.00000002.1569099723.0000000000900000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PETOOLS.EXE
Source: svchost.exe, 00000002.00000002.1569099723.0000000000900000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WINDUMP.EXE
Source: svchost.exe, 00000002.00000002.1569099723.0000000000900000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DUMPCAP.EXE
Source: svchost.exe, 00000002.00000002.1569099723.0000000000900000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DDLER.EXEIDA.EXEIDA64.EXEIMMUNITYDEBUGGER.EXEWINDUMP.EXEX64DBG.EXEX32DBG.EXEOLLYDBG.EXEP

Source: C:\Windows\SysWOW64\svchost.exe	File opened / queried: VBoxGuest	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0 name: Identifier	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File opened / queried: C:\Windows\SysWOW64\vboxservice.exe	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File opened / queried: C:\Windows\SysWOW64\vboxtray.exe	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File opened / queried: C:\Windows\SysWOW64\drivers\VBoxMouse.sys	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File opened / queried: VBoxTrayIPC	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File opened / queried: C:\Windows\SysWOW64\drivers\VBoxSF.sys	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File opened / queried: C:\Windows\SysWOW64\vboxhook.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosDate	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File opened / queried: \pipe\VBoxTrayIPC	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File opened / queried: C:\Windows\SysWOW64\drivers\VBoxVideo.sys	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File opened / queried: VBoxMiniRdrDN	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File opened / queried: C:\Windows\SysWOW64\drivers\VBoxGuest.sys	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\LayyB0R.exe

API coverage: 7.9 %

Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BaseBoard

Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystem

Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\LayyB0R.exe	Code function: 0_2_00431B09 FindFirstFileExW,		0_2_00431B09
Source: C:\Users\user\Desktop\LayyB0R.exe	Code function: 0_2_02151D70 FindFirstFileExW,		0_2_02151D70

Source: Amcache.hve.9.dr	Binary or memory string: VMware
Source: svchost.exe, 00000002.00000002.1569071986.0000000000874000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWMSAFD L2CAP [Bluetooth]RSVP UDPv6 Service Provider
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.9.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.9.dr	Binary or memory string: VMware-42 27 c5 9a 47 85 d6 84-53 49 ec ec 87 a6 6d 67
Source: Amcache.hve.9.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.9.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.9.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.9.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: svchost.exe, 00000002.00000002.1568964943.0000000000800000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.9.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: svchost.exe, 00000002.00000002.1568964943.0000000000800000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(
Source: Amcache.hve.9.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.9.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.9.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.9.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.9.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: svchost.exe, 00000002.00000003.1520981558.0000000000849000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-Hypervisor
Source: Amcache.hve.9.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: svchost.exe, 00000002.00000002.1569071986.0000000000874000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FApplication Management Group Policy>Microsoft-Windows-DHCPv6-Client@Microsoft-Windows-DiskDiagnostic>Microsoft-Windows-FilterManagerBMicrosoft-Windows-WLAN-AutoConfigDMicrosoft-Windows-BitLocker-Driver>Microsoft-Windows-BitLocker-APIJMicrosoft-Windows-GPIO-ClassExtensionHMicrosoft-Antimalware-ShieldProviderHMicrosoft-Windows-Hyper-V-Hypervisor@Microsoft-Windows-DistributedCOM@Microsoft-Windows-EventCollectorJMicrosoft-Windows-Fault-Tolerant-HeapDMicrosoft-Windows-IsolatedUserMode@Microsoft-Windows-WMPNSS-ServiceHMicrosoft-Windows-Devices-Background<Microsoft-Windows-Kernel-Power<Microsoft-Windows-OfflineFiles>Microsoft-Windows-OverlayFilter>Microsoft-Windows-NetworkBridgeJMicrosoft-Windows-ResourcePublication@Microsoft-Windows-Spell-Checking<Microsoft-Windows-SpellChecker>Microsoft-Windows-StartupRepairFMicrosoft-Windows-LanguagePackSetup<Microsoft-Windows-Time-ServiceJMicrosoft-Windows-Power-Meter-Polling>Microsoft-Windows-SetupPlatformHMicrosoft-Windows-SPB-ClassExtension>Microsoft-Windows-TaskScheduler>Microsoft-Windows-USB-MAUSBHOST@Microsoft-Windows-Kernel-GeneralBMicrosoft-Windows-WLAN-AutoConfigJMicrosoft-Windows-WindowsUpdateClient
Source: svchost.exe, 00000002.00000003.1505920756.0000000004CD0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: DisableGuestVmNetworkConnectivity
Source: svchost.exe, 00000002.00000003.1520981558.0000000000849000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-BitLocker-APIMicrosoft-Windows-BitLocker-DriverMicrosoft-Windows-Bits-ClientMicrosoft-Windows-Bluetooth-BthLEPrepairingMicrosoft-Windows-CoreSystem-InitMachineConfigMicrosoft-Windows-CoreSystem-NetProvision-JoinProviderOnlineMicrosoft-Windows-CorruptedFileRecovery-ClientMicrosoft-Windows-CorruptedFileRecovery-ServerMicrosoft-Windows-Devices-BackgroundMicrosoft-Windows-DfsSvcMicrosoft-Windows-Dhcp-ClientMicrosoft-Windows-DHCPv6-ClientMicrosoft-Windows-Diagnostics-NetworkingMicrosoft-Windows-Directory-Services-SAMMicrosoft-Windows-DiskDiagnosticMicrosoft-Windows-DistributedCOMMicrosoft-Windows-DNS-ClientMicrosoft-Windows-DriverFrameworks-UserModeMicrosoft-Windows-EnhancedStorage-EhStorTcgDrvMicrosoft-Windows-EventCollectorMicrosoft-Windows-EventlogMicrosoft-Windows-exFAT-SQMMicrosoft-Windows-FailoverClustering-ClientMicrosoft-Windows-Fat-SQMMicrosoft-Windows-Fault-Tolerant-HeapMicrosoft-Windows-FilterManagerMicrosoft-Windows-FirewallMicrosoft-Windows-FMSMicrosoft-Windows-FunctionDiscoveryHostMicrosoft-Windows-GPIO-ClassExtensionMicrosoft-Windows-GroupPolicyMicrosoft-Windows-HALMicrosoft-Windows-HttpEventMicrosoft-Windows-HttpServiceMicrosoft-Windows-Hyper-V-HypervisorMicrosoft-Windows-IphlpsvcMicrosoft-Windows-IsolatedUserModeMicrosoft-Windows-Kernel-BootMicrosoft-Windows-Kernel-GeneralMicrosoft-Windows-Kernel-Interrupt-SteeringMicrosoft-Windows-Kernel-IOMicrosoft-Windows-Kernel-PnPMicrosoft-Windows-Kernel-PowerMicrosoft-Windows-Kernel-Processor-PowerMicrosoft-Windows-Kernel-TmMicrosoft-Windows-Kernel-WHEAMicrosoft-Windows-Kernel-XDVMicrosoft-Windows-LanguagePackSetupMicrosoft-Windows-Memory-Diagnostic-Task-HandlerMicrosoft-Windows-MemoryDiagnostics-ResultsMicrosoft-Windows-MemoryDiagnostics-ScheduleMicrosoft-Windows-MountMgrMicrosoft-Windows-NDISMicrosoft-Windows-NdisImPlatformSysEvtProviderMicrosoft-Windows-NetworkBridgeMicrosoft-Windows-NtfsMicrosoft-Windows-Ntfs-UBPMMicrosoft-Windows-OfflineFilesMicrosoft-Windows-OverlayFilterMicrosoft-Windows-PersistentMemory-NvdimmMicrosoft-Windows-PersistentMemory-PmemDiskMicrosoft-Windows-Power-Meter-PollingMicrosoft-Windows-Power-TroubleshooterMicrosoft-Windows-ReFSMicrosoft-Windows-ReFS-v1Microsoft-Windows-ResetEngMicrosoft-Windows-Resource-Exhaustion-DetectorMicrosoft-Windows-ResourcePublicationMicrosoft-Windows-SCPNPMicrosoft-Windows-Serial-ClassExtensionMicrosoft-Windows-Serial-ClassExtension-V2Microsoft-Windows-ServicingMicrosoft-Windows-SetupMicrosoft-Windows-SetupPlatformMicrosoft-Windows-SPB-ClassExtensionMicrosoft-Windows-SPB-HIDI2CMicrosoft-Windows-Spell-CheckingMicrosoft-Windows-SpellCheckerMicrosoft-Windows-StartupRepairMicrosoft-Windows-Subsys-SMSSMicrosoft-Windows-TaskSchedulerMicrosoft-Windows-TerminalServices-LocalSessionManagerMicrosoft-Windows-TerminalServices-RemoteConnectionManagerMicrosoft-Windows-Time-ServiceMicrosoft-Windows-TPM-WMIMicrosoft-Windows-USB-CCIDMicrosoft-Windows-USB-MAUSBHOSTMicrosoft-Windows-USB-USBHUB3Microsoft-Windows-USB-USBXHCIMicrosoft-Windows-Use
Source: Amcache.hve.9.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.9.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.9.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.9.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.9.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.9.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.9.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.9.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual RAM
Source: svchost.exe, 00000002.00000003.1505920756.0000000004CD0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: EnableGuestVmNetworkConnectivity
Source: Amcache.hve.9.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: svchost.exe, 00000002.00000002.1569049203.000000000085C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HMicrosoft-Windows-Hyper-V-HypervisorHMicrosoft-Antimalware-ShieldProvider
Source: Amcache.hve.9.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\LayyB0R.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\LayyB0R.exe

Code function: 0_2_0042CB32 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0042CB32

Source: C:\Users\user\Desktop\LayyB0R.exe	Code function: 0_3_00439277 mov eax, dword ptr fs:[00000030h]	0_3_00439277
Source: C:\Users\user\Desktop\LayyB0R.exe	Code function: 0_3_00649D5B push dword ptr fs:[00000030h]	0_3_00649D5B
Source: C:\Users\user\Desktop\LayyB0R.exe	Code function: 0_2_00439277 mov eax, dword ptr fs:[00000030h]	0_2_00439277
Source: C:\Users\user\Desktop\LayyB0R.exe	Code function: 0_2_0212092B mov eax, dword ptr fs:[00000030h]	0_2_0212092B
Source: C:\Users\user\Desktop\LayyB0R.exe	Code function: 0_2_02120D90 mov eax, dword ptr fs:[00000030h]	0_2_02120D90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_3_00470283 mov eax, dword ptr fs:[00000030h]	2_3_00470283

Source: C:\Users\user\Desktop\LayyB0R.exe

Code function: 0_2_0042BEFA GetProcessHeap,HeapAlloc,HeapFree,HeapFree,VirtualFree,KiUserExceptionDispatcher,

0_2_0042BEFA

Source: C:\Users\user\Desktop\LayyB0R.exe	Code function: 0_2_0042CB32 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0042CB32
Source: C:\Users\user\Desktop\LayyB0R.exe	Code function: 0_2_0042CCC5 SetUnhandledExceptionFilter,	0_2_0042CCC5
Source: C:\Users\user\Desktop\LayyB0R.exe	Code function: 0_2_00431508 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00431508
Source: C:\Users\user\Desktop\LayyB0R.exe	Code function: 0_2_0042CFC3 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0042CFC3
Source: C:\Users\user\Desktop\LayyB0R.exe	Code function: 0_2_0214D22A SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0214D22A
Source: C:\Users\user\Desktop\LayyB0R.exe	Code function: 0_2_0214CF2C SetUnhandledExceptionFilter,	0_2_0214CF2C
Source: C:\Users\user\Desktop\LayyB0R.exe	Code function: 0_2_0215176F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0215176F
Source: C:\Users\user\Desktop\LayyB0R.exe	Code function: 0_2_0214CD99 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0214CD99

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe

Network Connect: 154.216.20.162 1950

Jump to behavior

Source: C:\Users\user\Desktop\LayyB0R.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\System32\svchost.exe"			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\System32\fontdrvhost.exe "C:\Windows\System32\fontdrvhost.exe"			Jump to behavior

Source: C:\Users\user\Desktop\LayyB0R.exe

Code function: 0_2_0042CDD5 cpuid

0_2_0042CDD5

Source: C:\Windows\SysWOW64\svchost.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\LayyB0R.exe

Code function: 0_2_0042CA19 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_0042CA19

Source: C:\Windows\SysWOW64\svchost.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: svchost.exe, 00000002.00000002.1569099723.0000000000900000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OllyDbg.exe
Source: Amcache.hve.9.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: svchost.exe, 00000002.00000002.1569099723.0000000000900000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: lordpe.exe
Source: Amcache.hve.9.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: svchost.exe, 00000002.00000002.1569099723.0000000000900000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: autoruns.exe
Source: Amcache.hve.9.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected RHADAMANTHYS Stealer

Source: Yara match	File source: 00000000.00000003.1491298614.0000000002190000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1494146858.00000000005F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1505769565.0000000002270000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1569395693.0000000002DD0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected RHADAMANTHYS Stealer

Source: Yara match	File source: 00000000.00000003.1491298614.0000000002190000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1494146858.00000000005F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1505769565.0000000002270000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1569395693.0000000002DD0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	31 Windows Management Instrumentation	1 DLL Side-Loading	111 Process Injection	23 Virtualization/Sandbox Evasion	21 Input Capture	1 System Time Discovery	Remote Services	21 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	111 Process Injection	LSASS Memory	661 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	23 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	4 Obfuscated Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	22 Software Packing	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	244 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
LayyB0R.exe	38%	Virustotal		Browse
LayyB0R.exe	100%	Avira	HEUR/AGEN.1312582
LayyB0R.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://154.216.20.162:1950/ea67a7c847f6620fc89/5mhwlxfi.wrqgakernelbasentdllkernel32GetProcessMitig	0%	Avira URL Cloud	safe
https://154.216.20.162:1950/ea67a7c847f6620fc89/5mhwlxfi.wrqga	0%	Avira URL Cloud	safe
https://154.216.20.162:1950/ea67a7c847f6620fc89/5mhwlxfi.wrqgax	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://154.216.20.162:1950/ea67a7c847f6620fc89/5mhwlxfi.wrqga	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://154.216.20.162:1950/ea67a7c847f6620fc89/5mhwlxfi.wrqgakernelbasentdllkernel32GetProcessMitig	svchost.exe, 00000002.00000002.1569099723.000000000090C000.00000004.00000020.00020000.00000000.sdmp, fontdrvhost.exe, 00000006.00000002.1659165600.00000227FA630000.00000040.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cloudflare-dns.com/dns-query	svchost.exe, 00000002.00000003.1534747651.00000000009A5000.00000004.00000020.00020000.00000000.sdmp	false		high
http://upx.sf.net	Amcache.hve.9.dr	false		high
https://cloudflare-dns.com/dns-queryPOSTContent-TypeContent-LengthHostapplication/dns-message%dMachi	svchost.exe, 00000002.00000003.1534747651.00000000009A5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://154.216.20.162:1950/ea67a7c847f6620fc89/5mhwlxfi.wrqgax	svchost.exe, 00000002.00000002.1568774447.000000000043C000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
154.216.20.162	unknown	Seychelles		135357	SKHT-ASShenzhenKatherineHengTechnologyInformationCo	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1585945
Start date and time:	2025-01-08 15:00:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	LayyB0R.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@7/5@0/1
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.73.29, 20.109.210.53, 40.126.31.71, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, login.live.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target svchost.exe, PID 768 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:01:25	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
154.216.20.162	aNfqvgu.exe	Get hash	malicious	RHADAMANTHYS	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SKHT-ASShenzhenKatherineHengTechnologyInformationCo	aNfqvgu.exe	Get hash	malicious	RHADAMANTHYS	Browse	154.216.20.162
	miori.x86.elf	Get hash	malicious	Unknown	Browse	45.207.240.67
	Jeffparish.docx	Get hash	malicious	Unknown	Browse	154.216.17.193
	wind.m68k.elf	Get hash	malicious	Mirai	Browse	154.216.17.34
	wind.sh4.elf	Get hash	malicious	Mirai	Browse	154.216.17.34
	wind.spc.elf	Get hash	malicious	Mirai	Browse	154.216.17.34
	wind.arm.elf	Get hash	malicious	Mirai	Browse	154.216.17.34
	wind.mips.elf	Get hash	malicious	Mirai	Browse	154.216.17.34
	wind.ppc.elf	Get hash	malicious	Mirai	Browse	154.216.17.34
	wind.mpsl.elf	Get hash	malicious	Mirai	Browse	154.216.17.34

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_fontdrvhost.exe_d32c824e8915b30da4efd4eabd13e74e4ef8c1_ad0be647_d154cbee-f8eb-4fe1-8d9d-e4c690c727d0\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6601024861471314
Encrypted:	false
SSDEEP:	96:y4GIFjw3euqigKJ6os3Wrk41yHpHS2QXIDcQkc6tcEycw3ZUtzJzQ+HbHgrZ2ZAy:hRAZHn6oxR0apYKjqzuiFcsZ24lO8JO
MD5:	DDC8003F24EB3A429C8230FC86C6C176
SHA1:	079C5748EB93994C36C84ED464B8A4AC13CFEFE6
SHA-256:	3CE1C6419C7A4BD6CCCE78F03F39E5357D0675147CA5465BED7668ED5AAD52C0
SHA-512:	561EF9831A99DFBDB472D965B7EF97DDDDB53B0DC6920DA995E84D3987586D06C1C3E50F283B0A5B754409CCCF887DF9766D7CAD26A1BB2BE11AE252A2C3F897
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.6.4.....E.v.e.n.t.T.i.m.e.=.1.3.3.8.0.8.1.8.4.8.0.2.3.1.9.1.2.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.8.0.8.1.8.4.8.0.6.2.2.5.3.1.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.1.5.4.c.b.e.e.-.f.8.e.b.-.4.f.e.1.-.8.d.9.d.-.e.4.c.6.9.0.c.7.2.7.d.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.c.5.c.a.1.b.4.-.e.4.6.e.-.4.1.8.8.-.8.6.a.c.-.c.e.e.3.7.d.f.b.6.1.9.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.f.o.n.t.d.r.v.h.o.s.t...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.f.o.n.t.d.r.v.h.o.s.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.5.f.8.-.0.0.0.1.-.0.0.1.4.-.7.4.b.c.-.3.6.c.9.d.5.6.1.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.5.e.f.b.3.f.9.7.3.4.2.b.a.1.9.5.4.2.4.1.3.4.f.2.8.f.9.7.7.d.a.9.e.0.d.6.a.a.9.1.!.f.o.n.t.d.r.v.h.o.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2CAB.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed Jan 8 14:01:20 2025, 0x1205a4 type
Category:	dropped
Size (bytes):	47862
Entropy (8bit):	1.2738416834154476
Encrypted:	false
SSDEEP:	96:5H8bjVR3jBy6KOP7i755a02qgPd0Pe9NdWICLKwIg1fDC:yfJTzOgqUd0Pe9NCRtC
MD5:	820CAD6FA3109178AA03FB286B76D48F
SHA1:	947839F88268654C54017B4231F409D067A19AC0
SHA-256:	E5965DB2F9254AD82681D0DED4E6075D6FBC9E60F93D356BC58DF76CAE6D0DD5
SHA-512:	363C7B8EE2EDC4680616FDE945BA9894979DF803FF8250F5E432E99E8AF1A25FD0450E4BC5E11B39295FD3A37F9269A9824F7C2E47A3B43C6C860D73AA32A65B
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .......0.~g........................................2!..........T.......8...........T...............F.......................................................................................................eJ..............Lw......................T...........,.~g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2CFB.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8618
Entropy (8bit):	3.6878263145716037
Encrypted:	false
SSDEEP:	192:R6l7wVeJH1sbjLUe6Yzwnnngmfr57vVpDP89bg6yfOHAm:R6lXJVq6YEnnngmfrFvwgXfOF
MD5:	31AD59DAF3DB913DFCAF33ABCE651059
SHA1:	08AC8CEFE01B58795E08C8DB579C17C97E658B58
SHA-256:	B8134E8E1014E37EFB2C9369F46468AA3C83531AE63CEDF8DD98E994C9886E42
SHA-512:	CE2D7A673A26E7706E0B6C8CBBCE94EE77656F5E57D412EAB945F69383DA7EC5B61F36C5498A2D5EF214FDEA2904FB4A7CA673E12B5B2FF6B0732B4576CF8D3E
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.6.2.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2D4A.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4853
Entropy (8bit):	4.4439862562784445
Encrypted:	false
SSDEEP:	48:cvIwWl8zsPJg771I9bQWpW8VYNjvYm8M4Jk5LvM6FEyq8vU5LvMWaMuDwMdFd:uIjfxI7Mp7VpJcjMLWsjMW1uLHd
MD5:	FFE31DC65EA6C8718D7BA6E2CC9A7269
SHA1:	32763BE165D387CA3E39972A7B270ED842683C5B
SHA-256:	952D53BF8D756FBE9DBF78EFB40322D3C9236F724C4054E50E2BCAB4F41FB484
SHA-512:	7B140169C695FEE334397F754E04CD041DA3D672DC3A12AA27ACDE1FD3543559A2C5B7193C7E3A68937FAB5C352E5748714433B708F0A64353266B3DC2E6720F
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="667024" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.373002345136772
Encrypted:	false
SSDEEP:	6144:XFVfpi6ceLP/9skLmb08yWWSPtaJG8nAge35OlMMhA2AX4WABlguNviL:VV1qyWWI/glMM6kF7Rq
MD5:	F94B1824FB1A23AFAA34534A46A178C1
SHA1:	53C2C9BC169EB5A7BCC3DE5CE02F1380CB7E802E
SHA-256:	AF098E04CF9AEAFC157ECF98C65FC71626CAD08A7C0C8644B9D7EC3EF109C534
SHA-512:	25C1C975E004464BBBB0FC6D0BE33A690586E8C71EB529CD08F59ED037EF66070AE1A0D446F9E883C515C65A076A6856AF743DD9B53E696C8B8C7FB80E618C6D
Malicious:	false
Reputation:	low
Preview:	regfC...C....\.Z.................... ....0......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.S...a...............................................................................................................................................................................................................................................................................................................................................h..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	2.017293467638857
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	LayyB0R.exe
File size:	2'693'632 bytes
MD5:	46fe008a90da36053c2283f88baf327a
SHA1:	d4468911d1a9d52029a87045b7fe3e48288b0c68
SHA256:	00b1dbb467fd9362fd4f5a3e76ef16f3b4abe4fb620e62aa00a7bdae67c0042a
SHA512:	3761b0c42a9e4bdfd5c52ccc23217cd60eb5306dcf34c1f462e23442b88b33abb2fe4b428493eb8fa79752803d5b567893512dd3888de0ddbb3a091fae0ca2dd
SSDEEP:	6144:YsjqaYcd6M9VwdL94slc8+Yl7aZilp3c52RiMAMl5jpNVXi2Z9Z+T7fcdY/bYT6/:BqaYcEMAnH7aADcIAmpNVXi2Z/+T74Q
TLSH:	BDC59D82B2FA3C04FE7747728E2AD2E8261FBDB14E75625DE118BA5F04B7871C162741
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........A]p. 3#. 3#. 3#.r.#. 3#.r.#. 3#.r.#. 3#..H#. 3#. 2#. 3#.r.#. 3#.r.#. 3#.r.#. 3#Rich. 3#........PE..L...t.Af...................

File Icon


Icon Hash:	738733b18ba383e0

Static PE Info

General

Entrypoint:	0x40164d
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6641CE74 [Mon May 13 08:25:24 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	f19e46a0d9a4cc2995291670215cf69f

Entrypoint Preview

Instruction
call 00007FC6A46D518Ah
jmp 00007FC6A46D0D2Dh
mov edi, edi
push ebp
mov ebp, esp
sub esp, 00000328h
mov dword ptr [004658F8h], eax
mov dword ptr [004658F4h], ecx
mov dword ptr [004658F0h], edx
mov dword ptr [004658ECh], ebx
mov dword ptr [004658E8h], esi
mov dword ptr [004658E4h], edi
mov word ptr [00465910h], ss
mov word ptr [00465904h], cs
mov word ptr [004658E0h], ds
mov word ptr [004658DCh], es
mov word ptr [004658D8h], fs
mov word ptr [004658D4h], gs
pushfd
pop dword ptr [00465908h]
mov eax, dword ptr [ebp+00h]
mov dword ptr [004658FCh], eax
mov eax, dword ptr [ebp+04h]
mov dword ptr [00465900h], eax
lea eax, dword ptr [ebp+08h]
mov dword ptr [0046590Ch], eax
mov eax, dword ptr [ebp-00000320h]
mov dword ptr [00465848h], 00010001h
mov eax, dword ptr [00465900h]
mov dword ptr [004657FCh], eax
mov dword ptr [004657F0h], C0000409h
mov dword ptr [004657F4h], 00000001h
mov eax, dword ptr [00464004h]
mov dword ptr [ebp-00000328h], eax
mov eax, dword ptr [00464008h]
mov dword ptr [ebp-00000324h], eax
call dword ptr [0000009Ch]

Rich Headers

Programming Language:

[C++] VS2008 build 21022
[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x62a3c	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd3000	0x290c0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x625c0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x61000	0x188	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5fd6b	0x5fe00	992e8ee5b7b27fdf95999dcb76cd5a55	False	0.8600625407431551	data	7.632200892708984	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x61000	0x231c	0x2400	ad8329064ba06243af9c9cf370f584fc	False	0.3667534722222222	data	5.478405416611641	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x64000	0x67f7c	0x1800	f8d096bb459b108de01a100e4a4176ce	False	0.3375651041666667	data	3.383792384370105	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.gima	0xcc000	0x53e5	0x4800	f9debe3f07be68533bf0295e3d2ba68a	False	0.002224392361111111	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tabiya	0xd2000	0x15a	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xd3000	0x290c0	0x29200	e7a13efbef9b76b34d09697c3a9133e2	False	0.32746010638297873	data	4.368428805745436	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_CURSOR	0xf1018	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0	0.7368421052631579
RT_CURSOR	0xf1148	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.06130705394190871
RT_CURSOR	0xf3718	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	0.31023454157782515
RT_CURSOR	0xf45d8	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0	0.7368421052631579
RT_CURSOR	0xf4708	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.06130705394190871
RT_ICON	0xd3d50	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	0.498134328358209
RT_ICON	0xd4bf8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	0.5388086642599278
RT_ICON	0xd54a0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	0.5639400921658986
RT_ICON	0xd5b68	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	0.588150289017341
RT_ICON	0xd60d0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	0.3529045643153527
RT_ICON	0xd8678	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	0.41369606003752346
RT_ICON	0xd9720	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	0.4233606557377049
RT_ICON	0xda0a8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	0.5106382978723404
RT_ICON	0xda588	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	0.27132196162046907
RT_ICON	0xdb430	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	0.4165162454873646
RT_ICON	0xdbcd8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	0.5305299539170507
RT_ICON	0xdc3a0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	0.569364161849711
RT_ICON	0xdc908	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.42396265560165974
RT_ICON	0xdeeb0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	0.4954918032786885
RT_ICON	0xdf838	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	0.5
RT_ICON	0xdfd08	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	0.3344882729211087
RT_ICON	0xe0bb0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	0.39666064981949456
RT_ICON	0xe1458	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	0.3888248847926267
RT_ICON	0xe1b20	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	0.3959537572254335
RT_ICON	0xe2088	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	0.22136929460580912
RT_ICON	0xe4630	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	0.24765478424015008
RT_ICON	0xe56d8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	0.28114754098360656
RT_ICON	0xe6060	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	0.3120567375886525
RT_ICON	0xe6540	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	0.3307569296375267
RT_ICON	0xe73e8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	0.4611913357400722
RT_ICON	0xe7c90	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	0.5282258064516129
RT_ICON	0xe8358	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	0.5469653179190751
RT_ICON	0xe88c0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	0.3025328330206379
RT_ICON	0xe9968	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	0.3008196721311475
RT_ICON	0xea2f0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	0.3528368794326241
RT_ICON	0xea7c0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	0.28171641791044777
RT_ICON	0xeb668	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	0.36597472924187724
RT_ICON	0xebf10	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	0.3738479262672811
RT_ICON	0xec5d8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	0.36921965317919075
RT_ICON	0xecb40	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.2598547717842324
RT_ICON	0xef0e8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	0.27790806754221387
RT_ICON	0xf0190	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	0.28524590163934427
RT_ICON	0xf0b18	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	0.32358156028368795
RT_STRING	0xf6e88	0x4c4	data	0.44344262295081965
RT_STRING	0xf7350	0x15e	data	0.5114285714285715
RT_STRING	0xf74b0	0x7d4	data	0.4241516966067864
RT_STRING	0xf7c88	0x7b0	data	0.42327235772357724
RT_STRING	0xf8438	0x5f8	data	0.4443717277486911
RT_STRING	0xf8a30	0x6ba	data	0.4332171893147503
RT_STRING	0xf90f0	0x66a	data	0.438489646772229
RT_STRING	0xf9760	0x6fa	data	0.4316909294512878
RT_STRING	0xf9e60	0x754	data	0.4253731343283582
RT_STRING	0xfa5b8	0x422	data	0.4735349716446125
RT_STRING	0xfa9e0	0x668	data	0.4329268292682927
RT_STRING	0xfb048	0x80e	data	0.4146459747817653
RT_STRING	0xfb858	0x668	data	0.4274390243902439
RT_STRING	0xfbec0	0x1fe	data	0.49411764705882355
RT_ACCELERATOR	0xf0ff8	0x20	data	1.15625
RT_GROUP_CURSOR	0xf36f0	0x22	data	1.088235294117647
RT_GROUP_CURSOR	0xf45c0	0x14	data	1.25
RT_GROUP_CURSOR	0xf6cb0	0x22	data	1.088235294117647
RT_GROUP_ICON	0xdfca0	0x68	data	0.7019230769230769
RT_GROUP_ICON	0xf0f80	0x76	data	0.6694915254237288
RT_GROUP_ICON	0xe64c8	0x76	data	0.6694915254237288
RT_GROUP_ICON	0xea758	0x68	data	0.7211538461538461
RT_GROUP_ICON	0xda510	0x76	data	0.6610169491525424
RT_VERSION	0xf6cd8	0x1ac	data	0.5747663551401869

Imports

DLL

Import

KERNEL32.dll

GetThreadContext, GetNumaNodeProcessorMask, SetDefaultCommConfigA, CreateProcessW, InterlockedIncrement, GetEnvironmentStringsW, CancelWaitableTimer, InterlockedCompareExchange, GetComputerNameW, GetTimeFormatA, GetModuleHandleW, GetCurrentThread, GetDateFormatA, SetProcessPriorityBoost, GetVolumePathNameW, LoadLibraryW, GetConsoleAliasW, GetStartupInfoW, GetShortPathNameA, GetStartupInfoA, SetLastError, GetProcAddress, SearchPathA, SetFileAttributesA, GetAtomNameA, UnhandledExceptionFilter, LocalAlloc, DeleteTimerQueue, AddAtomA, FindAtomA, FoldStringA, OpenFileMappingW, FindFirstVolumeW, GetModuleHandleA, HeapAlloc, GetCommandLineA, TerminateProcess, GetCurrentProcess, SetUnhandledExceptionFilter, IsDebuggerPresent, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, HeapFree, VirtualFree, VirtualAlloc, HeapReAlloc, HeapCreate, Sleep, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, GetLastError, WideCharToMultiByte, GetConsoleCP, GetConsoleMode, FlushFileBuffers, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, SetHandleCount, GetFileType, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, GetCurrentThreadId, InterlockedDecrement, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, SetFilePointer, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, InitializeCriticalSectionAndSpinCount, RtlUnwind, LoadLibraryA, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, MultiByteToWideChar, SetStdHandle, LCMapStringA, LCMapStringW, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, HeapSize, CreateFileA, CloseHandle, RaiseException

USER32.dll

GetProcessDefaultLayout

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-08T15:01:15.325933+0100	2854802	ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert	1	154.216.20.162	1950	192.168.2.8	49704	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 8, 2025 15:01:14.658427954 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:14.663235903 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:14.663358927 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:14.663527966 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:14.668349028 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.320111990 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.321113110 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:15.325932980 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.527101994 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.536952972 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:15.541913986 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.757770061 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.757808924 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.757828951 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.757841110 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.757853031 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.757858992 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:15.757867098 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.757882118 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:15.757894039 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.757908106 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.757920027 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.757958889 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:15.757958889 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:15.758008003 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.758053064 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:15.765227079 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.765244961 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.765311956 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.765319109 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:15.765324116 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.765367031 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:15.844829082 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.844841003 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.844954967 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:15.866179943 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.866194963 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.866206884 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.866260052 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:15.869801044 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.869848013 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.869853020 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:15.869899035 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.869910002 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.869946003 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:15.877383947 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.877398014 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.877433062 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:15.877573013 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.877583981 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.877652884 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:15.885736942 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.885796070 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.885814905 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:15.885835886 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.885893106 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:15.893018007 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.893032074 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.893043995 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.893074989 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:15.900238037 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.900249004 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.900299072 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.900306940 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:15.900319099 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.900343895 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:15.907682896 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.907695055 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.907706976 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.907778025 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:15.907808065 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:15.914515972 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.914530993 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.914541960 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.914592028 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:15.923110962 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.923131943 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.923145056 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.923171997 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:15.923198938 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:15.931164026 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.931175947 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.931189060 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.931232929 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:15.936805010 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.936821938 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.936882019 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:15.953352928 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.953372002 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.953385115 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.953397989 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.953419924 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:15.953442097 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:15.975238085 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.975259066 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.975274086 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.975306988 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:15.975337029 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:15.978578091 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.978738070 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.978749990 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.978784084 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:15.985837936 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.985914946 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.985925913 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.985935926 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:15.985937119 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.985991001 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:15.992993116 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.993010998 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.993029118 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:15.993073940 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:15.993117094 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.000221968 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.000240088 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.000252962 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.000426054 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.007023096 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.007054090 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.007302046 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.007533073 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.007574081 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.007601976 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.016769886 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.016786098 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.016801119 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.016882896 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.016916037 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.022371054 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.022384882 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.022396088 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.022408962 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.022520065 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.022555113 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.028342009 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.028357983 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.028481007 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.028502941 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.028512955 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.028808117 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.035586119 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.035598993 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.035685062 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.035705090 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.035739899 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.035772085 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.042552948 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.042568922 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.042581081 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.042643070 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.051331997 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.051347017 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.051369905 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.051383018 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.051393986 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.051393032 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.051434040 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.051434040 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.057300091 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.057317972 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.057331085 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.057482004 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.062477112 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.062511921 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.062609911 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.062771082 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.062782049 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.062845945 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.067709923 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.067775965 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.067785978 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.067804098 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.067918062 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.072757006 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.072772026 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.072787046 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.072798967 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.072881937 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.072881937 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.077721119 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.077737093 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.077750921 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.077874899 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.082695007 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.082710028 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.082724094 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.082861900 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.087635040 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.087651014 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.087662935 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.087820053 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.092684031 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.092699051 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.092714071 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.092762947 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.092762947 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.097557068 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.097573042 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.097585917 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.097665071 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.100724936 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.100740910 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.100755930 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.100812912 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.100889921 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.103538036 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.103550911 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.103667974 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.103683949 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.103696108 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.103790998 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.107067108 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.107079029 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.107084990 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.107207060 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.109889030 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.109904051 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.109919071 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.109941959 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.109972954 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.112639904 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.112672091 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.112689972 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.112700939 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.112793922 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.115744114 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.115756989 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.115767956 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.115788937 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.115813017 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.115861893 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.118752003 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.118767023 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.118779898 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.118824959 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.121659994 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.121675014 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.121686935 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.121746063 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.121746063 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.124838114 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.124855042 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.124866962 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.124989986 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.128115892 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.128134012 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.128146887 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.128259897 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.130721092 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.130738020 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.130749941 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.130830050 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.135576010 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.135592937 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.135606050 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.135699987 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.135766029 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.136811018 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.136826992 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.136837959 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.136889935 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.141278982 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.141311884 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.141324997 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.141355038 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.141386986 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.144643068 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.144660950 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.144673109 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.144735098 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.148034096 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.148051023 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.148062944 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.148221016 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.150434017 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.150456905 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.150470972 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.150834084 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.153785944 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.153799057 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.153810024 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.153889894 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.156543970 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.156555891 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.156574011 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.156641006 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.159917116 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.160090923 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.160105944 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.160222054 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.162848949 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.162997007 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.163007975 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.163022041 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.163117886 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.163135052 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.166007996 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.166023016 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.166034937 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.166054010 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.166167974 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.169011116 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.169025898 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.169039011 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.169106960 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.171860933 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.171875954 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.171889067 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.171947002 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.171947002 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.189966917 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.189985037 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.189996958 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.190076113 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.190242052 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.190254927 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.190335989 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.190567017 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.190577984 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.190591097 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.190630913 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.190704107 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.190716982 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.190743923 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.190844059 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.190964937 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.190975904 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.191008091 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.191018105 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.191029072 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.191055059 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.191071987 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.191082001 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.191083908 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.191114902 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.193990946 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.194001913 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.194077969 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.194468021 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.194576025 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.194580078 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.197427988 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.197438002 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.197530031 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.197540045 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.197566986 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.197623968 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.199659109 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.199671030 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.199681997 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.199860096 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.201677084 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.201695919 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.201805115 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.201814890 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.201829910 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.201958895 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.204678059 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.204690933 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.204701900 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.204885006 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.208787918 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.208892107 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.208930016 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.208942890 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.209059954 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.209073067 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.211517096 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.211529016 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.211540937 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.211561918 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.211657047 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.214173079 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.214184999 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.214196920 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.214432955 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.216231108 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.216243029 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.216255903 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.216317892 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.216317892 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.218718052 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.218735933 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.218749046 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.219058990 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.219496012 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.219510078 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.219521999 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.219577074 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.219578028 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.223015070 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.223030090 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.223102093 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.223145962 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.223156929 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.223222971 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.223774910 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.223790884 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.223802090 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.223865032 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.225478888 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.225491047 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.225548983 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.225753069 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.225928068 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.225996017 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.227588892 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.227658033 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.227739096 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.227749109 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.227828026 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.229403973 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.229415894 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.229425907 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.229438066 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.229495049 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.229495049 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.231057882 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.231070042 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.231081009 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.231282949 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.232830048 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.232841969 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.232852936 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.232990026 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.234733105 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.234744072 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.234755993 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.234774113 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.234783888 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.234874964 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.237071037 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.237085104 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.237097025 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.237174988 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.238472939 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.238483906 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.238495111 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.238504887 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.238528013 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.238595963 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.239593983 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.239603996 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.239615917 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.239671946 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.239671946 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.241606951 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.241620064 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.241631031 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.241669893 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.243127108 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.243144035 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.243158102 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.243212938 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.243212938 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.244841099 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.244853973 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.244864941 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.244894028 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.246531010 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.246547937 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.246562004 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.246692896 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.247689962 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.247703075 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.247709036 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.247848034 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.250210047 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.250318050 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.250354052 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.250364065 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.250562906 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.252552032 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.252564907 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.252577066 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.252592087 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.252660990 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.252660990 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.253918886 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.253937006 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.253951073 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.254076958 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.255608082 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.255620003 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.255634069 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.255697012 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.255697012 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.256897926 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.256908894 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.256921053 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.257030010 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.258569956 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.258582115 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.258594036 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.258642912 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.258642912 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.265243053 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.265259981 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.265270948 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.265281916 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.265294075 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.265304089 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.265321970 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.265331984 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.265345097 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.265357971 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.265364885 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.265383959 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.265392065 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.265397072 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.265407085 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.265418053 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.265430927 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.265433073 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.265443087 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.265454054 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.265496969 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.265794992 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.265994072 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.266014099 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.266074896 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.266084909 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.266108990 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.266182899 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.267498016 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.267512083 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.267522097 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.267857075 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.268809080 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.268827915 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.268838882 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.268888950 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.268889904 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.270179033 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.270191908 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.270203114 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.270328045 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.271496058 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.271507978 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.271519899 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.271605968 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.271606922 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.272808075 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.272818089 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.272861004 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.272871017 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.272891045 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.272923946 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.274164915 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.274175882 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.274194002 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.274287939 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.275437117 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.275448084 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.275459051 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.275737047 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.276742935 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.276756048 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.276768923 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.276817083 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.278170109 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.278184891 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.278198004 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.278582096 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.280787945 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.280812025 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.280826092 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.280838013 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.280849934 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.280872107 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.280911922 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.285897970 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.285911083 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.285922050 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.285928011 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.285934925 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.285965919 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.286117077 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.286129951 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.286156893 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.286261082 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.295135021 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.295156002 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.295169115 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.295181036 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.295192957 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.295227051 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.295272112 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.295378923 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.295419931 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.295519114 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.300040007 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.300065041 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.300079107 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.300105095 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.300133944 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.300138950 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.300149918 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.300201893 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.300213099 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.300225019 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.300231934 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.300321102 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.306305885 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.306329966 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.306343079 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.306369066 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.306385040 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.306412935 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.306452990 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.306466103 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.306490898 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.306548119 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.312192917 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.312207937 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.312220097 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.312267065 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.312278032 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.312289953 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.312294006 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.312302113 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.312334061 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.312334061 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.317679882 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.317703009 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.317749023 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.317769051 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.317780972 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.317784071 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.317820072 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.317917109 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.318090916 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.318103075 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.318115950 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.318125963 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.318183899 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.318183899 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.322956085 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.322972059 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.322983027 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.323014021 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.323088884 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.323105097 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.323117971 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.323144913 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.323154926 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.323169947 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.323185921 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.323230982 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.327989101 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.328001022 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.328071117 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.328079939 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.328131914 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.328144073 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.328161001 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.328174114 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.328186035 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.328190088 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.328212023 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.328274965 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.333203077 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.333220959 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.333231926 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.333244085 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.333257914 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.333271027 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.333312035 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.333353043 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.333353996 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.339847088 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.339858055 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.339939117 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.339956045 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.339967012 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.339977026 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.339977980 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.339988947 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.340001106 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.340004921 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.340023041 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.342891932 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.342909098 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.342921019 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.342935085 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.342947960 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.343027115 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.343188047 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.343225002 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.343238115 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.343323946 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.347336054 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.347347975 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.347362041 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.347373009 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.347383976 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.347395897 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.347407103 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.347410917 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.347496986 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.351412058 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.351423979 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.351471901 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.351492882 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.351505041 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.351519108 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.351530075 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.351535082 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.351891994 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.351926088 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.351959944 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.355281115 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.355565071 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.355582952 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.355593920 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.355680943 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.355720997 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.355726957 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.355740070 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.355755091 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.355768919 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.355792046 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.358531952 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.359648943 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.359668016 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.359679937 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.359747887 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.359747887 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.359754086 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.359766006 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.359777927 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.359788895 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.359807014 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.359888077 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.363528967 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.363542080 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.363642931 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.363648891 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.363655090 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.363720894 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.363740921 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.363753080 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.363765001 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.363846064 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.363989115 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.364005089 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.364069939 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.367630959 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.367646933 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.367657900 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.367669106 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.367681980 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.367702007 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.367702007 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.367741108 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.367753983 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.367768049 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.367984056 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.373342991 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.373354912 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.373399019 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.373419046 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.373549938 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.373563051 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.373574018 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.373594999 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.373608112 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.373608112 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.373651028 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.373678923 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.386831045 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.386847019 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.386858940 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.386910915 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.386921883 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.386953115 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.387020111 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.387187958 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.387224913 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.387249947 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.387259007 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.387274981 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.387504101 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.393209934 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.393222094 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.393234968 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.393294096 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.393294096 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.393327951 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.393342018 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.393348932 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.393359900 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.393399954 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.393435001 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.399060011 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.399101019 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.399112940 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.399123907 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.399182081 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.399292946 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.399326086 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.399338961 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.399348021 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.399374962 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.399406910 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.404715061 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.404727936 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.404740095 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.404751062 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.404761076 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.404772043 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.404784918 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.404798985 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.404871941 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.409742117 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.409754992 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.409766912 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.409832954 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.409832954 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.409877062 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.409888983 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.409899950 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.409936905 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.410130024 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.410165071 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.410279036 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.414808989 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.414829016 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.414876938 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.414902925 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.414915085 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.414936066 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.414936066 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.414956093 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.414968014 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.414974928 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.415107965 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.415450096 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.419747114 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.419758081 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.419800043 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.419833899 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.419857025 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.419871092 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.419882059 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.419892073 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.419936895 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.420278072 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.420295000 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.420393944 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.429657936 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.429672956 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.429685116 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.429754972 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.429754972 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.429759026 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.429789066 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.429800034 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.429826975 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.429838896 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.429864883 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.429864883 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.430383921 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.430396080 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.430408955 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.430421114 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.430433035 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.430490971 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.430490971 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.430828094 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.430844069 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.431237936 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.436057091 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.436069965 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.436081886 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.436093092 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.436120033 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.436131954 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.436141968 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.436150074 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.436150074 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.436156988 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.436182976 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.436225891 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.443382025 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.443412066 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.443424940 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.443438053 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.443449974 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.443459988 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.443470955 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.443481922 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.443492889 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.443500042 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.443504095 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.443516970 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.443530083 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.443542004 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.443553925 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.443557978 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.443557978 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.443557978 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.443567991 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.443579912 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.443586111 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.443608046 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.443701029 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.446513891 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.446527004 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.446541071 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.446557045 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.446568966 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.446576118 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.446598053 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.446757078 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.446794033 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.446867943 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.450457096 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.450474977 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.450486898 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.450498104 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.450505018 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.450522900 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.450597048 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.450750113 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.450767040 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.450926065 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.454399109 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.454411983 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.454423904 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.454485893 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.454508066 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.454546928 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.454561949 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.454581976 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.454598904 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.454612017 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.454626083 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.454705000 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.460362911 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.460376024 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.460383892 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.460388899 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.460397005 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.460402012 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.460408926 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.460539103 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.473726034 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.473742008 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.473753929 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.473767042 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.473802090 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.473875046 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.473901033 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.473922014 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.473932981 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.473939896 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.473964930 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.473989010 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.480104923 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.480118036 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.480130911 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.480187893 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.480199099 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.480209112 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.480221987 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.480233908 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.480233908 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.480233908 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.480386019 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.485857964 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.485871077 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.485882044 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.486012936 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.486023903 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.486038923 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.486048937 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.486051083 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.486064911 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.486078978 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.486110926 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.486227989 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.491585970 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.491599083 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.491611004 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.491622925 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.491636038 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.491648912 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.491661072 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.491661072 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.491683006 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.491755009 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.496593952 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.496606112 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.496617079 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.496629000 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.496655941 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.496685982 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.496697903 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.496712923 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.496776104 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.496952057 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.497580051 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.506630898 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.506643057 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.506655931 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.506670952 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.506681919 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.506692886 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.506735086 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.506747007 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.506799936 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.506824970 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.507004976 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.507020950 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.507033110 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.507071972 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.507095098 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.507095098 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.507409096 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.507460117 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.507471085 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.507489920 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.507534981 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.507589102 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.519691944 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.519711971 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.519727945 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.519741058 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.519752026 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.519766092 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.519774914 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.519774914 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.519778967 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.519797087 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.519814968 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.519825935 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.519840002 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.519853115 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.519854069 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.519853115 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.519866943 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.519875050 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.519875050 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.519881010 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.519896030 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.519906044 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.519910097 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.520045996 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.521487951 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.521501064 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.521512985 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.521524906 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.521536112 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.521548986 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.521563053 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.521569967 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.521605015 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.521635056 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.526448011 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.526462078 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.526474953 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.526513100 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.526570082 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.526582003 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.526592970 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.526604891 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.526617050 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.526633978 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.530529976 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.530541897 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.530549049 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.530560970 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.530574083 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.530601978 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.530683041 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.530694962 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.530706882 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.530725002 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.530790091 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.534640074 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.534656048 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.534668922 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.534681082 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.534693956 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.534694910 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.534707069 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.534720898 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.534722090 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.534792900 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.534792900 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.538642883 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.538655996 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.538667917 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.538681030 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.538695097 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.538714886 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.538800955 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.538814068 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.538825989 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.538834095 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.538873911 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.539017916 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.548365116 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.548377991 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.548511982 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.548523903 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.548537016 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.548583984 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.548612118 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.548672915 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.548686981 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.548701048 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.548712969 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.548726082 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.548737049 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.548739910 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.548754930 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.548767090 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.548769951 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.548769951 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.548779964 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.548791885 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.548805952 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.548819065 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.548819065 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.548924923 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.560554028 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.560580015 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.560591936 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.560695887 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.560709000 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.560723066 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.560736895 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.560739040 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.560739040 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.560791016 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.567006111 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.567019939 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.567030907 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.567044020 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.567058086 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.567070007 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.567101955 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.567141056 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.567223072 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.567589998 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.572715998 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.572729111 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.572777987 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.572788954 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.572801113 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.572838068 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.572879076 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.572890997 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.572911978 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.573065996 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.573343992 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.573801994 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.578155041 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.578172922 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.578258991 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.578308105 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.578320026 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.578332901 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.578392982 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.578566074 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.578578949 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.578592062 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.578600883 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.578732967 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.593450069 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.593472958 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.593482971 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.593496084 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.593508959 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.593548059 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.593580961 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.593738079 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.593799114 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.593811989 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.593822002 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.593890905 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.593890905 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.594099998 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.594116926 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.594233036 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.594268084 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.594311953 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.594324112 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.594347954 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.594347954 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.594374895 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.594387054 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.594409943 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.594479084 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.594949007 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.594959974 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.594970942 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.594999075 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.595005035 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.595011950 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.595024109 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.595036030 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.595068932 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.595283031 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.603286982 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.603307962 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.603327036 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.603349924 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.603385925 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.603445053 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.603456974 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.603470087 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.603482962 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.603583097 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.603583097 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.603768110 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.603782892 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.603792906 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.603802919 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.603815079 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.603828907 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.603878975 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.604288101 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.604310989 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.604474068 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.607923985 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.607955933 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.607976913 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.607989073 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.608020067 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.608021975 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.608055115 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.608176947 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.608202934 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.608273983 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.608589888 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.611938953 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.612005949 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.612019062 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.612030029 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.612045050 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.612080097 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.612230062 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.612277985 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.612349033 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.616070986 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.616087914 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.616100073 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.616112947 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.616126060 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.616142988 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.616142988 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.616245985 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.616326094 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.616341114 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.616398096 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.620088100 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.620140076 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.620151043 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.620162964 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.620253086 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.620302916 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.620343924 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.620356083 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.620368004 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.620491982 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.624193907 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.624207973 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.624226093 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.624241114 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.624253035 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.624263048 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.624267101 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.624298096 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.624341011 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.624366999 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.624378920 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.624475956 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.633900881 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.633913040 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.634006023 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.634017944 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.634030104 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.634066105 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.634067059 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.634072065 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.634234905 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.634411097 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.634423971 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.634903908 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.647396088 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.647612095 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.647623062 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.647636890 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.647646904 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.647682905 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.647711039 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.647723913 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.647736073 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.647744894 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.647747040 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.647783041 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.647866964 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.648076057 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.648087978 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.648101091 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.648133993 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.648160934 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.648343086 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.648354053 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.648365974 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.648406982 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.648418903 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.648433924 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.648513079 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.659847021 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.659859896 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.659871101 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.659883022 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.659898996 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.659909964 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.659921885 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.659934998 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.659965992 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.660108089 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.664999962 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.665016890 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.665055990 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.665081024 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.665096045 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.665108919 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.665164948 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.665458918 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.665606022 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.665616989 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.665630102 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.665640116 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.665811062 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.665874004 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.665920019 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.665930986 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.665971994 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.665985107 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.666017056 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.666413069 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.666521072 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.680648088 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.680779934 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.680790901 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.680798054 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.680808067 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.680819988 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.680830956 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.680862904 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.681071043 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.681083918 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.681096077 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.681096077 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.681128025 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.681138992 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.681153059 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.681154966 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.681165934 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.681179047 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.681201935 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.682074070 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.682085991 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.682097912 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.682109118 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.682121038 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.682132959 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.682140112 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.682140112 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.682162046 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.683298111 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.690119982 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.690135956 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.690148115 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.690180063 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.690232992 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.690237999 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.690252066 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.690264940 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.690283060 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.690294981 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.690318108 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.690362930 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.690730095 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.690758944 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.690773010 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.690781116 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.690788031 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.690799952 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.690828085 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.690938950 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.691277027 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.691293001 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.691709995 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.694828033 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.694844007 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.694854975 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.694896936 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.694938898 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.694982052 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.694998026 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.695014954 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.695019960 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.695101976 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.695349932 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.695394993 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.698753119 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.698868036 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.698879004 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.698890924 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.698905945 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.698919058 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.698945045 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.698945045 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.698970079 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.698970079 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.699408054 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.699510098 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.702832937 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.702883005 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.702893019 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.702935934 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.702945948 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.702965021 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.703015089 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.703193903 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.703212976 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.703227043 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.703237057 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.703258038 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.703299999 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.707030058 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.707041979 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.707055092 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.707066059 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.707077026 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.707089901 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.707098961 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.707134008 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.707164049 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.707268000 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.710915089 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.710926056 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.710969925 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.710987091 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.710994959 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.710999012 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.711107016 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.711155891 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.711205006 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.711218119 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.711240053 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.711267948 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.711334944 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.720765114 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.720817089 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.720827103 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.720839024 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.720854998 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.720858097 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.720858097 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.720899105 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.720911026 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.720916986 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.720925093 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.720982075 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.734513998 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.734524965 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.734538078 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.734554052 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.734565973 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.734589100 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.734688044 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.734766960 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.734783888 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.734796047 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.734807014 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.734884024 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.735052109 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.735064030 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.735078096 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.735089064 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.735100031 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.735121012 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.735219002 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.735431910 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.735446930 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.735543013 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.746454000 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.746468067 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.746479034 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.746493101 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.746505022 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.746552944 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.746566057 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.746582985 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.746582985 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.746751070 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.751945972 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.751959085 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.751971960 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.751986027 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.751997948 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.752041101 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.752051115 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.752057076 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.752098083 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.752152920 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.767062902 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.767076015 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.767088890 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.767157078 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.767168045 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.767179966 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.767193079 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.767204046 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.767204046 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.767231941 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.767292976 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.767370939 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.767385960 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.767458916 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.767478943 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.767489910 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.767522097 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.767673969 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.767678022 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.767695904 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.767705917 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.767724991 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.767734051 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.767766953 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.767997026 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.768049955 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.768062115 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.768073082 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.768084049 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.768122911 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.768193007 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.768374920 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.768394947 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.768407106 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.768481970 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.768512011 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.768522024 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.768532038 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.768574953 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.768603086 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.768615961 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.768626928 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.768642902 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.768660069 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.776905060 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.776917934 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.776941061 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.776993036 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.777007103 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.777020931 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.777024984 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.777035952 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.777076960 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.777093887 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.777236938 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.777318954 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.777331114 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.777342081 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.777359962 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.777431965 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.777604103 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.777650118 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.777661085 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.777672052 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.777687073 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.777699947 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.785440922 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.785456896 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.785469055 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.785645962 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.785657883 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.785669088 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.785670996 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.785681009 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.785693884 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.785725117 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.785754919 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.789693117 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.789705992 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.789716959 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.789733887 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.789747000 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.789813995 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.789890051 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.789927006 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.789942980 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.789953947 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.789973021 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.789987087 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.790014982 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.790169001 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.790204048 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.790209055 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.790220976 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.790250063 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.790261030 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.790277004 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.790277004 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.790345907 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.797775030 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.797787905 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.797799110 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.797885895 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.797898054 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.797910929 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.797918081 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.797954082 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.797966003 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.797975063 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.797975063 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.797976017 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.798222065 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.798294067 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.798305988 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.798317909 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.798393965 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.798404932 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.798414946 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.798414946 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.798414946 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.798515081 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.807625055 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.807651043 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.807682991 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.807701111 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.807708979 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.807715893 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.807739973 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.807745934 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.807756901 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.807794094 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.807857990 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.821341038 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.821361065 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.821377993 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.821458101 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.821475029 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.821490049 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.821501970 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.821512938 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.821526051 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.821541071 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.821553946 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.821559906 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.821566105 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.821623087 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.821737051 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.822005033 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.822024107 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.822043896 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.822061062 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.822076082 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.822103024 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.822232008 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.833499908 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.833524942 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.833540916 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.833571911 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.833590984 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.833605051 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.833607912 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.833622932 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.833641052 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.833646059 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.833765030 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.838695049 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.838712931 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.838824034 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.838838100 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.838855028 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.838860989 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.838952065 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.838953018 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.838953018 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.838968992 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.838984966 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.838998079 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.839154005 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.839154005 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.853925943 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.853949070 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.853966951 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.854074955 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.854077101 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.854091883 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.854109049 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.854150057 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.854166985 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.854192019 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.854259968 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.854367971 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.854383945 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.854429007 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.854444027 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.854459047 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.854469061 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.854543924 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.854590893 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.854720116 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.854736090 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.854748964 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.854751110 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.854803085 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.854804039 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.854820013 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.854834080 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.854851961 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.854871035 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.854876041 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.854887009 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.854913950 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.854913950 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.855488062 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.855505943 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.855521917 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.855535984 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.855551958 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.855566025 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.855573893 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.855583906 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.855600119 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.855638981 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.855725050 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.863847017 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.863878965 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.863900900 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.863915920 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.863934040 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.863949060 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.863965988 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.863972902 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.864001036 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.864063978 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.864119053 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.864131927 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.864154100 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.864168882 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.864254951 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.864352942 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.864392042 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.864408016 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.864424944 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.864438057 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.864469051 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.864574909 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.872344971 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.872375011 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.872395039 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.872411013 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.872432947 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.872452021 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.872461081 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.872467041 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.872484922 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.872520924 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.872566938 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.876540899 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.876579046 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.876600027 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.876616001 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.876633883 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.876648903 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.876674891 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.876713037 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.876713037 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.876799107 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.876816034 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.876924038 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.876960039 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.876980066 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.876996994 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.877073050 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.877088070 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.877181053 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.877351999 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.877388954 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.877443075 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.884733915 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.884772062 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.884809017 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.884824038 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.884839058 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.884840965 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.884857893 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.884876013 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.884891033 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.884891987 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.884891987 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.884943008 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.884970903 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.884984970 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.884994030 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.885051012 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.885051012 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.885377884 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.885394096 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.885409117 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.885421038 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.885488033 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.894624949 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.894648075 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.894664049 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.894689083 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.894704103 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.894720078 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.894732952 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.894767046 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.894812107 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.908381939 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.908396006 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.908410072 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.908428907 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.908446074 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.908468008 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.908472061 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.908552885 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.908567905 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.908580065 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.908684969 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.908684969 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.908684969 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.908766985 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.908782005 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.908796072 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.908813000 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.908829927 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.908842087 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.909054995 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.909075022 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.909090042 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.909140110 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.920366049 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.920391083 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.920416117 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.920434952 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.920450926 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.920453072 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.920468092 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.920484066 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.920485973 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.920506001 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.920705080 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.925730944 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.925753117 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.925784111 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.925802946 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.925817966 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.925841093 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.925856113 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.925860882 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.926063061 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.926074982 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.926096916 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.926167965 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.926194906 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.940861940 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.940892935 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.940910101 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.940926075 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.940931082 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.940944910 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.940983057 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.941039085 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.941086054 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.941334009 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.941410065 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.941412926 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.941436052 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.941452026 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.941468000 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.941478968 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.941493988 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.941495895 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.941523075 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.941565037 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.941574097 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.941674948 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.941687107 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.941704988 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.941715956 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.941737890 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.941780090 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.941901922 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.941945076 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.941956043 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.941967964 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.942002058 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.942002058 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.951302052 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.951328993 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.951340914 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.951353073 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.951366901 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.951402903 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.951407909 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.951407909 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.951416016 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.951430082 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.951446056 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.951452971 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.951466084 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.951477051 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.951486111 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.951489925 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.951503992 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.951503992 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.951519012 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.951536894 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.951536894 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.959101915 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.959124088 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.959137917 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.959203959 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.959213972 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.959230900 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.959238052 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.959239006 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.959244013 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.959258080 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.959274054 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.959274054 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.959542036 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.959558010 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.959570885 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.959587097 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.959603071 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.959646940 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.959830999 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.959844112 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.959856033 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.959867001 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.959886074 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.959965944 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.963365078 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.963383913 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.963396072 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.963443995 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.963463068 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.963463068 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.963488102 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.963505030 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.963516951 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.963532925 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.963545084 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.963546991 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.963557959 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.963581085 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.963661909 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.964021921 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.964035034 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.964046001 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.964056969 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.964068890 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.964106083 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.964106083 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.971498966 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.971515894 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.971529007 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.971596003 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.971607924 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.971620083 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.971637964 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.971657991 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.971672058 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.971683025 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.971683025 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.971708059 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.971720934 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.971735001 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.971782923 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.972116947 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.972141027 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.972152948 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.972167015 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.972234964 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.972234964 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.972275972 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.981363058 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.981389046 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.981404066 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.981415987 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.981429100 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.981435061 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.981441975 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.981458902 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.981527090 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.981527090 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.995450020 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.995464087 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.995476007 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.995488882 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.995498896 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.995512009 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.995547056 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.995579004 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.995589972 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.995856047 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.995867014 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.995989084 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.996097088 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.996109962 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.996119976 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.996131897 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.996144056 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:16.996155024 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:16.996300936 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.007304907 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.007339954 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.007352114 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.007365942 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.007443905 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.007443905 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.007455111 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.007468939 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.007482052 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.007508993 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.012708902 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.012741089 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.012758017 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.012768984 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.012775898 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.012784958 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.012789011 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.012797117 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.012809992 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.012823105 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.012828112 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.012873888 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.027641058 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.027662039 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.027678013 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.027698040 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.027712107 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.027724028 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.027754068 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.027791023 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.027797937 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.027803898 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.027842045 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.028251886 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.028269053 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.028280973 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.028338909 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.028338909 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.028347969 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.028361082 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.028373003 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.028387070 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.028398037 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.028410912 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.028458118 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.028660059 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.028682947 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.028696060 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.028728962 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.028749943 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.028763056 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.028774023 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.028780937 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.028815031 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.037549973 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.037575960 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.037587881 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.037616014 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.037638903 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.037640095 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.037653923 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.037663937 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.037676096 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.037708998 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.037724018 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.038239002 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.038250923 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.038264036 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.038292885 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.038305998 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.038319111 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.038331985 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.038383961 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.038453102 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.038485050 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.045974016 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.045989990 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.046005964 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.046021938 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.046037912 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.046036959 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.046068907 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.046078920 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.046248913 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.046261072 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.046272993 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.046283960 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.046308994 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.046328068 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.046446085 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.046458006 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.046473980 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.046484947 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.046494961 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.046499014 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.046541929 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.046542883 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.050213099 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.050225973 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.050240040 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.050287962 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.050298929 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.050312042 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.050324917 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.050376892 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.050376892 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.050434113 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.050472021 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.050484896 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.050499916 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.050512075 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.050534964 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.050534964 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.050817013 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.050827980 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.050838947 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.050867081 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.050925970 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.050982952 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.050997019 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.051100016 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.058336020 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.058352947 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.058363914 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.058413982 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.058425903 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.058453083 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.058453083 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.058495045 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.058507919 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.058547020 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.058671951 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.058684111 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.058696032 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.058708906 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.058712006 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.058737040 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.058926105 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.058939934 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.058959007 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.058969021 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.058984995 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.058984995 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.068169117 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.068205118 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.068217039 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.068242073 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.068265915 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.068269014 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.068283081 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.068325043 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.068335056 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.068346977 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.068394899 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.081912041 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.081928015 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.081938982 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.081952095 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.081965923 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.081989050 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.082026005 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.082051992 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.082101107 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.082158089 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.082226992 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.082250118 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.082262039 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.082273960 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.082308054 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.082319975 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.082323074 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.082350969 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.082369089 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.082384109 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.082472086 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.094100952 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.094120026 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.094129086 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.094141960 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.094203949 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.094255924 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.094266891 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.094279051 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.094291925 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.094321012 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.094361067 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.094482899 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.099592924 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.099606037 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.099617958 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.099631071 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.099642992 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.099653959 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.099666119 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.099670887 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.099704981 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.099704981 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.114466906 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.114480019 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.114490032 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.114510059 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.114521027 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.114527941 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.114650011 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.114737034 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.114748001 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.114762068 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.114772081 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.114772081 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.114810944 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.114936113 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.114948034 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.114958048 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.115075111 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.115082979 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.115082979 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.115118980 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.115132093 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.115151882 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.115187883 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.115206003 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.115370989 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.115423918 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.115436077 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.115448952 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.115469933 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.115499973 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.115499973 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.115514040 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.115525007 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.115541935 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.115592003 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.115650892 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.124491930 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.124505997 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.124537945 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.124557018 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.124567986 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.124578953 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.124591112 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.124596119 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.124596119 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.124619961 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.132793903 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.132808924 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.132822037 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.132847071 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.132859945 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.132868052 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.132872105 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.132931948 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.132966042 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.132977962 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.132988930 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.133021116 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.133045912 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.133404970 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.133415937 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.133428097 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.133498907 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.133508921 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.133512020 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.133526087 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.133577108 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.133585930 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.133585930 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.133589983 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.133603096 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.133615971 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.133629084 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.133666039 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.133666039 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.134103060 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.134119987 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.134171963 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.137223005 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.137236118 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.137248993 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.137284994 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.137298107 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.137309074 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.137319088 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.137319088 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.137321949 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.137362957 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.137368917 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.137368917 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.137442112 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.137454033 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.137465954 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.137478113 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.137484074 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.137525082 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.137660027 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.137677908 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.137701035 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.145343065 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.145363092 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.145375967 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.145437002 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.145448923 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.145447016 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.145466089 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.145478010 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.145481110 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.145490885 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.145531893 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.145543098 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.145543098 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.145585060 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.145695925 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.145741940 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.145766973 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.145777941 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.145812035 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.145836115 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.145978928 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.145997047 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.146047115 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.154982090 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.154994011 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.155004025 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.155085087 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.155098915 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.155107975 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.155117035 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.155129910 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.155132055 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.155142069 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.155173063 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.155173063 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.168894053 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.168910980 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.168924093 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.168935061 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.168988943 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.169013023 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.169027090 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.169039011 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.169073105 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.169204950 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.169215918 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.169228077 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.169258118 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.169281960 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.169421911 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.169433117 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.169445992 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.169456959 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.169471025 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.169480085 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.169516087 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.189754009 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.189769030 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.189781904 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.189794064 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.189807892 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.189827919 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.189827919 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.189867973 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.189889908 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.189918995 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.189935923 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.189948082 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.189965963 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.189976931 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.189999104 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.189999104 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.190001965 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.190047026 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.190159082 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.190171957 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.190201998 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.201359034 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.201376915 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.201390982 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.201436043 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.201447964 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.201459885 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.201461077 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.201461077 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.201473951 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.201508045 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.201508045 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.202002048 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.202018023 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.202029943 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.202069044 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.202069998 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.202125072 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.202143908 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.202156067 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.202167034 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.202178955 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.202209949 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.202225924 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.202343941 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.202356100 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.202368021 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.202392101 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.202421904 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.202434063 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.202486038 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.202640057 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.202708960 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.211447954 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.211461067 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.211472988 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.211555958 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.211569071 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.211580992 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.211595058 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.211689949 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.211689949 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.211714029 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.211731911 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.211782932 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.219849110 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.219861031 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.219899893 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.219917059 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.219932079 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.219944000 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.219954014 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.219955921 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.219954014 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.219996929 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.220099926 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.220117092 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.220128059 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.220139980 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.220153093 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.220154047 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.220206022 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.220303059 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.220315933 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.220330000 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.220369101 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.220381021 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.220386982 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.220443964 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.220448971 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.220455885 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.220490932 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.220509052 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.220520973 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.220596075 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.224127054 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.224139929 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.224153042 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.224169016 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.224184036 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.224195957 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.224239111 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.224241018 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.224241018 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.224241018 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.224253893 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.224291086 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.224323034 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.224334955 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.224345922 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.224369049 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.224428892 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.224447966 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.224463940 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.224481106 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.224502087 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.224524975 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.224539995 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.232197046 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.232208967 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.232218981 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.232269049 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.232274055 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.232280970 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.232292891 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.232316971 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.232317924 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.232330084 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.232346058 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.232366085 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.232618093 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.232636929 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.232650042 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.232661963 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.232673883 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.232760906 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.232760906 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.232958078 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.232975960 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.233004093 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.241822004 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.241873026 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.241885900 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.241890907 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.241898060 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.241926908 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.241952896 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.241970062 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.241995096 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.242003918 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.242007017 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.242028952 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.255856037 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.255868912 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.255886078 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.255901098 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.255912066 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.255924940 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.255938053 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.255944014 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.255992889 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.256047964 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.256088018 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.256099939 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.256138086 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.256144047 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.256155968 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.256165028 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.256197929 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.256197929 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.256206036 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.276499033 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.276516914 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.276530981 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.276541948 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.276551962 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.276576042 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.276598930 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.276643038 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.276658058 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.276670933 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.276737928 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.276746988 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.276799917 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.276813984 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.276865959 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.276869059 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.276881933 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.276923895 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.277116060 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.277168989 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.277173996 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.277185917 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.277195930 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.277209044 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.277249098 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.277249098 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.288467884 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.288487911 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.288501978 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.288521051 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.288535118 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.288537979 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.288547039 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.288558960 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.288578033 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.288631916 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.289016962 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.289040089 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.289052963 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.289064884 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.289146900 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.289146900 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.289165974 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.289232016 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.289242983 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.289254904 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.289267063 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.289292097 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.298276901 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.298290968 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.298305988 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.298316956 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.298331976 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.298369884 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.298396111 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.298398018 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.298410892 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.298423052 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.298437119 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.298450947 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.298474073 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.298474073 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.298907995 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.298919916 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.298930883 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.298949957 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.298991919 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.299041986 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.299058914 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.299105883 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.306616068 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.306631088 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.306651115 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.306662083 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.306674004 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.306710005 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.306730986 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.306763887 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.306781054 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.306793928 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.306823015 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.306838036 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.306921005 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.306931973 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.306943893 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.306956053 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.306979895 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.307004929 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.307264090 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.307409048 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.307439089 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.307451010 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.307455063 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.307465076 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.307478905 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.307492971 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.307506084 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.307539940 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.307539940 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.307539940 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.307878017 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.310955048 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.310966969 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.310978889 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.311026096 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.311033010 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.311044931 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.311064005 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.311067104 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.311083078 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.311095953 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.311116934 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.311116934 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.311252117 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.311264992 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.311279058 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.311300993 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.311332941 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.311342001 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.311347008 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.311358929 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.311440945 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.318985939 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.318999052 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.319072962 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.319084883 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.319097042 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.319104910 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.319125891 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.319148064 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.319160938 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.319173098 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.319184065 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.319196939 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.319226980 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.319266081 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.319660902 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.319674015 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.319693089 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.319704056 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.319715023 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.319730997 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.319731951 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.319772959 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.319772959 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.328577995 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.328593969 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.328604937 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.328640938 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.328654051 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.328728914 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.328739882 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.328766108 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.328766108 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.328874111 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.328886032 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.328900099 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.328908920 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.328975916 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.328975916 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.342608929 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.342623949 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.342636108 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.342647076 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.342719078 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.342719078 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.342834949 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.342847109 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.342859983 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.342873096 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.342885971 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.342897892 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.342900991 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.342911959 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.342921019 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.342925072 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.342928886 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.342973948 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.343355894 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.343401909 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.343472004 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.363496065 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.363512993 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.363528013 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.363542080 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.363604069 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.363643885 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.363663912 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.363677025 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.363689899 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.363698006 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.363708019 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.363722086 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.363748074 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.363755941 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.363768101 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.363784075 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.363836050 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.363862038 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.363883018 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.363945961 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.375534058 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.375549078 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.375574112 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.375585079 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.375591993 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.375614882 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.375617981 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.375628948 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.375653028 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.375691891 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.375868082 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.375885963 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.375900030 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.375921011 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.375953913 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.375956059 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.375968933 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.375981092 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.375993013 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.376020908 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.376050949 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.385189056 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.385210037 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.385221958 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.385267973 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.385282040 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.385294914 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.385304928 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.385328054 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.385355949 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.385364056 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.385377884 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.385447025 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.385504007 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.385518074 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.385529041 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.385555029 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.385567904 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.385579109 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.385587931 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.385596991 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.385626078 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.393620014 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.393634081 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.393645048 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.393656969 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.393732071 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.393732071 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.393764973 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.393784046 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.393800974 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.393812895 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.393825054 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.393834114 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.393836975 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.393858910 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.393877983 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.394115925 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.394165993 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.394179106 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.394191980 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.394215107 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.394224882 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.394253016 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.399066925 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.399077892 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.399097919 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.399108887 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.399122000 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.399135113 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.399136066 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.399180889 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.399219036 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.399230957 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.399240971 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.399252892 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.399266005 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.399267912 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.399279118 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.399308920 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.399308920 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.399492025 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.399513960 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.399524927 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.399544001 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.399559021 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.399646997 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.399660110 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.399668932 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.399674892 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.399687052 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.399704933 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.399727106 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.406239033 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.406306028 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.406307936 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.406320095 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.406333923 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.406347036 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.406357050 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.406367064 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.406378031 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.406389952 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.406404972 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.406404972 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.406415939 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.406445026 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.406455994 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.406467915 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.406481028 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.406521082 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.406675100 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.406693935 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.406721115 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.415595055 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.415606976 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.415621042 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.415652037 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.415658951 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.415673971 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.415674925 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.415712118 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.415723085 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.415734053 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.415744066 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.415777922 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.429682970 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.429697990 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.429721117 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.429742098 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.429757118 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.429757118 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.429757118 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.429774046 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.429785967 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.429796934 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.429810047 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.429831028 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.429831028 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.429877043 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.429891109 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.429903030 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.429913044 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.429954052 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.430126905 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.430140018 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.430180073 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.450308084 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.450330973 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.450350046 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.450361013 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.450366974 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.450371981 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.450402975 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.450474977 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.450493097 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.450506926 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.450520039 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.450532913 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.450570107 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.450570107 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.450603962 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.450615883 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.450629950 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.450644016 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.450654984 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.450679064 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.450679064 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.462589025 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.462600946 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.462687016 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.462697029 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.462712049 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.462723017 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.462733984 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.462738991 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.462776899 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.462776899 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.463676929 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.463687897 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.463700056 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.463711023 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.463721991 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.463731050 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.463735104 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.463747978 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.463758945 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.463773966 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.463773966 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.463818073 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.464310884 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.471976042 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.472004890 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.472035885 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.472045898 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.472049952 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.472063065 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.472074032 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.472106934 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.472137928 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.472150087 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.472165108 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.472172976 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.472178936 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.472206116 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.472206116 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.472651005 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.472668886 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.472680092 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.472692013 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.472702980 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.472704887 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.472732067 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.472757101 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.480577946 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.480593920 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.480607986 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.480624914 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.480635881 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.480647087 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.480655909 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.480659962 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.480704069 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.480710030 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.480722904 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.480792046 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.480876923 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.480889082 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.480900049 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.480931044 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.480931044 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.480958939 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.480972052 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.481072903 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.485894918 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.485905886 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.485953093 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.485970020 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.485971928 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.485984087 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.486027956 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.486047029 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.486148119 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.486335993 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.486355066 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.486372948 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.486383915 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.486396074 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.486404896 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.486406088 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.486423969 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.486447096 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.486509085 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.486521006 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.486542940 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.486553907 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.486928940 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.486941099 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.486955881 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.486974955 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.486975908 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.486989021 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.487000942 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.487011909 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.487029076 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.487029076 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.487080097 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.493033886 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.493047953 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.493067026 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.493082047 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.493107080 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.493107080 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.493120909 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.493134022 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.493148088 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.493169069 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.493211985 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.493230104 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.493241072 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.493267059 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.493299007 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.493726969 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.493745089 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.493757010 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.493767977 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.493783951 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.493787050 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.493823051 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.502548933 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.502564907 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.502585888 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.502597094 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.502608061 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.502620935 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.502634048 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.502636909 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.502656937 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.502669096 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.516436100 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.516457081 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.516556978 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.516568899 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.516580105 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.516583920 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.516596079 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.516622066 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.516680956 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.516714096 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.516727924 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.516746998 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.516762972 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.516766071 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.516776085 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.516819954 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.516990900 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.517003059 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.517033100 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.517039061 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.517086029 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.517087936 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.517098904 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.517163038 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.537288904 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.537313938 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.537328005 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.537339926 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.537353039 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.537364006 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.537395000 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.537508965 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.537520885 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.537533045 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.537544012 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.537554979 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.537559986 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.537561893 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.537585974 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.537607908 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.537806034 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.537856102 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.537868023 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.537874937 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.537879944 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.537925005 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.549000025 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.549029112 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.549041033 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.549058914 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.549071074 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.549071074 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.549084902 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.549097061 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.549139023 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.549616098 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.549628973 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.549675941 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.558757067 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.558778048 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.558789015 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.558803082 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.558815002 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.558831930 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.558831930 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.558851004 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.558861017 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.558875084 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.558937073 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.559231043 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.559248924 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.559262037 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.559273958 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.559333086 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.559401989 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.559416056 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.559436083 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.559446096 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.559451103 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.559458971 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.559497118 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.559777021 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.559799910 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.559811115 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.559827089 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.559840918 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.559875011 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.559886932 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.559899092 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.559935093 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.559952974 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.560188055 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.567447901 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.567462921 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.567486048 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.567502975 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.567506075 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.567516088 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.567527056 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.567538977 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.567550898 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.567562103 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.567594051 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.567594051 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.567771912 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.567790985 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.567809105 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.567868948 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.567935944 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.567985058 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.567994118 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.568002939 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.568027020 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.568046093 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.568197966 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.568248034 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.574748993 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.574763060 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.574774027 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.574784994 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.574795961 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.574806929 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.574807882 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.574825048 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.574843884 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.574855089 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.574877024 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.574887991 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.574889898 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.574898958 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.574913979 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.574943066 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.574999094 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.575015068 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.575018883 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.575030088 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.575041056 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.575052977 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.575058937 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.575064898 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.575083971 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.575092077 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.575095892 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.575107098 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.575118065 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.575118065 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.575122118 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.575191021 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.581348896 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.581500053 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.581511974 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.581588030 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.581640959 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.581653118 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.581664085 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.581701040 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.581721067 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.581787109 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.581799030 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.581865072 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.581940889 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.581953049 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.581964016 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.581994057 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.582098007 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.582245111 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.582256079 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.582298994 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.582298994 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.582550049 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.582561970 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.582607985 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.590918064 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.590934038 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.590946913 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.590962887 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.591021061 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.591209888 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.591224909 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.591239929 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.591250896 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.591269970 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.591316938 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.604655027 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.604846001 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.604969978 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.605137110 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.605329037 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.605341911 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.605355978 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.605380058 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.605391026 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.605391026 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.605397940 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.605411053 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.605422020 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.605436087 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.605465889 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.605495930 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.605731964 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.605743885 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.605755091 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.605792046 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.605887890 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.605891943 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.605906010 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.605983019 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.626987934 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.627263069 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.627275944 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.627329111 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.627749920 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.627793074 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.628043890 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.628055096 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.628071070 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.628083944 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.628130913 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.628171921 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.628189087 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.628195047 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.628201008 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.628212929 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.628226042 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.628237009 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.628251076 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.628271103 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.628271103 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.637434959 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.637449026 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.637460947 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.637494087 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.637571096 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.637583017 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.637593985 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.637638092 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.637638092 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.637721062 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.637732983 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.637784004 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.647423029 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.647437096 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.647448063 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.647556067 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.647572994 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.647586107 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.647598982 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.647659063 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.647659063 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.647737980 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.647749901 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.647762060 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.647778988 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.647788048 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.647793055 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.647849083 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.647895098 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.647942066 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.648071051 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.648082972 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.648093939 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.648125887 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.648257017 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.648268938 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.648279905 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.648332119 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.648332119 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.648422003 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.648433924 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.648444891 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.648458958 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.648482084 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.648503065 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.655721903 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.655844927 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.655855894 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.655867100 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.655878067 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.655899048 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.655926943 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.655992985 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.656011105 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.656069040 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.656141043 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.656188011 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.656285048 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.661434889 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.661447048 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.661458015 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.661478996 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.661494017 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.661544085 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.661597013 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.661608934 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.661622047 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.661648035 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.661708117 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.661741018 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.661900997 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.661911011 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.661922932 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.661940098 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.661957026 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.662035942 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.662163973 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.662174940 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.662187099 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.662198067 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.662209034 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.662218094 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.662224054 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.662236929 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.662275076 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.662300110 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.662444115 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.662801981 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.662812948 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.662826061 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.662837029 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.662848949 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.662853003 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.662913084 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.662949085 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.662961006 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.662971973 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.662992001 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.662995100 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.663003922 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.663022995 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.663068056 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.668230057 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.668245077 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.668257952 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.668292046 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.668361902 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.668401957 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.668540955 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.668554068 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.668653011 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.668682098 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.668694019 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.668704987 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.668750048 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.668852091 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.668889046 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.669044018 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.669055939 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.669074059 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.669086933 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.669092894 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.669143915 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.669339895 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.669352055 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.669384956 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.678051949 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.678107023 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.678119898 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.678131104 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.678142071 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.678153038 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.678160906 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.678160906 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.678167105 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.678195000 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.691715956 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.691730022 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.691741943 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.691802025 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.691802025 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.691858053 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.691869974 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.691881895 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.691894054 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.691905975 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.691910982 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.691951990 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.692210913 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.692223072 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.692234039 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.692246914 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.692264080 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.692290068 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.692502022 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.692513943 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.692580938 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.692662001 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.692672968 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.692899942 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.712440014 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.712455034 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.712466955 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.712542057 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.712579012 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.712771893 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.712784052 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.712795973 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.712817907 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.712917089 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.712929010 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.712938070 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.712939024 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.712968111 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.713124037 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.713171005 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.713174105 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.713186979 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.713198900 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.713210106 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.713239908 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.713279963 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.727299929 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.727432013 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.727442980 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.727453947 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.727466106 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.727477074 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.727484941 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.727493048 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.727552891 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.727593899 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.727607012 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.727669954 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.737212896 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.737370968 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.737382889 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.737456083 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.737456083 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.737514019 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.737525940 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.737536907 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.737550020 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.737580061 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.737580061 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.737680912 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.737865925 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.737878084 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.737888098 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.737900972 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.737914085 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.737947941 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.737947941 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.738338947 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.738349915 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.738362074 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.738373041 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.738384962 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.738394976 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.738406897 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.738419056 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.738419056 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.738445044 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.738476992 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.738581896 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.738812923 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.745712996 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.745727062 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.745767117 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.745862961 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.745874882 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.745884895 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.745929956 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.745965004 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.746001005 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.746172905 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.746428013 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.749465942 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.749480963 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.749492884 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.749504089 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.749516010 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.749556065 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.749578953 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.749610901 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.749624014 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.749676943 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.749793053 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.749804974 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.749814987 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.749829054 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.749850988 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.749876976 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.749967098 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.749979973 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.750034094 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.750139952 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.750153065 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.750165939 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.750180960 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.750194073 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.750194073 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.750214100 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.750245094 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.750319958 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.750332117 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.750344038 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.750396013 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.750471115 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.750483036 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.750494003 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.750505924 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.750516891 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.750528097 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.750562906 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.751137972 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.751148939 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.751163006 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.751173019 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.751185894 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.751214981 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.751214981 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.755861044 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.756002903 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.756028891 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.756040096 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.756092072 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.756216049 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.756227016 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.756274939 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.756381989 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.756398916 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.756412029 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.756422997 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.756434917 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.756445885 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.756447077 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.756457090 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.756470919 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.756505966 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.756505966 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.756865978 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.756879091 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.756894112 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.756903887 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.756942987 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.756942987 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.767796040 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.767811060 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.767874002 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.767956018 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.767971039 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.767982960 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.767996073 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.768008947 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.768049955 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.768105030 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.780952930 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.780967951 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.780980110 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.780992985 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.781003952 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.781018972 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.781039953 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.781039953 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.781073093 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.781080961 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.781090975 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.781121016 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.798197985 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.798212051 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.798224926 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.798240900 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.798274994 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.798274994 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.798355103 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.798367977 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.798378944 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.798396111 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.798429012 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.799019098 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.799031973 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.799046040 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.799057961 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.799069881 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.799081087 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.799091101 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.799091101 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.799093962 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.799105883 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.799118042 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.799122095 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.799135923 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.799149990 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.799158096 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.799158096 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.799169064 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.799180031 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.799187899 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.799195051 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.799205065 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.799216032 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.799227953 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.799262047 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.800178051 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.800251007 CET	49704	1950	192.168.2.8	154.216.20.162
Jan 8, 2025 15:01:17.805140018 CET	1950	49704	154.216.20.162	192.168.2.8
Jan 8, 2025 15:01:17.805228949 CET	1950	49704	154.216.20.162	192.168.2.8

Target ID:	0
Start time:	09:01:04
Start date:	08/01/2025
Path:	C:\Users\user\Desktop\LayyB0R.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\LayyB0R.exe"
Imagebase:	0x400000
File size:	2'693'632 bytes
MD5 hash:	46FE008A90DA36053C2283F88BAF327A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.1505624302.0000000002120000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000000.00000003.1491298614.0000000002190000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000003.1494152729.0000000000649000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000000.00000003.1493458753.0000000002DD0000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000000.00000003.1493301738.0000000002BB0000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000000.00000002.1505769565.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	09:01:09
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\svchost.exe"
Imagebase:	0xdc0000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.1494146858.00000000005F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000002.00000003.1505712687.0000000004AB0000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000002.00000003.1505920756.0000000004CD0000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000002.1569395693.0000000002DD0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	09:01:10
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5552 -s 468
Imagebase:	0xe20000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	09:01:16
Start date:	08/01/2025
Path:	C:\Windows\System32\fontdrvhost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\fontdrvhost.exe"
Imagebase:	0x7ff69ba10000
File size:	827'408 bytes
MD5 hash:	BBCB897697B3442657C7D6E3EDDBD25F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	09:01:20
Start date:	08/01/2025
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 5624 -s 136
Imagebase:	0x7ff632ce0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	24.5%
Dynamic/Decrypted Code Coverage:	1.6%
Signature Coverage:	3.1%
Total number of Nodes:	913
Total number of Limit Nodes:	8

Executed Functions

Function 0042BEFA Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 86
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0042BF03
HeapAlloc.KERNEL32(00000000,00000008,00040000), ref: 0042BF56

Part of subcall function 0042BFEB: HeapAlloc.KERNEL32(?,00000008,00000010,?,0042BF7F,?,0042BC80,00000000), ref: 0042BFF6

HeapFree.KERNEL32(00000000,00000000,?), ref: 0042BFA2
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 0042BFCE
KiUserExceptionDispatcher.NTDLL(00000000,00000000,00642D40), ref: 0042BFD4

Strings

@-d, xrefs: 0042BF12, 0042BF21, 0042BFD6, 0042BFDC
GNzcI3uZfeVBx4IpN5HKbbHyA9Xk0jQBupq7VTqGRU7u4TCmeGAKd8MC2t7XxA-|E6ZugqjWIr-5JZA4uxfNjQbqfsRKoFBWUnD9mqEg0SXYa7P98m0fkgnb9l1MqA6BUFi23z8hRpdvdlhnlWRgfgEnavjYDjsbCEfxCcTeEu9ScHBMDvgGi80LQ5C9nremaLQqj82Lb2AC7pwrYxziJq90Xca4ALHZc6S5CDFI6X3ncr2AUKqfoTjEMIO6W2OJ7Zxz, xrefs: 0042BF36
0d, xrefs: 0042BF1C

Memory Dump Source

Source File: 00000000.00000002.1505362557.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1505362557.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LayyB0R.jbxd

Similarity

API ID: Heap$AllocFree$DispatcherExceptionProcessUserVirtual
String ID: 0d$@-d$GNzcI3uZfeVBx4IpN5HKbbHyA9Xk0jQBupq7VTqGRU7u4TCmeGAKd8MC2t7XxA-|E6ZugqjWIr-5JZA4uxfNjQbqfsRKoFBWUnD9mqEg0SXYa7P98m0fkgnb9l1MqA6BUFi23z8hRpdvdlhnlWRgfgEnavjYDjsbCEfxCcTeEu9ScHBMDvgGi80LQ5C9nremaLQqj82Lb2AC7pwrYxziJq90Xca4ALHZc6S5CDFI6X3ncr2AUKqfoTjEMIO6W2OJ7Zxz
API String ID: 3598810914-1872762547
Opcode ID: c6efd58d8705114bd6ce61614c52128382e58d8c03c364074242ce3426763076
Instruction ID: 2a5401b6a08ddf3dc2aaa75bc5cda96bcf132d324c7078dfa8bf77b618d7fb6c
Opcode Fuzzy Hash: c6efd58d8705114bd6ce61614c52128382e58d8c03c364074242ce3426763076
Instruction Fuzzy Hash: 17313A71A00219AFCB10CF99ED80BAFBBF4EB09304F50802AE559E7350D735A945CF98

Function 0064A47E Relevance: 3.0, APIs: 2, Instructions: 41processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 0064A4A6
Module32First.KERNEL32(00000000,00000224), ref: 0064A4C6

Memory Dump Source

Source File: 00000000.00000003.1494152729.0000000000649000.00000040.00000020.00020000.00000000.sdmp, Offset: 00649000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_649000_LayyB0R.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 48289d32bb4ef673fcca93276063c5c133bcde8e83ba7f284f3e4b57b0bb0595
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: BEF096312407107FE7203BF5D88DBAEB6EDAF49724F100628E642D55C0DBB4EC458A62

Function 0212003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0212024D

Strings

cess, xrefs: 0212018D
kernel32.dll, xrefs: 0212008F, 02120095

Memory Dump Source

Source File: 00000000.00000002.1505624302.0000000002120000.00000040.00001000.00020000.00000000.sdmp, Offset: 02120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2120000_LayyB0R.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 6307871ac7b424446d8f48e480cf3fe90682051c211dfdc8c527356dcb06ef3a
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 61526A74A01229DFDB64CF58C984BACBBB1BF09304F1581D9E54DAB351DB30AA99CF14

Function 0042BCD2 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 132
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0042C033: HeapAlloc.KERNEL32(?,00000008,00000001,?,00000000), ref: 0042C069
Part of subcall function 0042C033: _strlen.LIBCMT ref: 0042C090
Part of subcall function 0042C033: HeapFree.KERNEL32(?,00000000,00000000,?,00000000), ref: 0042C1E4

HeapAlloc.KERNEL32(00000000,00000008,?), ref: 0042BD27
HeapAlloc.KERNEL32(00000000,00000008,00000015), ref: 0042BDCE
HeapAlloc.KERNEL32(00000000,00000008,?), ref: 0042BE13

Part of subcall function 0042BFEB: HeapAlloc.KERNEL32(?,00000008,00000010,?,0042BF7F,?,0042BC80,00000000), ref: 0042BFF6

RtlFreeHeap.NTDLL(00000000,00000000,00000000), ref: 0042BE54

Strings

H`E, xrefs: 0042BD05

Memory Dump Source

Source File: 00000000.00000002.1505362557.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1505362557.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LayyB0R.jbxd

Similarity

API ID: Heap$Alloc$Free$_strlen
String ID: H`E
API String ID: 2043604496-3800292306
Opcode ID: 6c8f0c34e0a748ada23f9682636e364d14b5594a34bf1f3ad6221a11dd4e9d3e
Instruction ID: 9f7fb62bb3ce8217459da819ea948e7cfebb82f451e23faa5cf46441fed875bc
Opcode Fuzzy Hash: 6c8f0c34e0a748ada23f9682636e364d14b5594a34bf1f3ad6221a11dd4e9d3e
Instruction Fuzzy Hash: 9A41D475600305AFD720DF64EC41F9BB7E8EF44708F44881EFA8992252E779E914CB99

Function 004392CC Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,00000000,?,?), ref: 00439314

Part of subcall function 00439098: VirtualAlloc.KERNELBASE(00000000,00001012,00001000,00000004), ref: 004390C1

VirtualAlloc.KERNELBASE(00000000,00400000,00001000,00000004), ref: 00439366
VirtualProtect.KERNELBASE(0000002C,?,00000040,0000002C), ref: 004393C0
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 004393F3

Strings

,, xrefs: 00439344

Memory Dump Source

Source File: 00000000.00000002.1505362557.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1505362557.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LayyB0R.jbxd

Similarity

API ID: Virtual$Alloc$FreeProtect
String ID: ,
API String ID: 980677596-3772416878
Opcode ID: 846e80d9192284de11e110977aaee4205ca63ec1a267e246cbf1a7208dcc7df3
Instruction ID: c7f9954aaf92802dc8596fc704158f53f7323d53bf85fe34f6f5e7b839a10a37
Opcode Fuzzy Hash: 846e80d9192284de11e110977aaee4205ca63ec1a267e246cbf1a7208dcc7df3
Instruction Fuzzy Hash: B3510AB590060AAFDB10DFA9C881A9EBBF4FF08354F10951AF959A7240D3B4E951CBA4

Function 004392CC Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,00000000,?,?), ref: 00439314

Part of subcall function 00439098: VirtualAlloc.KERNELBASE(00000000,00001012,00001000,00000004), ref: 004390C1

VirtualAlloc.KERNELBASE(00000000,00400000,00001000,00000004), ref: 00439366
VirtualProtect.KERNELBASE(0000002C,?,00000040,0000002C), ref: 004393C0
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 004393F3

Strings

,, xrefs: 00439344

Memory Dump Source

Source File: 00000000.00000003.1491424479.0000000000439000.00000040.00000001.01000000.00000003.sdmp, Offset: 00439000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_439000_LayyB0R.jbxd

Similarity

API ID: Virtual$Alloc$FreeProtect
String ID: ,
API String ID: 980677596-3772416878
Opcode ID: 846e80d9192284de11e110977aaee4205ca63ec1a267e246cbf1a7208dcc7df3
Instruction ID: c7f9954aaf92802dc8596fc704158f53f7323d53bf85fe34f6f5e7b839a10a37
Opcode Fuzzy Hash: 846e80d9192284de11e110977aaee4205ca63ec1a267e246cbf1a7208dcc7df3
Instruction Fuzzy Hash: B3510AB590060AAFDB10DFA9C881A9EBBF4FF08354F10951AF959A7240D3B4E951CBA4

Function 0042BC80 Relevance: 4.5, APIs: 3, Instructions: 30
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 0042BC87
WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 0042BC9A
CloseHandle.KERNELBASE(00000000), ref: 0042BCC7

Part of subcall function 0042BFEB: HeapAlloc.KERNEL32(?,00000008,00000010,?,0042BF7F,?,0042BC80,00000000), ref: 0042BFF6

Memory Dump Source

Source File: 00000000.00000002.1505362557.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1505362557.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LayyB0R.jbxd

Similarity

API ID: AllocCloseCreateEventHandleHeapObjectSingleWait
String ID:
API String ID: 783827187-0
Opcode ID: 4dc99e0828cb73d3b042eab61e92d94bd9680a422529f13331d7a34ac1021427
Instruction ID: af46de013a0d7d92c1d72c29f23f54d966f7dd85d52430f69652ae25bcc9dccc
Opcode Fuzzy Hash: 4dc99e0828cb73d3b042eab61e92d94bd9680a422529f13331d7a34ac1021427
Instruction Fuzzy Hash: C2E06DB9A016227BD3122B22AE06E7B776CEF92702705442AF804E3250DF28DC01D6F9

Function 00433C75 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 23
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FlsGetValue.KERNELBASE ref: 00433CA5

Strings

FlsGetValue, xrefs: 00433C85

Memory Dump Source

Source File: 00000000.00000002.1505362557.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1505362557.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LayyB0R.jbxd

Similarity

API ID: Value
String ID: FlsGetValue
API String ID: 3702945584-662576866
Opcode ID: 74a72e2ea0314db87ced77037b28d9a6ce5b8a2388f67483e5d85f0e08c8c5e8
Instruction ID: 5f3e0b4de25dc0737c33fcecb76ee88c50ce7d49f03d1e25d6551cb25966e40a
Opcode Fuzzy Hash: 74a72e2ea0314db87ced77037b28d9a6ce5b8a2388f67483e5d85f0e08c8c5e8
Instruction Fuzzy Hash: 2EE0CD33B802287782312BD5BD05BEB7E44D751BB2F144173FB0C56281D6A94D5185DC

Function 02120E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,02120223,?,?), ref: 02120E19
SetErrorMode.KERNELBASE(00000000,?,?,02120223,?,?), ref: 02120E1E

Memory Dump Source

Source File: 00000000.00000002.1505624302.0000000002120000.00000040.00001000.00020000.00000000.sdmp, Offset: 02120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2120000_LayyB0R.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 44aadaba4ceec3c7039f90236b980d150b62195d6aed535f06090d2979b601d5
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 68D012311451287BD7002A94DC09BCD7B1CDF09B66F108011FB0DD9080C770954046E5

Function 00431289 Relevance: 2.6, APIs: 2, Instructions: 67
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,00000000,00430B94,00434C4B,?,004344E3,?,?,00000000,?,?,00434548,?,004343DB,00000000,?), ref: 0043128D
SetLastError.KERNEL32(00000000,?,00000000,004343DB,?,?,?,00477898,0000002C,0043444C,?,?,?), ref: 0043132F

Part of subcall function 00433C75: FlsGetValue.KERNELBASE ref: 00433CA5

Memory Dump Source

Source File: 00000000.00000002.1505362557.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1505362557.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LayyB0R.jbxd

Similarity

API ID: ErrorLast$Value
String ID:
API String ID: 1883355122-0
Opcode ID: 483777f50ac71e4f52105c5ed3062467242286bacb5dff78a89a745269670e84
Instruction ID: 7ae844e43b4e0d2907d5aa361c861ee15f6527edd1f4f3dcae61067e151ce711
Opcode Fuzzy Hash: 483777f50ac71e4f52105c5ed3062467242286bacb5dff78a89a745269670e84
Instruction Fuzzy Hash: 591108712092106EE7103BB69CC6EAF269CCB4D3BAF10223BF914A11B1DB5D4C5B516E

Function 004391B0 Relevance: 1.4, APIs: 1, Instructions: 133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 0043926D

Memory Dump Source

Source File: 00000000.00000002.1505362557.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1505362557.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LayyB0R.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: de148ecc26438995122263fd84e79d06e7e20828183585f1ddfda33d16eac7f6
Instruction ID: 80fbf0fecc1045b27c107abcbf320e773f3ff1e05f448897efdd00af33896b18
Opcode Fuzzy Hash: de148ecc26438995122263fd84e79d06e7e20828183585f1ddfda33d16eac7f6
Instruction Fuzzy Hash: A851CC31A0464ADFDF41CF98C881AEEBBF0EF09310F281496E465F7241C278AE51DB29

Function 004391B0 Relevance: 1.4, APIs: 1, Instructions: 133COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 0043926D

Memory Dump Source

Source File: 00000000.00000003.1491424479.0000000000439000.00000040.00000001.01000000.00000003.sdmp, Offset: 00439000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_439000_LayyB0R.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: de148ecc26438995122263fd84e79d06e7e20828183585f1ddfda33d16eac7f6
Instruction ID: 80fbf0fecc1045b27c107abcbf320e773f3ff1e05f448897efdd00af33896b18
Opcode Fuzzy Hash: de148ecc26438995122263fd84e79d06e7e20828183585f1ddfda33d16eac7f6
Instruction Fuzzy Hash: A851CC31A0464ADFDF41CF98C881AEEBBF0EF09310F281496E465F7241C278AE51DB29

Function 0064A13D Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 0064A18E

Memory Dump Source

Source File: 00000000.00000003.1494152729.0000000000649000.00000040.00000020.00020000.00000000.sdmp, Offset: 00649000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_649000_LayyB0R.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 84560cb78856ac3d334e38bc64f882ccf621b3e640de368482b18c81886e9f2e
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 03113C79A40208FFDB01DF98C985E98BBF5AF08350F0580A4F9489B362D371EA50DF81

Function 00439098 Relevance: 1.3, APIs: 1, Instructions: 30
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00001012,00001000,00000004), ref: 004390C1

Memory Dump Source

Source File: 00000000.00000002.1505362557.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1505362557.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LayyB0R.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 5fa5c9145237fa88e1aa37702aad2718761a025d2b836103e406ca8614d22d44
Instruction ID: e4093ad80bf78e98c72bba1ec1b53d0bb2879be621b88dd1afff0ef72a226250
Opcode Fuzzy Hash: 5fa5c9145237fa88e1aa37702aad2718761a025d2b836103e406ca8614d22d44
Instruction Fuzzy Hash: AD01C471D00249EFEB00DF95C449BAEBBB0AB18326F108059E521AA291C3BC5A86DF85

Function 00439098 Relevance: 1.3, APIs: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00001012,00001000,00000004), ref: 004390C1

Memory Dump Source

Source File: 00000000.00000003.1491424479.0000000000439000.00000040.00000001.01000000.00000003.sdmp, Offset: 00439000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_439000_LayyB0R.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 5fa5c9145237fa88e1aa37702aad2718761a025d2b836103e406ca8614d22d44
Instruction ID: e4093ad80bf78e98c72bba1ec1b53d0bb2879be621b88dd1afff0ef72a226250
Opcode Fuzzy Hash: 5fa5c9145237fa88e1aa37702aad2718761a025d2b836103e406ca8614d22d44
Instruction Fuzzy Hash: AD01C471D00249EFEB00DF95C449BAEBBB0AB18326F108059E521AA291C3BC5A86DF85

Non-executed Functions

Function 0042CB32 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0042CB3E
IsDebuggerPresent.KERNEL32 ref: 0042CC0A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0042CC2A
UnhandledExceptionFilter.KERNEL32(?), ref: 0042CC34

Memory Dump Source

Source File: 00000000.00000002.1505362557.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1505362557.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LayyB0R.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 0a32ae6df5018c4e9d2e897c4d0c4c3add5bc9dd49ee71876b5e9a2547ad3e9a
Instruction ID: 42faa4f9909b3aef762f1b69cb6fadd3819c4f53252a6b8088f9c2c7ed860dda
Opcode Fuzzy Hash: 0a32ae6df5018c4e9d2e897c4d0c4c3add5bc9dd49ee71876b5e9a2547ad3e9a
Instruction Fuzzy Hash: EC312B75D4522C9BDB20DFA5E9897CDBBB8BF08304F5040EAE40DAB250EB745A84DF09

Function 0214CD99 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0214CDA5
IsDebuggerPresent.KERNEL32 ref: 0214CE71
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0214CE91
UnhandledExceptionFilter.KERNEL32(?), ref: 0214CE9B

Memory Dump Source

Source File: 00000000.00000002.1505624302.0000000002120000.00000040.00001000.00020000.00000000.sdmp, Offset: 02120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2120000_LayyB0R.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 0a32ae6df5018c4e9d2e897c4d0c4c3add5bc9dd49ee71876b5e9a2547ad3e9a
Instruction ID: 3ad2ee66e9b158b6d3f7cf995343cf46f2e8360a33d07a07f5e9d408afe76cdd
Opcode Fuzzy Hash: 0a32ae6df5018c4e9d2e897c4d0c4c3add5bc9dd49ee71876b5e9a2547ad3e9a
Instruction Fuzzy Hash: 3A314979D4221C9BDF20DFA0D989BCDBBB8AF08300F1041AAE40DAB250EB715A84DF44

Function 00431508 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00431600
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 0043160A
UnhandledExceptionFilter.KERNEL32(-00000327,?,?,?,?,?,00000000), ref: 00431617

Memory Dump Source

Source File: 00000000.00000002.1505362557.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1505362557.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LayyB0R.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 147832bb287b88a15beb7056b8bcaa81536f4274b3f866e702757040a2f54f19
Instruction ID: ae86be7521b6b59597c4dfc29ab5f864a3d94f5c8c14d9f12b2fd6c106cb2b0a
Opcode Fuzzy Hash: 147832bb287b88a15beb7056b8bcaa81536f4274b3f866e702757040a2f54f19
Instruction Fuzzy Hash: BE31C67490122C9BCB21DF65D9897CDBBB4BF18310F5041EAE41CA6261EB749F858F49

Function 0215176F Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 02151867
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 02151871
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 0215187E

Memory Dump Source

Source File: 00000000.00000002.1505624302.0000000002120000.00000040.00001000.00020000.00000000.sdmp, Offset: 02120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2120000_LayyB0R.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 147832bb287b88a15beb7056b8bcaa81536f4274b3f866e702757040a2f54f19
Instruction ID: 684e1d09fb4c50e7761751a32bf8e016cfbb4f94d599e2dd5d12bcfcb646ea05
Opcode Fuzzy Hash: 147832bb287b88a15beb7056b8bcaa81536f4274b3f866e702757040a2f54f19
Instruction Fuzzy Hash: E431C574941228ABCB21DF68DD88BDDBBB5BF08350F5041EAE81CA7250EB749F858F45

Function 0212092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

l, xrefs: 02120966
GetProcAddress., xrefs: 021209DC, 021209DF, 021209E4
., xrefs: 0212095F

Memory Dump Source

Source File: 00000000.00000002.1505624302.0000000002120000.00000040.00001000.00020000.00000000.sdmp, Offset: 02120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2120000_LayyB0R.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: c47a0ca15b32ba9ed95b3f1139f05f2783e18e5976a0671db0a234a546f7024c
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: F23169B6901619CFDB10CF99C880AAEBBF5FF18324F15414AE445B7210D771EA59CFA4

Function 004381D2 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,004381CD,?,?,00000008,?,?,00437DCF,00000000), ref: 004383FF

Memory Dump Source

Source File: 00000000.00000002.1505362557.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1505362557.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LayyB0R.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: a57a128d1c16c12dcf4902804604208ecf22197fe885c780f8585ef138a26dff
Instruction ID: ad84d1db3417f16a611dee80d1a4d95a75d70bb4da77cef0a64069da59ef5b86
Opcode Fuzzy Hash: a57a128d1c16c12dcf4902804604208ecf22197fe885c780f8585ef138a26dff
Instruction Fuzzy Hash: 21B15A315106099FD715CF28C48AB66BBA0FF48364F25969DF899CF3A1C739D982CB44

Function 02158439 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,02158434,?,?,00000008,?,?,02158036,00000000), ref: 02158666

Memory Dump Source

Source File: 00000000.00000002.1505624302.0000000002120000.00000040.00001000.00020000.00000000.sdmp, Offset: 02120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2120000_LayyB0R.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: a57a128d1c16c12dcf4902804604208ecf22197fe885c780f8585ef138a26dff
Instruction ID: 085091373218556bb519e53e17d26ca1faec917686eef746ad4fdc09f9e01931
Opcode Fuzzy Hash: a57a128d1c16c12dcf4902804604208ecf22197fe885c780f8585ef138a26dff
Instruction Fuzzy Hash: 5AB16F31660618DFD719CF28C48AB657BE1FF45368F268698ECA9CF2A1C735D981CB40

Function 0042CDD5 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 0042CDEB

Memory Dump Source

Source File: 00000000.00000002.1505362557.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1505362557.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LayyB0R.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 77b3093be1156be3bc706a8abc0d27d42b0644c93a3c5185c8af99966272e9a2
Instruction ID: 4e230acca2c0943960e613f45b8d74b08b3d28c2e242260d3d20a9101a00cee3
Opcode Fuzzy Hash: 77b3093be1156be3bc706a8abc0d27d42b0644c93a3c5185c8af99966272e9a2
Instruction Fuzzy Hash: 4C516BB1A112158FEB24CF59E9957AFB7F0FB88350F65802AD409EB350D3789940CB59

Function 00431B09 Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1505362557.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1505362557.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LayyB0R.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fac21ddf36a1cac62d688ec0aabb3d721857be582b74a47d93c30dd5619bbae
Instruction ID: b74e4d7ad6079f2158c0893ebec8bec6c122f4474772ff2b14e4ac2acf838b12
Opcode Fuzzy Hash: 6fac21ddf36a1cac62d688ec0aabb3d721857be582b74a47d93c30dd5619bbae
Instruction Fuzzy Hash: 2C41A57580421CAEDB24DF69CC89AAAB7B8AF49304F1452DEE41D93211DA359E84CF64

Function 02151D70 Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1505624302.0000000002120000.00000040.00001000.00020000.00000000.sdmp, Offset: 02120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2120000_LayyB0R.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fac21ddf36a1cac62d688ec0aabb3d721857be582b74a47d93c30dd5619bbae
Instruction ID: a455defa80921b4191cb0144cb38e29d39ca3a10d1ffc96157ec9e71d29d31b2
Opcode Fuzzy Hash: 6fac21ddf36a1cac62d688ec0aabb3d721857be582b74a47d93c30dd5619bbae
Instruction Fuzzy Hash: DE4192B5845229AFDB21DF69CC88BEABBB9EF45304F1442D9E81DD3200DB359E858F50

Function 0042CCC5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0002CCD1,0042C635), ref: 0042CCCA

Memory Dump Source

Source File: 00000000.00000002.1505362557.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1505362557.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LayyB0R.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 2ef17a7829592e77de669268fa308c7993c865907c94676bb5a929c7a250335f
Instruction ID: edde5bba0472f2246b45327483f68c3b9c4dae570f80fb26b3fbfc0cc39a0c7e
Opcode Fuzzy Hash: 2ef17a7829592e77de669268fa308c7993c865907c94676bb5a929c7a250335f
Instruction Fuzzy Hash:

Function 0214CF2C Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(0042CCD1,0214C89C), ref: 0214CF31

Memory Dump Source

Source File: 00000000.00000002.1505624302.0000000002120000.00000040.00001000.00020000.00000000.sdmp, Offset: 02120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2120000_LayyB0R.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 2ef17a7829592e77de669268fa308c7993c865907c94676bb5a929c7a250335f
Instruction ID: edde5bba0472f2246b45327483f68c3b9c4dae570f80fb26b3fbfc0cc39a0c7e
Opcode Fuzzy Hash: 2ef17a7829592e77de669268fa308c7993c865907c94676bb5a929c7a250335f
Instruction Fuzzy Hash:

Function 0042C231 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1505362557.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1505362557.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LayyB0R.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d193c468afbce6fbd9eb4e5394dbbb247effe2f843c3929c2b1e459493df29d4
Instruction ID: c65d13f3938e86a1c1ac9610a8e364237ea661446d7bb90356398c89c9b5cd3b
Opcode Fuzzy Hash: d193c468afbce6fbd9eb4e5394dbbb247effe2f843c3929c2b1e459493df29d4
Instruction Fuzzy Hash: BF51C3206182E64ED31D8A3D58A5139FFE0AB96101F4C87EFE9DADB383C428C945C7B1

Function 0214C498 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1505624302.0000000002120000.00000040.00001000.00020000.00000000.sdmp, Offset: 02120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2120000_LayyB0R.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d193c468afbce6fbd9eb4e5394dbbb247effe2f843c3929c2b1e459493df29d4
Instruction ID: 1af8a6b8d5ef10c33828f3629f8009c4b6c8363c6ac51e4e2f56d85c8ff8f561
Opcode Fuzzy Hash: d193c468afbce6fbd9eb4e5394dbbb247effe2f843c3929c2b1e459493df29d4
Instruction Fuzzy Hash: 4251A3202182E64ED31D8A3D58A5539FFE1AB96101F4C87EEE9DACB383C428C555C7A1

Function 0042C400 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1505362557.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1505362557.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LayyB0R.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94a5601144706b6f3443770d4d999911805d9ed5dd19e39bfe06ad26875fec32
Instruction ID: e7de1f71a5d65e498c01162ad52c815fa767125d8db88433021dc05d342508ba
Opcode Fuzzy Hash: 94a5601144706b6f3443770d4d999911805d9ed5dd19e39bfe06ad26875fec32
Instruction Fuzzy Hash: C03172205040A50EEB6D873E4879139FFE1AA8920274983AFE5FBCA1C2D55CC545DBB0

Function 0214C667 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1505624302.0000000002120000.00000040.00001000.00020000.00000000.sdmp, Offset: 02120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2120000_LayyB0R.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94a5601144706b6f3443770d4d999911805d9ed5dd19e39bfe06ad26875fec32
Instruction ID: 013ac5cbfd8796cc2251a49e392f06af4dd657bd35cbabb70beb32d43f3a86d3
Opcode Fuzzy Hash: 94a5601144706b6f3443770d4d999911805d9ed5dd19e39bfe06ad26875fec32
Instruction Fuzzy Hash: 1E3183605040A50EE76D873E4879139FFE1AA8920274D43AFE5FBCA2C2D95CC545DBB0

Function 00649D5B Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1494152729.0000000000649000.00000040.00000020.00020000.00000000.sdmp, Offset: 00649000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_649000_LayyB0R.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: d7cc26002e8cbd9de1b28e793f9727b1835abeac7cb148724ce596e5dd7da2d7
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: F8117C72780500AFDB44DE55DC81FA773EAEF88360B298169ED08CB356D675EC02CB60

Function 02120D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1505624302.0000000002120000.00000040.00001000.00020000.00000000.sdmp, Offset: 02120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2120000_LayyB0R.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 6a7ae1ff5e9c438eb39d1739dd139b69842fd91671cf499703bb93b43dee2957
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 3C012B766516148FDF21CF20C804BAA33F5FB99205F1541B4E506D7341E370A845CB80

Function 00439277 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1505362557.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1505362557.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LayyB0R.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d558d006f42668ff0cb3938fe5626bc0e09627662ae6e14989234e2d35bd114b
Instruction ID: 7675036b0cbaeec3b79254137bf16d4b44bb9a97824819e20ca5cf47a51b5ef9
Opcode Fuzzy Hash: d558d006f42668ff0cb3938fe5626bc0e09627662ae6e14989234e2d35bd114b
Instruction Fuzzy Hash: 0DF0C279A00A00EF8714DF4AC544C9777F6EB88710F2549D6E4049B320D3F4DD44CB54

Function 00439277 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1491424479.0000000000439000.00000040.00000001.01000000.00000003.sdmp, Offset: 00439000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_439000_LayyB0R.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d558d006f42668ff0cb3938fe5626bc0e09627662ae6e14989234e2d35bd114b
Instruction ID: 7675036b0cbaeec3b79254137bf16d4b44bb9a97824819e20ca5cf47a51b5ef9
Opcode Fuzzy Hash: d558d006f42668ff0cb3938fe5626bc0e09627662ae6e14989234e2d35bd114b
Instruction Fuzzy Hash: 0DF0C279A00A00EF8714DF4AC544C9777F6EB88710F2549D6E4049B320D3F4DD44CB54

Function 004378C3 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 147COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,0043722F), ref: 004378DC

Strings

exp, xrefs: 0043795B, 004379C0
sqrt, xrefs: 00437A1B
log, xrefs: 00437939, 00437948
log10, xrefs: 0043791E, 0043792D
acos, xrefs: 00437A12
pow, xrefs: 0043797A, 00437A24, 00437A71
asin, xrefs: 00437A09

Memory Dump Source

Source File: 00000000.00000002.1505362557.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1505362557.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LayyB0R.jbxd

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: 791412bdd8908b3afe492d2992d678c69540c7ca568271baefb7fc38a389ac3a
Instruction ID: c44c5b8514d1aa23157313693abc2c0029e949ab2c4641301568c17ff8061e4e
Opcode Fuzzy Hash: 791412bdd8908b3afe492d2992d678c69540c7ca568271baefb7fc38a389ac3a
Instruction Fuzzy Hash: E3519DF0908A0ACBEF20AF98E84C1AEBFB0FF09314F119157D4C1A6264D7788A15DF59

Function 0042E841 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0042E960
___TypeMatch.LIBVCRUNTIME ref: 0042EA6E
_UnwindNestedFrames.LIBCMT ref: 0042EBC0
CallUnexpected.LIBVCRUNTIME ref: 0042EBDB

Strings

csm, xrefs: 0042E8EB
csm, xrefs: 0042E87E
csm, xrefs: 0042E997

Memory Dump Source

Source File: 00000000.00000002.1505362557.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1505362557.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LayyB0R.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: a65231c7224523d78c135119b38e93c421f23d8deef9d53e41ae7645979b48cb
Instruction ID: 76a96f9c105297bffa1ec5f26c5fbed64ee5ac1727e0173b64fd743f997f4b24
Opcode Fuzzy Hash: a65231c7224523d78c135119b38e93c421f23d8deef9d53e41ae7645979b48cb
Instruction Fuzzy Hash: 64B19D71E00229DFCF14DFA6E8419AEBB75FF14314B94456BE801AB212C339EA51CF99

Function 0214EAA8 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0214EBC7
___TypeMatch.LIBVCRUNTIME ref: 0214ECD5
_UnwindNestedFrames.LIBCMT ref: 0214EE27
CallUnexpected.LIBVCRUNTIME ref: 0214EE42

Strings

csm, xrefs: 0214EBFE
csm, xrefs: 0214EAE5
csm, xrefs: 0214EB52

Memory Dump Source

Source File: 00000000.00000002.1505624302.0000000002120000.00000040.00001000.00020000.00000000.sdmp, Offset: 02120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2120000_LayyB0R.jbxd

Yara matches

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: a65231c7224523d78c135119b38e93c421f23d8deef9d53e41ae7645979b48cb
Instruction ID: 8721b380b88cc6e505b9809986c8d5c47054100d6dff124a8dc07f176f4015b7
Opcode Fuzzy Hash: a65231c7224523d78c135119b38e93c421f23d8deef9d53e41ae7645979b48cb
Instruction Fuzzy Hash: F4B17471D40219EFCF25DFA8C9809AEB7B6FF08314F14856AE8196B211DB31EA51CF91

Function 0042C033 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 172memoryCOMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0042C04D
HeapAlloc.KERNEL32(?,00000008,00000001,?,00000000), ref: 0042C069
_strlen.LIBCMT ref: 0042C090
___from_strstr_to_strchr.LIBCMT ref: 0042C118
HeapFree.KERNEL32(?,00000000,00000000,?,00000000), ref: 0042C1E4

Strings

!?#$%&()*+-,/:;<>=@[\]^`{|}~, xrefs: 0042C0D4, 0042C117, 0042C1B3, 0042C1BC

Memory Dump Source

Source File: 00000000.00000002.1505362557.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1505362557.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LayyB0R.jbxd

Similarity

API ID: Heap_strlen$AllocFree___from_strstr_to_strchr
String ID: !?#$%&()*+-,/:;<>=@[\]^`{|}~
API String ID: 355428601-2271055266
Opcode ID: 18ba3ee87ac263ca046d0cc64a6699f702523e87a887ffd6cf0ee4ead859b1c6
Instruction ID: a8cb22043a8aa05832ee2590f306a077f251e6838bcd97514f5f7ebd8ee95794
Opcode Fuzzy Hash: 18ba3ee87ac263ca046d0cc64a6699f702523e87a887ffd6cf0ee4ead859b1c6
Instruction Fuzzy Hash: 3651F4756082648BE320CE18E4817BF77E6EF56758FD4045AD9858B303D329AD06CB8A

Function 0214C29A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 172memoryCOMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0214C2B4
RtlAllocateHeap.NTDLL(?,00000008,00000001), ref: 0214C2D0
_strlen.LIBCMT ref: 0214C2F7
___from_strstr_to_strchr.LIBCMT ref: 0214C37F
HeapFree.KERNEL32(?,00000000,00000000,?,00000000), ref: 0214C44B

Strings

!?#$%&()*+-,/:;<>=@[\]^`{|}~, xrefs: 0214C33B, 0214C37E, 0214C41A, 0214C423

Memory Dump Source

Source File: 00000000.00000002.1505624302.0000000002120000.00000040.00001000.00020000.00000000.sdmp, Offset: 02120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2120000_LayyB0R.jbxd

Yara matches

Similarity

API ID: Heap_strlen$AllocateFree___from_strstr_to_strchr
String ID: !?#$%&()*+-,/:;<>=@[\]^`{|}~
API String ID: 1213348923-2271055266
Opcode ID: 18ba3ee87ac263ca046d0cc64a6699f702523e87a887ffd6cf0ee4ead859b1c6
Instruction ID: f8c812b0d800ae788e56f680f4a0b27b82bc0c1b43c6bbdcc39fab0d1f2e1d06
Opcode Fuzzy Hash: 18ba3ee87ac263ca046d0cc64a6699f702523e87a887ffd6cf0ee4ead859b1c6
Instruction Fuzzy Hash: 2C5129B158A2448FE320CE19C4407BBB7E6EF95758FC8046BD5DC8B601EB25EA06C7D9

Function 0042D940 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 0042D977
___except_validate_context_record.LIBVCRUNTIME ref: 0042D97F
_ValidateLocalCookies.LIBCMT ref: 0042DA08
__IsNonwritableInCurrentImage.LIBCMT ref: 0042DA33
_ValidateLocalCookies.LIBCMT ref: 0042DA88

Strings

csm, xrefs: 0042DA1D

Memory Dump Source

Source File: 00000000.00000002.1505362557.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1505362557.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LayyB0R.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 727bd755396df652e1a708ec171ae51c463fec0952143e88064398cf5f6b08bc
Instruction ID: c3ff90e6c98b77f7825d4f6483462e13c2c6f666ebbe1c2a106e591db53f6d38
Opcode Fuzzy Hash: 727bd755396df652e1a708ec171ae51c463fec0952143e88064398cf5f6b08bc
Instruction Fuzzy Hash: 7941C534F002289BCF10DF69E885A9FBBB1AF45314F64805BF819AB352C739D951CB99

Function 00433A48 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00433B57,004343DB,?,00000000,00000000,00000000,?,00433CD0,00000022,FlsSetValue,004740A0,004740A8,00000000), ref: 00433B09

Strings

ext-ms-, xrefs: 00433AB3
api-ms-, xrefs: 00433A9F

Memory Dump Source

Source File: 00000000.00000002.1505362557.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1505362557.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LayyB0R.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 2b9994b2bbd4ec7bb9f69d4717ff7e2925b3815c011d12a359ccfcec31050e2c
Instruction ID: 701d92ca15afa7f270cc4f408c9fe8fc21a2fe6e402611b2d20f0705e1605e89
Opcode Fuzzy Hash: 2b9994b2bbd4ec7bb9f69d4717ff7e2925b3815c011d12a359ccfcec31050e2c
Instruction Fuzzy Hash: 7421E731A04211ABDB21FF24AC41A5B7B68DB49761F251222FD46A7391DB78EF00C6D8

Function 0042DE91 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0042DE88,0042DCBC,0042CD15), ref: 0042DE9F
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0042DEAD
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0042DEC6
SetLastError.KERNEL32(00000000,0042DE88,0042DCBC,0042CD15), ref: 0042DF18

Memory Dump Source

Source File: 00000000.00000002.1505362557.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1505362557.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LayyB0R.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: c3eb6bf0a7234faedb7c0a201c394f7478a2313920b75adf210bd18b39fa6472
Instruction ID: 4c524e6e54e895b205e2a647cd7641f8164f43047676a93b51c3844bd5b636a9
Opcode Fuzzy Hash: c3eb6bf0a7234faedb7c0a201c394f7478a2313920b75adf210bd18b39fa6472
Instruction Fuzzy Hash: 89016432B082315EB62433B27C8587B27A4DB56378762033FF128852E0EF284C66A14E

Function 0214E0F8 Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0214E0EF,0214DF23,0214CF7C), ref: 0214E106
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0214E114
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0214E12D
SetLastError.KERNEL32(00000000,0214E0EF,0214DF23,0214CF7C), ref: 0214E17F

Memory Dump Source

Source File: 00000000.00000002.1505624302.0000000002120000.00000040.00001000.00020000.00000000.sdmp, Offset: 02120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2120000_LayyB0R.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: c3eb6bf0a7234faedb7c0a201c394f7478a2313920b75adf210bd18b39fa6472
Instruction ID: 809152b10a3c28ee61379df7ad4c3ad73066a6c97e1e34e1079f369ecbd9b929
Opcode Fuzzy Hash: c3eb6bf0a7234faedb7c0a201c394f7478a2313920b75adf210bd18b39fa6472
Instruction Fuzzy Hash: 6801F2322C83215EBB7937B46C88A6B2BA6FB46F74721023DF53C821E0EF118C569546

Function 0043200D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\LayyB0R.exe, xrefs: 00432029

Memory Dump Source

Source File: 00000000.00000002.1505362557.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1505362557.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LayyB0R.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\LayyB0R.exe
API String ID: 0-3361696360
Opcode ID: af959c50f9ceb22731f565f3fb959b59621721a55135329773564823bcb7b730
Instruction ID: ad3e3ed31c10cde0997af27abe55d792c07127680f7ced24e6d8497351ae1d10
Opcode Fuzzy Hash: af959c50f9ceb22731f565f3fb959b59621721a55135329773564823bcb7b730
Instruction Fuzzy Hash: 1B21F971200216AFDB28AF72CE4196B7779FF08368F10551BFA159B251D778EC05C768

Function 02152274 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\LayyB0R.exe, xrefs: 02152290

Memory Dump Source

Source File: 00000000.00000002.1505624302.0000000002120000.00000040.00001000.00020000.00000000.sdmp, Offset: 02120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2120000_LayyB0R.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\Desktop\LayyB0R.exe
API String ID: 0-3361696360
Opcode ID: af959c50f9ceb22731f565f3fb959b59621721a55135329773564823bcb7b730
Instruction ID: d6991f67fe6eb0aedffa7f86c71a6b53c623900972e50adfd05715ee1141ac4d
Opcode Fuzzy Hash: af959c50f9ceb22731f565f3fb959b59621721a55135329773564823bcb7b730
Instruction Fuzzy Hash: 9F219373680225EFDB64AFA5CC8096B77AAEF1936470185A8ED3597250D731ED00CBA0

Function 0043001E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,5DBA7D75,?,?,00000000,00438ADF,000000FF,?,0042FFFA,00000002,?,0042FFCB,00430877), ref: 00430053
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00430065
FreeLibrary.KERNEL32(00000000,?,?,00000000,00438ADF,000000FF,?,0042FFFA,00000002,?,0042FFCB,00430877), ref: 00430087

Strings

mscoree.dll, xrefs: 0043004C
CorExitProcess, xrefs: 0043005D

Memory Dump Source

Source File: 00000000.00000002.1505362557.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1505362557.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LayyB0R.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 65f550cb3e6f7ffa6512f9fcd5b93e87532d598a35e95b34558b3b73d281781c
Instruction ID: 9ddb27ef9bb45fbe9de7f2c848ff8ceee15d63003235df1ee0023fccde4d79f4
Opcode Fuzzy Hash: 65f550cb3e6f7ffa6512f9fcd5b93e87532d598a35e95b34558b3b73d281781c
Instruction Fuzzy Hash: 0C01A735900659EFDB259F50DC05BAFB7B9FB09B10F004626F811A2290DBB89C00CA58

Function 00430BA2 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00430C27
__alloca_probe_16.LIBCMT ref: 00430CF0
__freea.LIBCMT ref: 00430D57

Part of subcall function 00433511: HeapAlloc.KERNEL32(00000000,00432586,?,?,00432586,00000220,?,00000000,?), ref: 00433543

__freea.LIBCMT ref: 00430D6A
__freea.LIBCMT ref: 00430D77

Memory Dump Source

Source File: 00000000.00000002.1505362557.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1505362557.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LayyB0R.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 3230ddc416008924cf0954a4264170ddc79692ceb8cb15dab18b7fb941252935
Instruction ID: eace223344cde17d2edb028cd1fdc56d7f0f867d81659f41c1869f0ae689ef47
Opcode Fuzzy Hash: 3230ddc416008924cf0954a4264170ddc79692ceb8cb15dab18b7fb941252935
Instruction Fuzzy Hash: 1251B571600206AFEB215FA5CC51EBB77E9DF48B14F15122EFD04D6251EB38ED50C668

Function 0214C161 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0214C16A
RtlAllocateHeap.NTDLL(00000000,00000008,00040000), ref: 0214C1BD

Part of subcall function 0214C252: RtlAllocateHeap.NTDLL(?,00000008,00000010), ref: 0214C25D

Strings

0d, xrefs: 0214C183
@-d, xrefs: 0214C179, 0214C188, 0214C237, 0214C23D, 0214C243

Memory Dump Source

Source File: 00000000.00000002.1505624302.0000000002120000.00000040.00001000.00020000.00000000.sdmp, Offset: 02120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2120000_LayyB0R.jbxd

Yara matches

Similarity

API ID: Heap$Allocate$Process
String ID: 0d$@-d
API String ID: 980559045-254180037
Opcode ID: d4c341f74e060cd561d315f63606d6c5e1f892c1824839db415b7060855c419f
Instruction ID: bda9e7e40cd79fa65a99ee8a4a5d6a876772a82b04cfe512143499b0e47abde5
Opcode Fuzzy Hash: d4c341f74e060cd561d315f63606d6c5e1f892c1824839db415b7060855c419f
Instruction Fuzzy Hash: 68313A71941209EFCB10CFA9D884FAEBBF4EB49744F10802AE959A7250DB75A941CB98

Function 0042E0B3 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,0042E064,00000000,?,0047B508,?,?,?,0042E207,00000004,InitializeCriticalSectionEx,00472CE8,InitializeCriticalSectionEx), ref: 0042E0C0
GetLastError.KERNEL32(?,0042E064,00000000,?,0047B508,?,?,?,0042E207,00000004,InitializeCriticalSectionEx,00472CE8,InitializeCriticalSectionEx,00000000,?,0042DF87), ref: 0042E0CA
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 0042E0F2

Strings

api-ms-, xrefs: 0042E0D7

Memory Dump Source

Source File: 00000000.00000002.1505362557.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1505362557.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LayyB0R.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: e97cb8aef0451175157745688cbe99fad46fbc073c2e7ab4228f61846e837a09
Instruction ID: a9f9758dc7447ee91e21cc9657b3a9e7bcae6e54e9dde0c25938df980e33f7bf
Opcode Fuzzy Hash: e97cb8aef0451175157745688cbe99fad46fbc073c2e7ab4228f61846e837a09
Instruction Fuzzy Hash: 8DE01230340325B7EF205B52ED06B5A3A65AB11B51F508031FA0DE41A1DFE59961954C

Function 004355A9 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(5DBA7D75,00000000,00000000,?), ref: 0043560C

Part of subcall function 00432BDB: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00430D4D,?,00000000,-00000008), ref: 00432C3C

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0043585E
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 004358A4
GetLastError.KERNEL32 ref: 00435947

Memory Dump Source

Source File: 00000000.00000002.1505362557.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1505362557.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LayyB0R.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: b4cbff27fd4ab21845aba02c09109cc48990d3ec193e972a02813d8f5f450ba4
Instruction ID: 51e358ba8c1ceb706a909722da25d8c7b1e269b7874c46722394f45778562d45
Opcode Fuzzy Hash: b4cbff27fd4ab21845aba02c09109cc48990d3ec193e972a02813d8f5f450ba4
Instruction Fuzzy Hash: 99D18BB5D00648DFCB14CFA8D880AAEBBB9FF0D314F25452AE45AEB351D734A942CB54

Function 02155810 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(0047A8A8,00000000,00000000,?), ref: 02155873

Part of subcall function 02152E42: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,02150FB4,?,00000000,-00000008), ref: 02152EA3

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 02155AC5
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 02155B0B
GetLastError.KERNEL32 ref: 02155BAE

Memory Dump Source

Source File: 00000000.00000002.1505624302.0000000002120000.00000040.00001000.00020000.00000000.sdmp, Offset: 02120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2120000_LayyB0R.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: b4cbff27fd4ab21845aba02c09109cc48990d3ec193e972a02813d8f5f450ba4
Instruction ID: a0a67575e6681dfbb8cc2f7f622e1235a404acf60c30154f729f7cbf15848db6
Opcode Fuzzy Hash: b4cbff27fd4ab21845aba02c09109cc48990d3ec193e972a02813d8f5f450ba4
Instruction Fuzzy Hash: 3AD19EB5D00258EFCF14CFA8D884AADBBB6FF08314F5441AAE866EB351D730A941CB50

Function 0042E5EA Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0042E6B1
___AdjustPointer.LIBCMT ref: 0042E6D4
___AdjustPointer.LIBCMT ref: 0042E770

Memory Dump Source

Source File: 00000000.00000002.1505362557.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1505362557.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LayyB0R.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 893888af18e71582d7d8a6e2594258244a1919dfa8c6d50e086ea7ae5b819a09
Instruction ID: a38d2b6541b71c520280f613d6ec420bae21797082b0ad144b49c478ca17333c
Opcode Fuzzy Hash: 893888af18e71582d7d8a6e2594258244a1919dfa8c6d50e086ea7ae5b819a09
Instruction Fuzzy Hash: 5351E571700226AFDB288F12F841BAB77A5EFA4304F94452FE80557391D779EC81C798

Function 0214E851 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0214E918
___AdjustPointer.LIBCMT ref: 0214E93B
___AdjustPointer.LIBCMT ref: 0214E9D7

Memory Dump Source

Source File: 00000000.00000002.1505624302.0000000002120000.00000040.00001000.00020000.00000000.sdmp, Offset: 02120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2120000_LayyB0R.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 893888af18e71582d7d8a6e2594258244a1919dfa8c6d50e086ea7ae5b819a09
Instruction ID: 044ee947940c5b9b90503203c68fc87cf5afd6064729951cf8471d9c2dfd3ce8
Opcode Fuzzy Hash: 893888af18e71582d7d8a6e2594258244a1919dfa8c6d50e086ea7ae5b819a09
Instruction Fuzzy Hash: B251A1B2A81202EFEF299F54D840BBAB7A5FF44314F14456EE81D962E0DF31E941CB90

Function 0214BF39 Relevance: 6.1, APIs: 4, Instructions: 132memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0214C29A: RtlAllocateHeap.NTDLL(?,00000008,00000001), ref: 0214C2D0
Part of subcall function 0214C29A: _strlen.LIBCMT ref: 0214C2F7
Part of subcall function 0214C29A: HeapFree.KERNEL32(?,00000000,00000000,?,00000000), ref: 0214C44B

RtlAllocateHeap.NTDLL(00000000,00000008,?), ref: 0214BF8E
RtlAllocateHeap.NTDLL(00000000,00000008,00000015), ref: 0214C035
RtlAllocateHeap.NTDLL(00000000,00000008,?), ref: 0214C07A

Part of subcall function 0214C252: RtlAllocateHeap.NTDLL(?,00000008,00000010), ref: 0214C25D

HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0214C0BB

Memory Dump Source

Source File: 00000000.00000002.1505624302.0000000002120000.00000040.00001000.00020000.00000000.sdmp, Offset: 02120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2120000_LayyB0R.jbxd

Yara matches

Similarity

API ID: Heap$Allocate$Free$_strlen
String ID:
API String ID: 3997513149-0
Opcode ID: f53d8b809367e930981b9f67468d851460710721d0c2411bbbfb01b5a60a3957
Instruction ID: 87c6bfb4bb796039296c303c9772c00ef6e1ae08cd452dd58f6fd33ba66ac69c
Opcode Fuzzy Hash: f53d8b809367e930981b9f67468d851460710721d0c2411bbbfb01b5a60a3957
Instruction Fuzzy Hash: 9F417CBA540305AFD720DF94DC44F6BB7E8AF44708F04482EFA8993241EB75E914CB96

Function 004318A9 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00432BDB: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00430D4D,?,00000000,-00000008), ref: 00432C3C

GetLastError.KERNEL32 ref: 0043190D
__dosmaperr.LIBCMT ref: 00431914
GetLastError.KERNEL32(?,?,?,?), ref: 0043194E
__dosmaperr.LIBCMT ref: 00431955

Memory Dump Source

Source File: 00000000.00000002.1505362557.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1505362557.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LayyB0R.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: d5d81d66b65ad09e41a19373382a09ae2f9af2f18da878edb6234075b2c35934
Instruction ID: b5a63444dd780b6f6c4a24546968ac13a97be2a1639071e31cdd29044f6b5631
Opcode Fuzzy Hash: d5d81d66b65ad09e41a19373382a09ae2f9af2f18da878edb6234075b2c35934
Instruction Fuzzy Hash: 7721C571600605AFDB20AFA2C89196BB7A9EF0C378F10552AF81597260D739EC41C7A8

Function 02151B10 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 02152E42: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,02150FB4,?,00000000,-00000008), ref: 02152EA3

GetLastError.KERNEL32 ref: 02151B74
__dosmaperr.LIBCMT ref: 02151B7B
GetLastError.KERNEL32(?,?,?,?), ref: 02151BB5
__dosmaperr.LIBCMT ref: 02151BBC

Memory Dump Source

Source File: 00000000.00000002.1505624302.0000000002120000.00000040.00001000.00020000.00000000.sdmp, Offset: 02120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2120000_LayyB0R.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: d5d81d66b65ad09e41a19373382a09ae2f9af2f18da878edb6234075b2c35934
Instruction ID: b06f7b2941d86919334e592c047d344ff3e470cc93f6c11d19d2656b4c5c5889
Opcode Fuzzy Hash: d5d81d66b65ad09e41a19373382a09ae2f9af2f18da878edb6234075b2c35934
Instruction Fuzzy Hash: E521B671680625FF9B35AFA9C880B6BB7BAEF053647018598ED3D97110E731EC10CB90

Function 00432C7E Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00432C86

Part of subcall function 00432BDB: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00430D4D,?,00000000,-00000008), ref: 00432C3C

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00432CBE
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00432CDE

Memory Dump Source

Source File: 00000000.00000002.1505362557.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1505362557.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LayyB0R.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: e1d1cfe4224bd6d605f767870ae2c5bad661794c0040ce08366285e2c0b68a1f
Instruction ID: 608a9734fde1ec8eee3d3293c4006d0f06b7e9441533a69e02f1924e93b15e95
Opcode Fuzzy Hash: e1d1cfe4224bd6d605f767870ae2c5bad661794c0040ce08366285e2c0b68a1f
Instruction Fuzzy Hash: 951104B59001157E67112B726E89CAF7A6CDE8D3A9F24212BF40191251FEB8DD0182B9

Function 02152EE5 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 02152EED

Part of subcall function 02152E42: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,02150FB4,?,00000000,-00000008), ref: 02152EA3

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 02152F25
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 02152F45

Memory Dump Source

Source File: 00000000.00000002.1505624302.0000000002120000.00000040.00001000.00020000.00000000.sdmp, Offset: 02120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2120000_LayyB0R.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: e1d1cfe4224bd6d605f767870ae2c5bad661794c0040ce08366285e2c0b68a1f
Instruction ID: 4a31e8829ac4e5683005308ee794da8d68898eccfff9cfacb07d941cafd898fa
Opcode Fuzzy Hash: e1d1cfe4224bd6d605f767870ae2c5bad661794c0040ce08366285e2c0b68a1f
Instruction Fuzzy Hash: 1E1122B7944235FE671227B16C88D6F7AAEDE862D431402E5FC25D1100EB74DD008AB4

Function 02153CAF Relevance: 6.1, APIs: 4, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,02153DBE,02154642,?,00000000,00000000,00000000,?,02153F37,00000022,00472CDC,004740A0,004740A8,00000000), ref: 02153D70

Memory Dump Source

Source File: 00000000.00000002.1505624302.0000000002120000.00000040.00001000.00020000.00000000.sdmp, Offset: 02120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2120000_LayyB0R.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 2b9994b2bbd4ec7bb9f69d4717ff7e2925b3815c011d12a359ccfcec31050e2c
Instruction ID: 0bde3c924e677d3e7bdb00928f097d86705c6490475bdaee0e62ec7644b5d2ed
Opcode Fuzzy Hash: 2b9994b2bbd4ec7bb9f69d4717ff7e2925b3815c011d12a359ccfcec31050e2c
Instruction Fuzzy Hash: 2921EB31A40135EBD7229B60DC41B5A3778DB427E0B1505E1FD35A7290D731ED00C6E4

Function 00436D66 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,00436520,00000000,00000001,00000000,?,?,0043599B,?,00000000,00000000), ref: 00436D7D
GetLastError.KERNEL32(?,00436520,00000000,00000001,00000000,?,?,0043599B,?,00000000,00000000,?,?,?,00435F3E,00000000), ref: 00436D89

Part of subcall function 00436D4F: CloseHandle.KERNEL32(FFFFFFFE,00436D99,?,00436520,00000000,00000001,00000000,?,?,0043599B,?,00000000,00000000,?,?), ref: 00436D5F

___initconout.LIBCMT ref: 00436D99

Part of subcall function 00436D11: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00436D40,0043650D,?,?,0043599B,?,00000000,00000000,?), ref: 00436D24

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,00436520,00000000,00000001,00000000,?,?,0043599B,?,00000000,00000000,?), ref: 00436DAE

Memory Dump Source

Source File: 00000000.00000002.1505362557.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1505362557.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LayyB0R.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: cf6ea9a65e43c229ecdbaac8f2c98c14aab39449d773b73dc703fe6c6485b977
Instruction ID: 5083f7f303b468fe56f9e97aaa619913868a22d3358b886830ad9e3c2d69f757
Opcode Fuzzy Hash: cf6ea9a65e43c229ecdbaac8f2c98c14aab39449d773b73dc703fe6c6485b977
Instruction Fuzzy Hash: 10F0123660016ABBCF625F91DC05ADB3F26FB09371F018021FE1885130D6328D60EBD8

Function 02156FCD Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,02156787,00000000,00000001,00000000,?,?,02155C02,?,00000000,00000000), ref: 02156FE4
GetLastError.KERNEL32(?,02156787,00000000,00000001,00000000,?,?,02155C02,?,00000000,00000000,?,?,?,021561A5,00000000), ref: 02156FF0

Part of subcall function 02156FB6: CloseHandle.KERNEL32(0047B0F0,02157000,?,02156787,00000000,00000001,00000000,?,?,02155C02,?,00000000,00000000,?,?), ref: 02156FC6

___initconout.LIBCMT ref: 02157000

Part of subcall function 02156F78: CreateFileW.KERNEL32(00476188,40000000,00000003,00000000,00000003,00000000,00000000,02156FA7,02156774,?,?,02155C02,?,00000000,00000000,?), ref: 02156F8B

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,02156787,00000000,00000001,00000000,?,?,02155C02,?,00000000,00000000,?), ref: 02157015

Memory Dump Source

Source File: 00000000.00000002.1505624302.0000000002120000.00000040.00001000.00020000.00000000.sdmp, Offset: 02120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2120000_LayyB0R.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: cf6ea9a65e43c229ecdbaac8f2c98c14aab39449d773b73dc703fe6c6485b977
Instruction ID: a8dfeaae2327648469c95ec2590b17ada78ff99d29413047f6506c840bd3a472
Opcode Fuzzy Hash: cf6ea9a65e43c229ecdbaac8f2c98c14aab39449d773b73dc703fe6c6485b977
Instruction Fuzzy Hash: E1F0F836540169FBCF221F91AC05A9A7F66FB0A2B1B004060FE2885120D7328960ABD4

Function 00435E5C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 196fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004355A9: GetConsoleOutputCP.KERNEL32(5DBA7D75,00000000,00000000,?), ref: 0043560C

WriteFile.KERNEL32(?,?,00000000,?,00000000,?,00000000,00000000,00000000,?,?,00000000,?,?,00434548,?), ref: 00435FE1
GetLastError.KERNEL32(?,?,00434548,?,004343DB,00000000,?,00000000,004343DB,?,?,?,00477898,0000002C,0043444C,?), ref: 00435FEB

Strings

HEC, xrefs: 00435F63, 0043600C

Memory Dump Source

Source File: 00000000.00000002.1505362557.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1505362557.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LayyB0R.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID: HEC
API String ID: 2915228174-3809717760
Opcode ID: 875ed4caef2ba3b8c44ea95059b68dd271ddda11c5d8c5e028be2ec9587d80b8
Instruction ID: 5a8df784fa6fddbf3b6aa5c5635f95a91e4df5003a71c3995b1d26c88b7e0b06
Opcode Fuzzy Hash: 875ed4caef2ba3b8c44ea95059b68dd271ddda11c5d8c5e028be2ec9587d80b8
Instruction Fuzzy Hash: DF61C371C0451AAFDF15DFA8C845AEFBBB9AF0D308F15118AE804A7252D33AD901CB99

Function 0214DBA7 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0214DBE6
__IsNonwritableInCurrentImage.LIBCMT ref: 0214DC9A

Strings

csm, xrefs: 0214DC84

Memory Dump Source

Source File: 00000000.00000002.1505624302.0000000002120000.00000040.00001000.00020000.00000000.sdmp, Offset: 02120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2120000_LayyB0R.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 727bd755396df652e1a708ec171ae51c463fec0952143e88064398cf5f6b08bc
Instruction ID: 12d47c9e3061a1e24149acf0ee234fe3bd36b3cbb3515bb42320142697f52ce3
Opcode Fuzzy Hash: 727bd755396df652e1a708ec171ae51c463fec0952143e88064398cf5f6b08bc
Instruction Fuzzy Hash: D7418130A4021DAFCF10DF68D884A9EBBB5BF45318F1481A9EC1D9B391DB71AA51CF91

Function 0042EBE6 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 0042EC0B

Strings

MOC, xrefs: 0042EC1D
RCC, xrefs: 0042EC25

Memory Dump Source

Source File: 00000000.00000002.1505362557.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1505362557.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LayyB0R.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 60d334a2babda9015152320fb1b56685fe8a5b2565357ad46f9000524526b17b
Instruction ID: f6177e7823097d9f83aa6b0a93fd605ee05562e7b9c8208c8f5f3ed515438118
Opcode Fuzzy Hash: 60d334a2babda9015152320fb1b56685fe8a5b2565357ad46f9000524526b17b
Instruction Fuzzy Hash: 88419D71A00219AFCF15DF96DD81AEEBBB5FF48304F54409AF904B7221D3399950DB58

Function 0214EE4D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 0214EE72

Strings

MOC, xrefs: 0214EE84
RCC, xrefs: 0214EE8C

Memory Dump Source

Source File: 00000000.00000002.1505624302.0000000002120000.00000040.00001000.00020000.00000000.sdmp, Offset: 02120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2120000_LayyB0R.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 60d334a2babda9015152320fb1b56685fe8a5b2565357ad46f9000524526b17b
Instruction ID: 056ef7544d7b35a51e0c043c53d5e9352a32caa438ad20963134b7701c211057
Opcode Fuzzy Hash: 60d334a2babda9015152320fb1b56685fe8a5b2565357ad46f9000524526b17b
Instruction Fuzzy Hash: E2413871940209AFDF15DFA8CD80AEEBBB5BF48304F188159F918B7260DB35A951DF50

Function 0214C0CC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000008,00000014), ref: 0214C0DD

Strings

0d, xrefs: 0214C0F8, 0214C109
@-d, xrefs: 0214C0FE

Memory Dump Source

Source File: 00000000.00000002.1505624302.0000000002120000.00000040.00001000.00020000.00000000.sdmp, Offset: 02120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2120000_LayyB0R.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID: 0d$@-d
API String ID: 1279760036-254180037
Opcode ID: 856209f30ecbbe190187eac75280585fdedc4530504fb61483039f127a241cfc
Instruction ID: 4dd11cebabe763cb9794ab0697c06067718e7ea8f2ee6a37dca746396aceb887
Opcode Fuzzy Hash: 856209f30ecbbe190187eac75280585fdedc4530504fb61483039f127a241cfc
Instruction Fuzzy Hash: 00F092B06493119FD314CF15E854A56BBE5FB89B14F05886EA4499B3A1CB709800DF95

Analysis Process: svchost.exePID: 768, Parent PID: 932COMMON

Executed Functions

Function 004702D8 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 169memoryfileCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,00000000,?,?), ref: 00470326

Part of subcall function 004700A4: VirtualAlloc.KERNELBASE(00000000,00001012,00001000,00000004), ref: 004700CD
Part of subcall function 004700A4: VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 00470279

VirtualAlloc.KERNELBASE(00000000,00400000,00001000,00000004), ref: 00470378
VirtualProtect.KERNELBASE(0000002C,?,00000040,?), ref: 004703E7
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 00470407
MapViewOfFile.KERNELBASE(?,00000004,00000000,00000000,00000000), ref: 0047042E
VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 00470456
CloseHandle.KERNELBASE(?), ref: 00470471

Strings

,, xrefs: 00470356

Memory Dump Source

Source File: 00000002.00000003.1494333800.0000000000470000.00000040.00000001.00020000.00000000.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_470000_svchost.jbxd

Similarity

API ID: Virtual$Alloc$Free$CloseFileHandleProtectView
String ID: ,
API String ID: 3867569247-3772416878
Opcode ID: 35eb397ea14406336b01ea38f36e06f8461e94550e7b98cd084062937234d485
Instruction ID: bbc27c51bab0151f64639bd0d4ba272fb0f23aff4905bd1b69da4b8698ff2a05
Opcode Fuzzy Hash: 35eb397ea14406336b01ea38f36e06f8461e94550e7b98cd084062937234d485
Instruction Fuzzy Hash: 49611CB1901209EFDB20DFA5C884ADEBBB8FF08354F14C51AFA59E7241D734A941CB64

Function 004700A4 Relevance: 4.7, APIs: 2, Strings: 1, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00001012,00001000,00000004), ref: 004700CD
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 00470279

Strings

E0G, xrefs: 00470273

Memory Dump Source

Source File: 00000002.00000003.1494333800.0000000000470000.00000040.00000001.00020000.00000000.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_470000_svchost.jbxd

Similarity

API ID: Virtual$AllocFree
String ID: E0G
API String ID: 2087232378-3203298553
Opcode ID: 7dc8e79fde86babc96161718fc4e5f80a5398d7d893a888eaa0e52eee754c683
Instruction ID: 3ef5ed364e465240f52a290152e68ac880e396e6faa2f85b37136264b24ca6fe
Opcode Fuzzy Hash: 7dc8e79fde86babc96161718fc4e5f80a5398d7d893a888eaa0e52eee754c683
Instruction Fuzzy Hash: 24719D71A05249DFDB41CF98C985BEEBBF0EB09314F248096E465F7241C238AA91DF69

Function 00470230 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 00470279

Strings

E0G, xrefs: 00470273

Memory Dump Source

Source File: 00000002.00000003.1494333800.0000000000470000.00000040.00000001.00020000.00000000.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_470000_svchost.jbxd

Similarity

API ID: FreeVirtual
String ID: E0G
API String ID: 1263568516-3203298553
Opcode ID: 72cd1d773d33be3c714891ca11413f6904648207820b321c7b6ca4a788c60533
Instruction ID: 496b778556754ac983e3777aca01de317441c7448d07e980a108e6527f44b01e
Opcode Fuzzy Hash: 72cd1d773d33be3c714891ca11413f6904648207820b321c7b6ca4a788c60533
Instruction Fuzzy Hash: AEF0F931A05209DFCB41CF58C981BEEBBF0EB14300F608082E489F7251D634EE41DB65

Analysis Process: fontdrvhost.exePID: 5624, Parent PID: 932COMMON

Execution Graph

Execution Coverage:	33.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	83.3%
Total number of Nodes:	24
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00000227FA631CF4 Relevance: 3.3, APIs: 2, Instructions: 278
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAcceptConnectPort.NTDLL ref: 00000227FA631F92
CloseHandle.KERNELBASE ref: 00000227FA631F9B

Memory Dump Source

Source File: 00000006.00000002.1659165600.00000227FA630000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000227FA630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_227fa630000_fontdrvhost.jbxd

Similarity

API ID: AcceptCloseConnectHandlePort
String ID:
API String ID: 3811980168-0
Opcode ID: c28fd07678fc221e1754ee083f118103e9e8097afeb12f13d48dc470bfa4e84b
Instruction ID: 36668ba4ad75529eb6c700593c0657b4be4fd2538bdf5434d99d5fd739bf2c61
Opcode Fuzzy Hash: c28fd07678fc221e1754ee083f118103e9e8097afeb12f13d48dc470bfa4e84b
Instruction Fuzzy Hash: 5F91903090CF089FDB64EB58C5857E573E1FB98310F14465EE48BC77A6EA78A9428B81

Function 00000227FA630AC8 Relevance: 3.2, APIs: 2, Instructions: 185
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAcceptConnectPort.NTDLL ref: 00000227FA630C14
NtAcceptConnectPort.NTDLL ref: 00000227FA630C5E

Memory Dump Source

Source File: 00000006.00000002.1659165600.00000227FA630000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000227FA630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_227fa630000_fontdrvhost.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: 275693e7d66e5d53f7e2184dfa7c88ce453f9d9d0d3e8ba4525500231a394657
Instruction ID: 3e993bf34f40f136982ce89cb90ebe6d3eaabae809b74bdcff787a9bd5ab1ca2
Opcode Fuzzy Hash: 275693e7d66e5d53f7e2184dfa7c88ce453f9d9d0d3e8ba4525500231a394657
Instruction Fuzzy Hash: 2751273091CA590AE32CA6788899678B7D4FB81305F34055ED0F3C5BA3E92DC54B9782

Function 00000227FA631AA4 Relevance: 3.2, APIs: 2, Instructions: 150
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAcceptConnectPort.NTDLL ref: 00000227FA631AE9

Part of subcall function 00000227FA631870: GetProcessMitigationPolicy.KERNELBASE ref: 00000227FA631943

NtAcceptConnectPort.NTDLL ref: 00000227FA631BE3

Memory Dump Source

Source File: 00000006.00000002.1659165600.00000227FA630000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000227FA630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_227fa630000_fontdrvhost.jbxd

Similarity

API ID: AcceptConnectPort$MitigationPolicyProcess
String ID:
API String ID: 2923266908-0
Opcode ID: e7c877b781110a0d6e647df344fb2e40eb660a4b7f668a210715c22aed20397b
Instruction ID: 7da8c7a0eba3c6e24c969db5e6404f6dbbf5452723bdb3823a2f9c7e291d97ed
Opcode Fuzzy Hash: e7c877b781110a0d6e647df344fb2e40eb660a4b7f668a210715c22aed20397b
Instruction Fuzzy Hash: F641F13060CB488FDB44DF2C98897957BD1EB55320F0443AEE95ACB3E7DA38C94A8795

Function 00000227FA6315C0 Relevance: 1.6, APIs: 1, Instructions: 76
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAcceptConnectPort.NTDLL(?,?,?,?,?,?,?,?,00000000,00000227FA631E3A), ref: 00000227FA631654

Memory Dump Source

Source File: 00000006.00000002.1659165600.00000227FA630000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000227FA630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_227fa630000_fontdrvhost.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: 1eb38bd4e9810c4692bda8c47b34b9a63fb6abd40dd4841afe63035e04063970
Instruction ID: 71fab1c81072e20824c88ea5f5ce6279633aadef4220dee1536b4f5bb95f5edf
Opcode Fuzzy Hash: 1eb38bd4e9810c4692bda8c47b34b9a63fb6abd40dd4841afe63035e04063970
Instruction Fuzzy Hash: 8F219D7090CB088FDB58DF98C489A6AB7E1FBA9305F040A2EE44AC7721DB34D485CB41

Function 00000227FA631870 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessMitigationPolicy.KERNELBASE ref: 00000227FA631943

Memory Dump Source

Source File: 00000006.00000002.1659165600.00000227FA630000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000227FA630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_227fa630000_fontdrvhost.jbxd

Similarity

API ID: MitigationPolicyProcess
String ID:
API String ID: 1088084561-0
Opcode ID: 26f3b5b73fc16ab59c2c5e195c9b4eeee4e831d251455a47b6c64e26f9aa79e3
Instruction ID: cf2cfec8657fe0ba532261f9e983f1598c8130bde38895205b8a47f817dc4e69
Opcode Fuzzy Hash: 26f3b5b73fc16ab59c2c5e195c9b4eeee4e831d251455a47b6c64e26f9aa79e3
Instruction Fuzzy Hash: 1531933090CB079AEFA597AA85987F172D0EF94312F1401A9C016D7BE1EA7DC94AD640

Non-executed Functions

Function 00000227FA630511 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659165600.00000227FA630000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000227FA630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_227fa630000_fontdrvhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 247c94ababd4710b0196191072c8bbb5758b71c13019f7a788401a9348e82e18
Instruction ID: 1684949b0e2b346c4f6e13502068689c61c9b2d028cdf62c4328b71d82623ec0
Opcode Fuzzy Hash: 247c94ababd4710b0196191072c8bbb5758b71c13019f7a788401a9348e82e18
Instruction Fuzzy Hash: CFB01130E2AA00C2E3880E0AB8023A0F2B2C30B300F02B2322002F3220CA28CC08028F

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report LayyB0R.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Rhadamanthys

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_fontdrvhost.exe_d32c824e8915b30da4efd4eabd13e74e4ef8c1_ad0be647_d154cbee-f8eb-4fe1-8d9d-e4c690c727d0\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2CAB.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2CFB.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2D4A.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Windows Analysis Report
LayyB0R.exe

Function 0042BEFA Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 86
memoryCOMMON

Function 0212003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Function 0042BCD2 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 132
memoryCOMMON

Function 004392CC Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129
memoryCOMMON

Function 0042BC80 Relevance: 4.5, APIs: 3, Instructions: 30
synchronizationCOMMON

Function 00433C75 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 23
COMMONLIBRARYCODE

Function 02120E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Function 00431289 Relevance: 2.6, APIs: 2, Instructions: 67
COMMONLIBRARYCODE

Function 004391B0 Relevance: 1.4, APIs: 1, Instructions: 133
COMMON

Function 00439098 Relevance: 1.3, APIs: 1, Instructions: 30
memoryCOMMON